| |
| |||||||
Log-Analyse und Auswertung: GUV Trojaner / Auswertung OTL logfilesWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.02.2013, 13:08
| #1 |
 |  GUV Trojaner / Auswertung OTL logfiles Hallo Trojaner-board team, wie viele Andere hier habe ich mir letzte Woche auch den GUV Trojaner eingefangen. Wie im Forum vorgeschlagen habe ich mir OTL über eine Rescue Disc auf den infizierten Rechner geladen und den Scan wie beschrieben laufen lassen. Hier der Inhalt der OTL.txt datei (eine extra.txt konnte ich auf c: leider nicht finden). Code:
ATTFilter OTL logfile created on: 2/4/2013 12:17:57 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 8.0.6001.19393)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 359.62 Gb Total Space | 224.36 Gb Free Space | 62.39% Space Free | Partition Type: NTFS
Drive D: | 3.80 Gb Total Space | 3.80 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV - [2013/01/31 06:11:06 | 002,561,488 | ---- | M] () [Auto] -- C:\ProgramData\Browser Manager\2.6.1123.78\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe -- (Browser Manager)
SRV - [2013/01/28 14:34:15 | 000,184,832 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Users\Nora\wgsdgsdgdsgsd.exe -- (Winmgmt)
SRV - [2012/12/13 11:31:24 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/12/13 11:30:34 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/10/02 06:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/07/13 06:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/01/18 07:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand] -- C:\Program Files\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2010/03/18 04:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2008/11/25 07:40:16 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/11/21 22:33:20 | 000,303,104 | ---- | M] (Sony Corporation) [Auto] -- C:\Program Files\sony\Network Utility\NSUService.exe -- (NSUService)
SRV - [2008/11/05 12:32:28 | 000,203,624 | ---- | M] (Sony Corporation) [Auto] -- C:\Program Files\sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2008/10/21 04:52:38 | 000,353,568 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Sony\VAIO Media plus\SOHDms.exe -- (SOHDms)
SRV - [2008/10/21 04:52:38 | 000,062,752 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Sony\VAIO Media plus\SOHDs.exe -- (SOHDs)
SRV - [2008/10/21 04:52:36 | 000,103,712 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe -- (SOHCImp)
SRV - [2008/10/17 12:16:54 | 000,415,584 | ---- | M] (Sony Corporation) [Auto] -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe -- (VAIO Power Management)
SRV - [2008/10/17 05:28:57 | 000,102,400 | ---- | M] (Realtek Semiconductor) [Auto] -- C:\Windows\RTKAUDIOSERVICE.EXE -- (RtkAudioService)
SRV - [2008/10/01 12:18:48 | 000,369,952 | ---- | M] (Sony Corporation) [Auto] -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr)
SRV - [2008/09/19 04:06:22 | 000,083,232 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe -- (VcmXmlIfHelper)
SRV - [2008/09/18 04:59:10 | 000,104,960 | ---- | M] (ArcSoft, Inc.) [Auto] -- C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)
SRV - [2008/09/11 13:28:26 | 000,446,464 | ---- | M] (Sony Corporation) [Auto] -- C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw)
SRV - [2008/09/08 03:59:56 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe -- (VAIO Entertainment TV Device Arbitration Service)
SRV - [2008/09/08 03:59:54 | 000,192,512 | ---- | M] (Sony Corporation) [Auto] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe -- (VzCdbSvc)
SRV - [2008/09/08 03:59:52 | 000,279,848 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe -- (Vcsw)
SRV - [2008/08/20 10:38:30 | 000,860,160 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008/08/20 10:08:02 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008/07/09 08:43:14 | 000,131,072 | ---- | M] (AccSys GmbH) [Auto] -- C:\Program Files\Common Files\AccSys\accvssvc.exe -- (accvssvc)
SRV - [2008/05/19 19:51:34 | 000,077,824 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2008/05/19 19:49:04 | 000,053,248 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe -- (MSCSPTISRV)
SRV - [2008/05/19 19:29:06 | 000,053,248 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/10 18:45:04 | 000,124,832 | ---- | M] () [Auto] -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0)
SRV - [2007/01/04 13:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
DRV - [2012/12/13 11:31:36 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/12/13 11:31:35 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012/12/05 10:23:32 | 000,073,544 | ---- | M] (Citrix Systems, Inc.) [Kernel | System] -- C:\Windows\System32\drivers\ctxusbm.sys -- (ctxusbm)
DRV - [2012/11/13 11:54:13 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012/08/27 08:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/10/23 19:06:27 | 000,150,560 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2008/10/22 19:02:23 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\risdptsk.sys -- (risdptsk)
DRV - [2008/10/22 19:02:02 | 000,068,608 | ---- | M] (REDC) [Kernel | Auto] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2008/09/29 19:04:57 | 000,164,400 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008/09/24 19:44:13 | 003,847,168 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008/08/28 17:48:46 | 003,664,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008/08/22 10:22:42 | 000,010,216 | ---- | M] (Sony Corporation) [Kernel | System] -- C:\Windows\System32\drivers\DMICall.sys -- (DMICall)
DRV - [2008/08/21 19:06:22 | 000,009,344 | ---- | M] (Sony Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\SFEP.sys -- (SFEP)
DRV - [2008/06/06 19:02:55 | 000,131,000 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr)
DRV - [2008/04/24 08:06:40 | 000,017,920 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
DRV - [2008/01/24 21:14:25 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/06/05 08:37:14 | 000,042,000 | ---- | M] (CACE Technologies) [Kernel | Auto] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2007/04/17 14:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto] -- C:\Windows\System32\drivers\regi.sys -- (regi)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Nora_ON_C\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.claro-search.com/?affID=114508&tl=gbn193047&tt=4412_4&babsrc=HP_clro&mntrId=e6af4b2500000000000000215df0a852
IE - HKU\Nora_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com
IE - HKU\Nora_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKU\Nora_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Nora_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Nora_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Nora_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Nora_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: calendar-timezones@mozilla.org:0.1.2008d
FF - prefs.js..extensions.enabledItems: default-palette@celtx.com:1.0
FF - prefs.js..extensions.enabledItems: emoticons-msn-smileys@m513901.de:0.1
FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.0
FF - prefs.js..extensions.enabledItems: messagestyle-blackened@addons.instantbird.org:0.9
FF - prefs.js..extensions.enabledItems: messagestyle-depth@addons.instantbird.org:1.1
FF - prefs.js..extensions.enabledItems: messagestyle-minimal20@addons.instantbird.org:1.5
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Citrix.com/npagee,version=9.3.48.6: C:\Program Files\Citrix\Secure Access Client\npagee.dll (Citrix Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Citrix.com/npican: C:\Program Files\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.732: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.732: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=1.0.0.0: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.732: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files\sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Nora\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Nora\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Nora\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/05/01 08:10:10 | 000,000,000 | ---D | M]
[2012/10/30 13:19:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nora\AppData\Roaming\Mozilla\Extensions
[2012/10/30 13:19:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nora\AppData\Roaming\Mozilla\Extensions\celtx@celtx.com
[2012/10/30 12:54:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/10/30 12:54:16 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\CALENDAR-TIMEZONES@MOZILLA.ORG
[2012/10/30 12:54:16 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\DEFAULT-PALETTE@CELTX.COM
[2012/10/30 12:54:16 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE
[2012/10/30 12:54:16 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\INSPECTOR@MOZILLA.ORG
[2012/10/30 12:54:16 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-BLACKENED@ADDONS.INSTANTBIRD.ORG
[2012/10/30 12:54:16 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-DEPTH@ADDONS.INSTANTBIRD.ORG
[2012/10/30 12:54:16 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-MINIMAL20@ADDONS.INSTANTBIRD.ORG
O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Claro LTD Helper Object) - {000F18F2-09EB-4A59-82B2-5AE4184C39C3} - C:\Program Files\Claro LTD\claro\1.8.3.10\bh\claro.dll (Montera Technologeis LTD)
O2 - BHO: (Savings Sidekick) - {11111111-1111-1111-1111-110011501160} - C:\Program Files\Savings Sidekick\Savings Sidekick.dll (215 Apps)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Claro LTD Toolbar) - {9E131A93-EED7-4BEB-B015-A0ADB30B5646} - C:\Program Files\Claro LTD\claro\1.8.3.10\claroTlbr.dll (Montera Technologeis LTD)
O3 - HKU\Nora_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Nora_ON_C\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AML] C:\Program Files\Sony\VAIO Launcher\AML.exe (Sony)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CitrixReceiver] File not found
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [MarketingTools] C:\Program Files\sony\Marketing Tools\MarketingTools.exe (Sony Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Nora_ON_C..\Run: [Facebook Update] C:\Users\Nora\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\Nora_ON_C..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\Nora_ON_C..\Run: [NSUFloatingUI] C:\Program Files\Sony\Network Utility\LANUtil.exe (Sony Corporation)
O4 - HKU\Nora_ON_C..\Run: [pasui] File not found
O4 - HKU\Nora_ON_C..\Run: [Sony PC Companion] C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe (Sony)
O4 - Startup: C:\Users\Nora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Inhaltsverzeichnis.onetoc2 ()
O4 - Startup: C:\Users\Nora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O7 - HKU\Nora_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} https://xs1.nibc.com/CitrixSessionInit/ICAWEB/icaweb.cab (Citrix ICA Client)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - AppInit_DLLs: (c:\progra~2\browse~1\261123~1.78\{61d8b~1\browse~1.dll) - C:\ProgramData\Browser Manager\2.6.1123.78\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\VESWinlogon: DllName - VESWinlogon.dll - C:\Windows\System32\VESWinlogon.dll (Sony Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{cb101934-ce32-11df-81c2-001dbaadb8ff}\Shell - "" = AutoRun
O33 - MountPoints2\{cb101934-ce32-11df-81c2-001dbaadb8ff}\Shell\AutoRun\command - "" = H:\Startme.exe
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\Autorun\Autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2013/01/23 12:52:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Citrix
[2013/01/23 12:51:44 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/01/20 17:39:45 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/01/20 17:39:43 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013/01/20 17:39:41 | 002,048,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[1 C:\Users\Nora\AppData\Roaming\*.tmp files -> C:\Users\Nora\AppData\Roaming\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/02/04 04:28:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/02/02 06:06:37 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2013/02/02 05:46:59 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/02/02 05:46:59 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/02/02 04:55:49 | 000,001,879 | ---- | M] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
[2013/02/02 04:55:49 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2013/01/28 14:34:19 | 000,002,864 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.js
[2013/01/28 14:34:19 | 000,000,882 | ---- | M] () -- C:\Users\Nora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2013/01/28 13:54:12 | 000,002,631 | ---- | M] () -- C:\Users\Nora\Desktop\Microsoft Office Word 2007.lnk
[2013/01/28 12:39:24 | 000,001,076 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013/01/23 12:55:06 | 000,001,193 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix Receiver.lnk
[2013/01/23 12:50:43 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2013/01/21 07:16:11 | 000,367,664 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/01/20 21:20:10 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013/01/20 21:20:10 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/01/20 21:20:10 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013/01/20 21:20:10 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/01/20 17:13:42 | 000,002,037 | ---- | M] () -- C:\Users\Nora\Desktop\Google Chrome.lnk
[2013/01/20 16:59:53 | 000,000,372 | ---- | M] () -- C:\Windows\tasks\RNUpgradeHelperLogonPrompt_Nora.job
[2013/01/20 16:59:53 | 000,000,366 | ---- | M] () -- C:\Windows\tasks\ReclaimerUpdateFiles_Nora.job
[2013/01/20 16:59:53 | 000,000,362 | ---- | M] () -- C:\Windows\tasks\ReclaimerUpdateXML_Nora.job
[1 C:\Users\Nora\AppData\Roaming\*.tmp files -> C:\Users\Nora\AppData\Roaming\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/01/28 14:34:19 | 000,002,864 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.js
[2013/01/28 14:34:19 | 000,000,882 | ---- | C] () -- C:\Users\Nora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2013/01/28 14:34:16 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2013/01/23 12:55:06 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix Receiver.lnk
[2012/09/07 07:31:26 | 000,000,112 | ---- | C] () -- C:\ProgramData\58w3N8B42.dat
[2012/09/07 07:31:12 | 000,000,001 | ---- | C] () -- C:\ProgramData\LMUB1fPE.exe_.b
[2012/09/07 07:31:12 | 000,000,001 | ---- | C] () -- C:\ProgramData\LMUB1fPE.exe.b
[2012/09/01 10:12:48 | 000,000,051 | ---- | C] () -- C:\ProgramData\buzrwxbjfhfycaf
[2012/05/18 14:49:25 | 000,000,016 | ---- | C] () -- C:\Users\Nora\AppData\Roaming\blckdom.res
[2012/04/12 13:19:37 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2012/04/10 13:06:01 | 000,025,773 | ---- | C] () -- C:\Users\Nora\AppData\Roaming\UserTile.png
[2011/11/27 05:20:00 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/05/21 12:44:28 | 000,000,005 | ---- | C] () -- C:\Users\Nora\AppData\Roaming\openList.awt
[2010/05/21 12:44:28 | 000,000,005 | ---- | C] () -- C:\Users\Nora\AppData\Roaming\closedList.awt
[2010/05/13 15:27:34 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/05/13 15:27:34 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/05/01 07:48:20 | 000,011,776 | ---- | C] () -- C:\Users\Nora\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/27 14:06:26 | 000,002,032 | ---- | C] () -- C:\Users\Nora\AppData\Local\d3d9caps.dat
[2008/12/08 08:15:58 | 000,000,000 | ---- | C] () -- C:\Windows\VAIOUpdt.INI
[2008/12/08 08:07:41 | 000,344,064 | ---- | C] () -- C:\Windows\System32\SSMSIppCustom.dll
[2008/12/08 07:27:48 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008/11/25 13:42:47 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2008/11/25 13:42:47 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008/11/25 13:42:47 | 000,081,920 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2008/11/25 13:42:47 | 000,040,960 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2008/11/25 13:42:46 | 000,174,819 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008/11/25 13:42:46 | 000,090,112 | ---- | C] () -- C:\Windows\System32\atibrtmon.exe
[2008/11/25 05:35:50 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2008/11/25 05:10:02 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/11/25 05:05:53 | 000,001,076 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008/09/19 07:14:16 | 000,024,056 | ---- | C] () -- C:\Windows\System32\providers.bin
[2008/08/08 12:14:10 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/08/08 12:10:34 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/01/21 02:15:58 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/01/21 02:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/01/21 02:15:58 | 000,126,454 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/01/21 02:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,367,664 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2001/11/14 07:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
========== LOP Check ==========
[2011/05/24 06:24:05 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Amazon
[2012/10/30 12:54:38 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Babylon
[2012/07/01 14:35:14 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Bepyil
[2011/09/18 12:25:44 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Citrix
[2011/12/18 14:08:21 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\DVDVideoSoft
[2012/10/30 13:19:08 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Greyfirst
[2011/09/18 15:33:09 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\ICAClient
[2012/05/25 17:55:10 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Inqeby
[2011/01/15 16:47:13 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\InterVideo
[2012/05/18 14:49:28 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Kefef
[2012/05/18 14:49:11 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\kock
[2012/11/02 10:54:31 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Luvi
[2011/09/18 12:25:43 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Netscape
[2012/04/10 13:06:01 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\PeerNetworking
[2010/10/10 12:23:58 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Sony
[2012/05/18 14:48:37 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\TeamViewer
[2012/05/19 03:14:28 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\UAs
[2012/07/07 10:53:08 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Uchau
[2012/05/19 03:14:42 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\xmldm
[2012/07/05 13:15:55 | 000,000,000 | ---D | M] -- C:\Users\Nora\AppData\Roaming\Ytub
[2012/07/23 13:55:38 | 000,000,000 | ---D | M] -- C:\ProgramData\036DFF85000932A002C8B1902F3B707C
[2012/04/12 13:19:26 | 000,000,000 | ---D | M] -- C:\ProgramData\AccSys
[2010/04/27 14:02:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/07/09 12:59:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Avanquest Bluetooth SDK
[2012/09/01 10:12:53 | 000,000,000 | ---D | M] -- C:\ProgramData\aytwtgjwbsctxrn
[2012/10/30 12:54:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Babylon
[2013/02/02 05:05:27 | 000,000,000 | ---D | M] -- C:\ProgramData\Browser Manager
[2013/01/23 12:55:33 | 000,000,000 | ---D | M] -- C:\ProgramData\Citrix
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2010/04/27 14:02:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2010/04/27 14:02:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/10/30 12:54:37 | 000,000,000 | ---D | M] -- C:\ProgramData\IBUpdaterService
[2011/01/15 16:48:04 | 000,000,000 | ---D | M] -- C:\ProgramData\InterVideo
[2008/12/08 08:17:07 | 000,000,000 | ---D | M] -- C:\ProgramData\Roaming
[2012/07/08 05:20:01 | 000,000,000 | ---D | M] -- C:\ProgramData\Sony
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/04/27 14:02:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2006/11/02 08:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/12/08 08:06:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Uninstall
[2010/04/27 14:02:28 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2012/05/18 14:51:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Windows
[2012/06/05 11:21:59 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2010/09/17 16:12:33 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/11/07 12:18:01 | 000,000,902 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3256999809-2769954180-380837127-1000Core.job
[2012/11/07 15:18:05 | 000,000,924 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3256999809-2769954180-380837127-1000UA.job
[2013/01/20 16:59:53 | 000,000,366 | ---- | M] () -- C:\Windows\Tasks\ReclaimerUpdateFiles_Nora.job
[2013/01/20 16:59:53 | 000,000,362 | ---- | M] () -- C:\Windows\Tasks\ReclaimerUpdateXML_Nora.job
[2013/01/20 16:59:53 | 000,000,372 | ---- | M] () -- C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Nora.job
[2013/01/28 12:39:29 | 000,032,538 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
Gruß, Steve |
|
04.02.2013, 13:47
| #2 |
| /// Malware-holic   | GUV Trojaner / Auswertung OTL logfiles hi
__________________auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein: Code:
ATTFilter :OTL
O4 - Startup: C:\Users\Nora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
[2013/02/02 06:06:37 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2013/01/28 14:34:19 | 000,002,864 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.js
[2013/01/28 14:34:19 | 000,000,882 | ---- | M] () -- C:\Users\Nora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
:Files
C:\Users\Nora\wgsdgsdgdsgsd.exe
:Commands
[EMPTYFLASH]
[emptytemp]
dieses speicherst du auf nem usb stick als fix.txt nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist. • Klicke nun bitte auf den Fix Button. es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick. wenn dies nicht funktioniert, bitte den fix manuell eintragen. dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen, log posten bitte.
__________________ |
|
04.02.2013, 14:05
| #3 |
| | GUV Trojaner / Auswertung OTL logfiles Das hat schonmal super geklappt. Vielen Dank dafür! Allerdings hat sich die otl.txt nicht automatisch geöffnet. Wie kann ich sie alternativ finden / öffnen?
__________________ |
|
04.02.2013, 14:17
| #4 |
| /// Malware-holic | GUV Trojaner / Auswertung OTL logfiles hi solange der Pc läuft, passt das. Laden und ausführen: http://download.bleepingcomputer.com...ta/Winmgmt.reg Nachfrage bestätigen, neustarten. download tdss killer: http://www.trojaner-board.de/82358-t...entfernen.html Klicke auf Change parameters • Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system • Klick auf OK und anschließend auf Start scan - bei funden erst mal immer skip wählen, log posten c: öffnen, tdsskiller-datum-version.txt öffnen, Inhalt posten
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
04.02.2013, 14:31
| #5 |
| | GUV Trojaner / Auswertung OTL logfiles Alles gemacht! Hier das log-file von TDSS: Code:
ATTFilter 14:28:26.0405 5716 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
14:28:26.0590 5716 ============================================================
14:28:26.0590 5716 Current date / time: 2013/02/04 14:28:26.0590
14:28:26.0590 5716 SystemInfo:
14:28:26.0590 5716
14:28:26.0590 5716 OS Version: 6.0.6002 ServicePack: 2.0
14:28:26.0590 5716 Product type: Workstation
14:28:26.0590 5716 ComputerName: NORA-PC
14:28:26.0591 5716 UserName: Nora
14:28:26.0591 5716 Windows directory: C:\Windows
14:28:26.0591 5716 System windows directory: C:\Windows
14:28:26.0591 5716 Processor architecture: Intel x86
14:28:26.0591 5716 Number of processors: 2
14:28:26.0591 5716 Page size: 0x1000
14:28:26.0591 5716 Boot type: Normal boot
14:28:26.0591 5716 ============================================================
14:28:27.0434 5716 Drive \Device\Harddisk0\DR0 - Size: 0x5D27216000 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xBE01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
14:28:27.0439 5716 ============================================================
14:28:27.0439 5716 \Device\Harddisk0\DR0:
14:28:27.0440 5716 MBR partitions:
14:28:27.0440 5716 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x19FB800, BlocksNum 0x2CF3D0B0
14:28:27.0440 5716 ============================================================
14:28:27.0484 5716 C: <-> \Device\Harddisk0\DR0\Partition1
14:28:27.0484 5716 ============================================================
14:28:27.0484 5716 Initialize success
14:28:27.0484 5716 ============================================================
14:28:52.0947 2928 ============================================================
14:28:52.0947 2928 Scan started
14:28:52.0947 2928 Mode: Manual; SigCheck; TDLFS;
14:28:52.0947 2928 ============================================================
14:28:54.0636 2928 ================ Scan system memory ========================
14:28:54.0637 2928 System memory - ok
14:28:54.0637 2928 ================ Scan services =============================
14:28:54.0981 2928 [ 12582C7AB2F3B80E08B33A43EF602DA3 ] accvssvc C:\Program Files\Common Files\AccSys\AccVSSvc.exe
14:28:55.0248 2928 accvssvc ( UnsignedFile.Multi.Generic ) - warning
14:28:55.0248 2928 accvssvc - detected UnsignedFile.Multi.Generic (1)
14:28:55.0336 2928 [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
14:28:55.0751 2928 ACDaemon - ok
14:28:55.0946 2928 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
14:28:55.0988 2928 ACPI - ok
14:28:56.0093 2928 [ E8FE4FCE23D2809BD88BCC1D0F8408CE ] AdobeActiveFileMonitor6.0 C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
14:28:56.0130 2928 AdobeActiveFileMonitor6.0 - ok
14:28:56.0242 2928 [ 424877CB9D5517F980FF7BACA2EB379D ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
14:28:56.0276 2928 AdobeFlashPlayerUpdateSvc - ok
14:28:56.0367 2928 [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
14:28:56.0428 2928 adp94xx - ok
14:28:56.0467 2928 [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci C:\Windows\system32\drivers\adpahci.sys
14:28:56.0515 2928 adpahci - ok
14:28:56.0542 2928 [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
14:28:56.0586 2928 adpu160m - ok
14:28:56.0623 2928 [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
14:28:56.0655 2928 adpu320 - ok
14:28:56.0737 2928 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
14:28:56.0844 2928 AeLookupSvc - ok
14:28:56.0917 2928 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
14:28:57.0033 2928 AFD - ok
14:28:57.0079 2928 [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440 C:\Windows\system32\drivers\agp440.sys
14:28:57.0109 2928 agp440 - ok
14:28:57.0150 2928 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
14:28:57.0179 2928 aic78xx - ok
14:28:57.0226 2928 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
14:28:57.0389 2928 ALG - ok
14:28:57.0418 2928 [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide C:\Windows\system32\drivers\aliide.sys
14:28:57.0454 2928 aliide - ok
14:28:57.0527 2928 [ C47344BC706E5F0B9DCE369516661578 ] amdagp C:\Windows\system32\drivers\amdagp.sys
14:28:57.0566 2928 amdagp - ok
14:28:57.0613 2928 [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide C:\Windows\system32\drivers\amdide.sys
14:28:57.0648 2928 amdide - ok
14:28:57.0680 2928 [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
14:28:57.0753 2928 AmdK7 - ok
14:28:57.0808 2928 [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
14:28:57.0878 2928 AmdK8 - ok
14:28:58.0138 2928 [ 0FA2D8304ECA29CA0AB7E3EE50FD585A ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
14:28:58.0175 2928 AntiVirSchedulerService - ok
14:28:58.0245 2928 [ 5C69AAC8A59207DA9710FF2E42D6F80F ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe
14:28:58.0281 2928 AntiVirService - ok
14:28:58.0338 2928 [ 9325E49D555D8F12CE1735227DBB3D80 ] ApfiltrService C:\Windows\system32\DRIVERS\Apfiltr.sys
14:28:58.0375 2928 ApfiltrService - ok
14:28:58.0440 2928 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
14:28:58.0527 2928 Appinfo - ok
14:28:58.0627 2928 [ D8E18021F91AD79CA8491CB5A5DA22D4 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
14:28:58.0661 2928 Apple Mobile Device - ok
14:28:58.0744 2928 [ 5D2888182FB46632511ACEE92FDAD522 ] arc C:\Windows\system32\drivers\arc.sys
14:28:58.0784 2928 arc - ok
14:28:58.0823 2928 [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas C:\Windows\system32\drivers\arcsas.sys
14:28:58.0863 2928 arcsas - ok
14:28:58.0913 2928 [ 857B48965A0503B7AB795D4BFE7CBD8B ] ArcSoftKsUFilter C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys
14:28:58.0942 2928 ArcSoftKsUFilter - ok
14:28:58.0987 2928 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
14:28:59.0071 2928 AsyncMac - ok
14:28:59.0138 2928 [ 2D9C903DC76A66813D350A562DE40ED9 ] atapi C:\Windows\system32\drivers\atapi.sys
14:28:59.0172 2928 atapi - ok
14:28:59.0279 2928 [ 6455100A6CDB1DEDC551E12FD41BC519 ] Ati External Event Utility C:\Windows\system32\Ati2evxx.exe
14:28:59.0400 2928 Ati External Event Utility - ok
14:28:59.0694 2928 [ 9F66D1BA97911731133E46212539A08D ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
14:29:00.0050 2928 atikmdag - ok
14:29:00.0126 2928 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:29:00.0225 2928 AudioEndpointBuilder - ok
14:29:00.0235 2928 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
14:29:00.0282 2928 Audiosrv - ok
14:29:00.0336 2928 [ A5C175039B1D6D85D0E79F5855828E4D ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
14:29:00.0372 2928 avgntflt - ok
14:29:00.0430 2928 [ 37B854C7D1F477E66C5B49C7700C47CC ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
14:29:00.0471 2928 avipbb - ok
14:29:00.0546 2928 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
14:29:00.0581 2928 avkmgr - ok
14:29:00.0661 2928 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
14:29:00.0781 2928 Beep - ok
14:29:00.0867 2928 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
14:29:00.0916 2928 BFE - ok
14:29:01.0046 2928 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\System32\qmgr.dll
14:29:01.0145 2928 BITS - ok
14:29:01.0200 2928 [ D4DF28447741FD3D953526E33A617397 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys
14:29:01.0306 2928 blbdrive - ok
14:29:01.0442 2928 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
14:29:01.0489 2928 Bonjour Service - ok
14:29:01.0540 2928 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
14:29:01.0640 2928 bowser - ok
14:29:01.0711 2928 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
14:29:01.0789 2928 BrFiltLo - ok
14:29:01.0843 2928 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
14:29:01.0948 2928 BrFiltUp - ok
14:29:01.0977 2928 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
14:29:02.0040 2928 Browser - ok
14:29:02.0314 2928 [ B98EF68B1E3DC5AC79A432900947EA2D ] Browser Manager C:\ProgramData\Browser Manager\2.6.1123.78\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe
14:29:02.0438 2928 Browser Manager - ok
14:29:02.0495 2928 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
14:29:02.0755 2928 Brserid - ok
14:29:02.0809 2928 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
14:29:02.0923 2928 BrSerWdm - ok
14:29:02.0958 2928 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
14:29:03.0065 2928 BrUsbMdm - ok
14:29:03.0112 2928 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
14:29:03.0196 2928 BrUsbSer - ok
14:29:03.0284 2928 [ 6D39C954799B63BA866910234CF7D726 ] BthEnum C:\Windows\system32\DRIVERS\BthEnum.sys
14:29:03.0352 2928 BthEnum - ok
14:29:03.0388 2928 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
14:29:03.0489 2928 BTHMODEM - ok
14:29:03.0518 2928 [ 5904EFA25F829BF84EA6FB045134A1D8 ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
14:29:03.0599 2928 BthPan - ok
14:29:03.0689 2928 [ 611FF3F2F095C8D4A6D4CFD9DCC09793 ] BTHPORT C:\Windows\system32\Drivers\BTHport.sys
14:29:03.0814 2928 BTHPORT - ok
14:29:03.0866 2928 [ A4C8377FA4A994E07075107DBE2E3DCE ] BthServ C:\Windows\System32\bthserv.dll
14:29:03.0946 2928 BthServ - ok
14:29:04.0007 2928 [ D330803EAB2A15CAEC7F011F1D4CB30E ] BTHUSB C:\Windows\system32\Drivers\BTHUSB.sys
14:29:04.0042 2928 BTHUSB - ok
14:29:04.0117 2928 [ 14164C0CFD9D5A2704FDAB93A9688630 ] btwaudio C:\Windows\system32\drivers\btwaudio.sys
14:29:04.0155 2928 btwaudio - ok
14:29:04.0206 2928 [ 94DC6E5F3F532C5054F078D845714129 ] btwavdt C:\Windows\system32\drivers\btwavdt.sys
14:29:04.0241 2928 btwavdt - ok
14:29:04.0351 2928 [ C832A3622A35CA7C595EA8CA385BA813 ] btwdins C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
14:29:04.0436 2928 btwdins - ok
14:29:04.0497 2928 [ B9920FB30BCAFF10C111654909B275C9 ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys
14:29:04.0527 2928 btwl2cap - ok
14:29:04.0563 2928 [ 61E29BA977B972C9BAA847CC11D48C3D ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys
14:29:04.0593 2928 btwrchid - ok
14:29:04.0648 2928 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
14:29:04.0739 2928 cdfs - ok
14:29:04.0798 2928 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
14:29:04.0865 2928 cdrom - ok
14:29:04.0912 2928 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
14:29:04.0972 2928 CertPropSvc - ok
14:29:05.0041 2928 [ E5D4133F37219DBCFE102BC61072589D ] circlass C:\Windows\system32\drivers\circlass.sys
14:29:05.0126 2928 circlass - ok
14:29:05.0238 2928 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
14:29:05.0312 2928 CLFS - ok
14:29:05.0425 2928 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:29:05.0462 2928 clr_optimization_v2.0.50727_32 - ok
14:29:05.0546 2928 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:29:05.0614 2928 clr_optimization_v4.0.30319_32 - ok
14:29:05.0657 2928 [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
14:29:05.0731 2928 CmBatt - ok
14:29:05.0781 2928 [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide C:\Windows\system32\drivers\cmdide.sys
14:29:05.0820 2928 cmdide - ok
14:29:05.0845 2928 [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
14:29:05.0874 2928 Compbatt - ok
14:29:05.0883 2928 COMSysApp - ok
14:29:06.0006 2928 [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
14:29:06.0029 2928 crcdisk - ok
14:29:06.0054 2928 [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe C:\Windows\system32\drivers\crusoe.sys
14:29:06.0163 2928 Crusoe - ok
14:29:06.0228 2928 [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc C:\Windows\system32\cryptsvc.dll
14:29:06.0309 2928 CryptSvc - ok
14:29:06.0364 2928 [ ECDB9665937F737A7AB26390A6C68573 ] ctxusbm C:\Windows\system32\DRIVERS\ctxusbm.sys
14:29:06.0402 2928 ctxusbm - ok
14:29:06.0498 2928 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
14:29:06.0630 2928 DcomLaunch - ok
14:29:06.0686 2928 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
14:29:06.0758 2928 DfsC - ok
14:29:06.0876 2928 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
14:29:07.0045 2928 DFSR - ok
14:29:07.0104 2928 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
14:29:07.0190 2928 Dhcp - ok
14:29:07.0219 2928 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
14:29:07.0261 2928 disk - ok
14:29:07.0337 2928 [ F206E28ED74C491FD5D7C0A1119CE37F ] DMICall C:\Windows\system32\DRIVERS\DMICall.sys
14:29:07.0365 2928 DMICall - ok
14:29:07.0457 2928 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
14:29:07.0531 2928 Dnscache - ok
14:29:07.0616 2928 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
14:29:07.0696 2928 dot3svc - ok
14:29:07.0729 2928 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
14:29:07.0781 2928 DPS - ok
14:29:07.0836 2928 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
14:29:07.0913 2928 drmkaud - ok
14:29:07.0985 2928 [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
14:29:08.0039 2928 DXGKrnl - ok
14:29:08.0090 2928 [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
14:29:08.0193 2928 E1G60 - ok
14:29:08.0267 2928 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
14:29:08.0324 2928 EapHost - ok
14:29:08.0372 2928 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
14:29:08.0421 2928 Ecache - ok
14:29:08.0504 2928 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
14:29:08.0620 2928 ehRecvr - ok
14:29:08.0654 2928 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
14:29:08.0749 2928 ehSched - ok
14:29:08.0790 2928 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
14:29:08.0854 2928 ehstart - ok
14:29:08.0915 2928 [ 23B62471681A124889978F6295B3F4C6 ] elxstor C:\Windows\system32\drivers\elxstor.sys
14:29:08.0968 2928 elxstor - ok
14:29:09.0043 2928 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
14:29:09.0155 2928 EMDMgmt - ok
14:29:09.0184 2928 [ 3DB974F3935483555D7148663F726C61 ] ErrDev C:\Windows\system32\drivers\errdev.sys
14:29:09.0248 2928 ErrDev - ok
14:29:09.0313 2928 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
14:29:09.0388 2928 EventSystem - ok
14:29:09.0489 2928 [ BA6063E3375F9BC11A9C8450A7F61E70 ] EvtEng C:\Program Files\Intel\WiFi\bin\EvtEng.exe
14:29:09.0619 2928 EvtEng ( UnsignedFile.Multi.Generic ) - warning
14:29:09.0619 2928 EvtEng - detected UnsignedFile.Multi.Generic (1)
14:29:09.0672 2928 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
14:29:09.0790 2928 exfat - ok
14:29:09.0947 2928 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
14:29:10.0030 2928 fastfat - ok
14:29:10.0069 2928 [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
14:29:10.0136 2928 fdc - ok
14:29:10.0187 2928 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
14:29:10.0242 2928 fdPHost - ok
14:29:10.0249 2928 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
14:29:10.0378 2928 FDResPub - ok
14:29:10.0432 2928 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
14:29:10.0469 2928 FileInfo - ok
14:29:10.0500 2928 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
14:29:10.0570 2928 Filetrace - ok
14:29:10.0686 2928 [ F76D04F7413B07DAA029F6520B64B4E8 ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
14:29:10.0776 2928 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
14:29:10.0776 2928 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
14:29:10.0796 2928 [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
14:29:10.0866 2928 flpydisk - ok
14:29:10.0972 2928 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
14:29:11.0024 2928 FltMgr - ok
14:29:11.0202 2928 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
14:29:11.0288 2928 FontCache - ok
14:29:11.0353 2928 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
14:29:11.0387 2928 FontCache3.0.0.0 - ok
14:29:11.0449 2928 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
14:29:11.0539 2928 Fs_Rec - ok
14:29:11.0574 2928 [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
14:29:11.0613 2928 gagp30kx - ok
14:29:11.0683 2928 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
14:29:11.0713 2928 GEARAspiWDM - ok
14:29:11.0841 2928 [ 9F5F2F0FB0A7F5AA9F16B9A7B6DAD89F ] GoogleDesktopManager-051210-111108 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
14:29:11.0871 2928 GoogleDesktopManager-051210-111108 - ok
14:29:11.0923 2928 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
14:29:12.0069 2928 gpsvc - ok
14:29:12.0165 2928 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
14:29:12.0190 2928 gupdate - ok
14:29:12.0197 2928 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
14:29:12.0221 2928 gupdatem - ok
14:29:12.0302 2928 [ CC839E8D766CC31A7710C9F38CF3E375 ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
14:29:12.0327 2928 gusvc - ok
14:29:12.0400 2928 [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:29:12.0538 2928 HdAudAddService - ok
14:29:12.0687 2928 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
14:29:12.0785 2928 HDAudBus - ok
14:29:12.0824 2928 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
14:29:12.0942 2928 HidBth - ok
14:29:12.0974 2928 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys
14:29:13.0074 2928 HidIr - ok
14:29:13.0130 2928 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\system32\hidserv.dll
14:29:13.0194 2928 hidserv - ok
14:29:13.0230 2928 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
14:29:13.0302 2928 HidUsb - ok
14:29:13.0365 2928 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
14:29:13.0454 2928 hkmsvc - ok
14:29:13.0503 2928 [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
14:29:13.0540 2928 HpCISSs - ok
14:29:13.0689 2928 [ 46D67209550973257601A533E2AC5785 ] HSFHWAZL C:\Windows\system32\DRIVERS\VSTAZL3.SYS
14:29:13.0781 2928 HSFHWAZL - ok
14:29:13.0884 2928 [ 7BC42C65B5C6281777C1A7605B253BA8 ] HSF_DPV C:\Windows\system32\DRIVERS\HSX_DPV.sys
14:29:14.0115 2928 HSF_DPV - ok
14:29:14.0173 2928 [ 9EBF2D102CCBB6BCDFBF1B7922F8BA2E ] HSXHWAZL C:\Windows\system32\DRIVERS\HSXHWAZL.sys
14:29:14.0202 2928 HSXHWAZL - ok
14:29:14.0266 2928 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
14:29:14.0403 2928 HTTP - ok
14:29:14.0454 2928 [ C6B032D69650985468160FC9937CF5B4 ] i2omp C:\Windows\system32\drivers\i2omp.sys
14:29:14.0489 2928 i2omp - ok
14:29:14.0558 2928 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
14:29:14.0624 2928 i8042prt - ok
14:29:14.0669 2928 [ 8EF427C54497C5F8A7A645990E4278C7 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
14:29:14.0705 2928 iaStor - ok
14:29:14.0860 2928 [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
14:29:14.0930 2928 iaStorV - ok
14:29:15.0065 2928 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:29:15.0206 2928 idsvc - ok
14:29:15.0273 2928 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
14:29:15.0303 2928 iirsp - ok
14:29:15.0381 2928 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
14:29:15.0472 2928 IKEEXT - ok
14:29:15.0629 2928 [ 4A0F260DF9A5333C07F4AB40CA9D4F4B ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
14:29:15.0748 2928 IntcAzAudAddService - ok
14:29:15.0811 2928 [ 83AA759F3189E6370C30DE5DC5590718 ] intelide C:\Windows\system32\drivers\intelide.sys
14:29:15.0842 2928 intelide - ok
14:29:15.0899 2928 [ 224191001E78C89DFA78924C3EA595FF ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
14:29:15.0955 2928 intelppm - ok
14:29:15.0998 2928 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
14:29:16.0116 2928 IPBusEnum - ok
14:29:16.0171 2928 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:29:16.0217 2928 IpFilterDriver - ok
14:29:16.0246 2928 [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
14:29:16.0320 2928 iphlpsvc - ok
14:29:16.0325 2928 IpInIp - ok
14:29:16.0366 2928 [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
14:29:16.0428 2928 IPMIDRV - ok
14:29:16.0457 2928 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
14:29:16.0508 2928 IPNAT - ok
14:29:16.0625 2928 [ 33642C17C232AA272C68E446A2619899 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
14:29:16.0767 2928 iPod Service - ok
14:29:16.0867 2928 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
14:29:16.0920 2928 IRENUM - ok
14:29:16.0969 2928 [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp C:\Windows\system32\drivers\isapnp.sys
14:29:17.0008 2928 isapnp - ok
14:29:17.0085 2928 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
14:29:17.0118 2928 iScsiPrt - ok
14:29:17.0145 2928 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
14:29:17.0179 2928 iteatapi - ok
14:29:17.0243 2928 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
14:29:17.0278 2928 iteraid - ok
14:29:17.0321 2928 [ 213822072085B5BBAD9AF30AB577D817 ] IviRegMgr C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
14:29:17.0357 2928 IviRegMgr - ok
14:29:17.0388 2928 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
14:29:17.0423 2928 kbdclass - ok
14:29:17.0450 2928 [ 18247836959BA67E3511B62846B9C2E0 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
14:29:17.0521 2928 kbdhid - ok
14:29:17.0572 2928 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
14:29:17.0656 2928 KeyIso - ok
14:29:17.0693 2928 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
14:29:17.0754 2928 KSecDD - ok
14:29:17.0872 2928 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
14:29:17.0990 2928 KtmRm - ok
14:29:18.0048 2928 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\system32\srvsvc.dll
14:29:18.0105 2928 LanmanServer - ok
14:29:18.0204 2928 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:29:18.0293 2928 LanmanWorkstation - ok
14:29:18.0322 2928 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
14:29:18.0423 2928 lltdio - ok
14:29:18.0483 2928 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
14:29:18.0563 2928 lltdsvc - ok
14:29:18.0615 2928 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
14:29:18.0705 2928 lmhosts - ok
14:29:18.0794 2928 [ C7E15E82879BF3235B559563D4185365 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
14:29:18.0840 2928 LSI_FC - ok
14:29:18.0883 2928 [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
14:29:18.0929 2928 LSI_SAS - ok
14:29:19.0007 2928 [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
14:29:19.0052 2928 LSI_SCSI - ok
14:29:19.0091 2928 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
14:29:19.0164 2928 luafv - ok
14:29:19.0194 2928 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
14:29:19.0254 2928 Mcx2Svc - ok
14:29:19.0321 2928 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys
14:29:19.0345 2928 mdmxsdk - ok
14:29:19.0419 2928 [ 0001CE609D66632FA17B84705F658879 ] megasas C:\Windows\system32\drivers\megasas.sys
14:29:19.0451 2928 megasas - ok
14:29:19.0516 2928 [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR C:\Windows\system32\drivers\megasr.sys
14:29:19.0597 2928 MegaSR - ok
14:29:19.0639 2928 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
14:29:19.0726 2928 MMCSS - ok
14:29:19.0757 2928 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
14:29:19.0807 2928 Modem - ok
14:29:19.0855 2928 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
14:29:19.0894 2928 monitor - ok
14:29:19.0930 2928 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
14:29:19.0953 2928 mouclass - ok
14:29:19.0968 2928 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
14:29:20.0039 2928 mouhid - ok
14:29:20.0060 2928 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
14:29:20.0091 2928 MountMgr - ok
14:29:20.0152 2928 [ 511D011289755DD9F9A7579FB0B064E6 ] mpio C:\Windows\system32\drivers\mpio.sys
14:29:20.0190 2928 mpio - ok
14:29:20.0265 2928 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
14:29:20.0349 2928 mpsdrv - ok
14:29:20.0420 2928 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
14:29:20.0513 2928 MpsSvc - ok
14:29:20.0581 2928 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
14:29:20.0610 2928 Mraid35x - ok
14:29:20.0680 2928 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
14:29:20.0763 2928 MRxDAV - ok
14:29:20.0809 2928 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
14:29:20.0863 2928 mrxsmb - ok
14:29:20.0906 2928 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:29:20.0981 2928 mrxsmb10 - ok
14:29:21.0008 2928 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:29:21.0088 2928 mrxsmb20 - ok
14:29:21.0142 2928 [ 28023E86F17001F7CD9B15A5BC9AE07D ] msahci C:\Windows\system32\drivers\msahci.sys
14:29:21.0170 2928 msahci - ok
14:29:21.0268 2928 [ A99D2C7E30AD63EF920A894131CAF5F7 ] MSCSPTISRV C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
14:29:21.0287 2928 MSCSPTISRV ( UnsignedFile.Multi.Generic ) - warning
14:29:21.0287 2928 MSCSPTISRV - detected UnsignedFile.Multi.Generic (1)
14:29:21.0321 2928 [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm C:\Windows\system32\drivers\msdsm.sys
14:29:21.0353 2928 msdsm - ok
14:29:21.0396 2928 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
14:29:21.0488 2928 MSDTC - ok
14:29:21.0540 2928 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
14:29:21.0613 2928 Msfs - ok
14:29:21.0656 2928 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
14:29:21.0693 2928 msisadrv - ok
14:29:21.0868 2928 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
14:29:21.0973 2928 MSiSCSI - ok
14:29:21.0980 2928 msiserver - ok
14:29:22.0038 2928 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
14:29:22.0106 2928 MSKSSRV - ok
14:29:22.0134 2928 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
14:29:22.0195 2928 MSPCLOCK - ok
14:29:22.0237 2928 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
14:29:22.0292 2928 MSPQM - ok
14:29:22.0426 2928 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
14:29:22.0467 2928 MsRPC - ok
14:29:22.0524 2928 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
14:29:22.0550 2928 mssmbios - ok
14:29:22.0588 2928 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
14:29:22.0624 2928 MSTEE - ok
14:29:22.0684 2928 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
14:29:22.0704 2928 Mup - ok
14:29:22.0778 2928 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
14:29:22.0847 2928 napagent - ok
14:29:22.0930 2928 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
14:29:22.0967 2928 NativeWifiP - ok
14:29:23.0143 2928 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
14:29:23.0233 2928 NDIS - ok
14:29:23.0265 2928 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
14:29:23.0339 2928 NdisTapi - ok
14:29:23.0381 2928 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
14:29:23.0423 2928 Ndisuio - ok
14:29:23.0455 2928 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
14:29:23.0498 2928 NdisWan - ok
14:29:23.0539 2928 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
14:29:23.0579 2928 NDProxy - ok
14:29:23.0622 2928 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
14:29:23.0698 2928 NetBIOS - ok
14:29:23.0735 2928 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
14:29:23.0815 2928 netbt - ok
14:29:23.0861 2928 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
14:29:23.0892 2928 Netlogon - ok
14:29:23.0996 2928 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
14:29:24.0071 2928 Netman - ok
14:29:24.0109 2928 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
14:29:24.0168 2928 netprofm - ok
14:29:24.0197 2928 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:29:24.0244 2928 NetTcpPortSharing - ok
14:29:24.0556 2928 [ BA420E8EBFCAD35581FE8E4C64F71469 ] NETw5v32 C:\Windows\system32\DRIVERS\NETw5v32.sys
14:29:24.0960 2928 NETw5v32 - ok
14:29:25.0001 2928 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
14:29:25.0037 2928 nfrd960 - ok
14:29:25.0082 2928 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
14:29:25.0142 2928 NlaSvc - ok
14:29:25.0286 2928 [ B15E0180C43D8B5219196D76878CC2DD ] NPF C:\Windows\system32\drivers\npf.sys
14:29:25.0323 2928 NPF - ok
14:29:25.0368 2928 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
14:29:25.0448 2928 Npfs - ok
14:29:25.0493 2928 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
14:29:25.0615 2928 nsi - ok
14:29:25.0650 2928 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
14:29:25.0720 2928 nsiproxy - ok
14:29:25.0778 2928 [ B30F5C423B45A6668EADAD883678E2D0 ] NSUService C:\Program Files\sony\Network Utility\NSUService.exe
14:29:25.0792 2928 NSUService ( UnsignedFile.Multi.Generic ) - warning
14:29:25.0792 2928 NSUService - detected UnsignedFile.Multi.Generic (1)
14:29:26.0039 2928 [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
14:29:26.0203 2928 Ntfs - ok
14:29:26.0253 2928 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
14:29:26.0341 2928 ntrigdigi - ok
14:29:26.0373 2928 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
14:29:26.0437 2928 Null - ok
14:29:26.0476 2928 [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid C:\Windows\system32\drivers\nvraid.sys
14:29:26.0521 2928 nvraid - ok
14:29:26.0550 2928 [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor C:\Windows\system32\drivers\nvstor.sys
14:29:26.0588 2928 nvstor - ok
14:29:26.0626 2928 [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
14:29:26.0667 2928 nv_agp - ok
14:29:26.0673 2928 NwlnkFlt - ok
14:29:26.0684 2928 NwlnkFwd - ok
14:29:26.0849 2928 [ E54AA592A65F317390EEE386A8821692 ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
14:29:26.0911 2928 odserv - ok
14:29:26.0958 2928 [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
14:29:27.0162 2928 ohci1394 - ok
14:29:27.0215 2928 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
14:29:27.0254 2928 ose - ok
14:29:27.0332 2928 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
14:29:27.0434 2928 p2pimsvc - ok
14:29:27.0451 2928 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
14:29:27.0499 2928 p2psvc - ok
14:29:27.0546 2928 [ 41C33FB4FD929FED732A00D2DAEF5BE0 ] PACSPTISVR C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
14:29:27.0564 2928 PACSPTISVR ( UnsignedFile.Multi.Generic ) - warning
14:29:27.0564 2928 PACSPTISVR - detected UnsignedFile.Multi.Generic (1)
14:29:27.0599 2928 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
14:29:27.0689 2928 Parport - ok
14:29:27.0783 2928 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
14:29:27.0884 2928 partmgr - ok
14:29:27.0927 2928 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
14:29:28.0079 2928 Parvdm - ok
14:29:28.0168 2928 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
14:29:28.0274 2928 PcaSvc - ok
14:29:28.0304 2928 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
14:29:28.0336 2928 pci - ok
14:29:28.0427 2928 [ FC175F5DDAB666D7F4D17449A547626F ] pciide C:\Windows\system32\drivers\pciide.sys
14:29:28.0463 2928 pciide - ok
14:29:28.0498 2928 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
14:29:28.0541 2928 pcmcia - ok
14:29:28.0619 2928 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
14:29:28.0760 2928 PEAUTH - ok
14:29:28.0965 2928 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
14:29:29.0158 2928 pla - ok
14:29:29.0206 2928 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
14:29:29.0290 2928 PlugPlay - ok
14:29:29.0410 2928 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
14:29:29.0459 2928 PNRPAutoReg - ok
14:29:29.0475 2928 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
14:29:29.0523 2928 PNRPsvc - ok
14:29:29.0591 2928 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
14:29:29.0751 2928 PolicyAgent - ok
14:29:29.0933 2928 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
14:29:30.0025 2928 PptpMiniport - ok
14:29:30.0060 2928 [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor C:\Windows\system32\drivers\processr.sys
14:29:30.0124 2928 Processor - ok
14:29:30.0179 2928 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll
14:29:30.0247 2928 ProfSvc - ok
14:29:30.0284 2928 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
14:29:30.0323 2928 ProtectedStorage - ok
14:29:30.0379 2928 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
14:29:30.0461 2928 PSched - ok
14:29:30.0505 2928 [ 153D02480A0A2F45785522E814C634B6 ] PxHelp20 C:\Windows\system32\Drivers\PxHelp20.sys
14:29:30.0552 2928 PxHelp20 - ok
14:29:30.0687 2928 [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
14:29:30.0839 2928 ql2300 - ok
14:29:30.0901 2928 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
14:29:30.0919 2928 ql40xx - ok
14:29:30.0967 2928 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
14:29:31.0018 2928 QWAVE - ok
14:29:31.0047 2928 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
14:29:31.0083 2928 QWAVEdrv - ok
14:29:31.0100 2928 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
14:29:31.0176 2928 RasAcd - ok
14:29:31.0222 2928 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
14:29:31.0340 2928 RasAuto - ok
14:29:31.0433 2928 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
14:29:31.0501 2928 Rasl2tp - ok
14:29:31.0550 2928 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
14:29:31.0634 2928 RasMan - ok
14:29:31.0666 2928 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
14:29:31.0747 2928 RasPppoe - ok
14:29:31.0765 2928 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
14:29:31.0795 2928 RasSstp - ok
14:29:31.0873 2928 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
14:29:31.0958 2928 rdbss - ok
14:29:31.0985 2928 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
14:29:32.0039 2928 RDPCDD - ok
14:29:32.0073 2928 [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
14:29:32.0131 2928 rdpdr - ok
14:29:32.0138 2928 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
14:29:32.0212 2928 RDPENCDD - ok
14:29:32.0267 2928 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
14:29:32.0356 2928 RDPWD - ok
14:29:32.0405 2928 [ 001B4278407F4303EFC902A2B16F2453 ] regi C:\Windows\system32\drivers\regi.sys
14:29:32.0433 2928 regi - ok
14:29:32.0513 2928 [ 7EEEEC28A34516E66137F355DCC15BDB ] RegSrvc C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
14:29:32.0557 2928 RegSrvc ( UnsignedFile.Multi.Generic ) - warning
14:29:32.0557 2928 RegSrvc - detected UnsignedFile.Multi.Generic (1)
14:29:32.0630 2928 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
14:29:32.0719 2928 RemoteAccess - ok
14:29:32.0778 2928 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
14:29:32.0867 2928 RemoteRegistry - ok
14:29:32.0929 2928 [ 6482707F9F4DA0ECBAB43B2E0398A101 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
14:29:33.0020 2928 RFCOMM - ok
14:29:33.0044 2928 [ F7D9ECF41EBD3CF6C65944368150F66B ] rimsptsk C:\Windows\system32\DRIVERS\rimsptsk.sys
14:29:33.0091 2928 rimsptsk - ok
14:29:33.0112 2928 [ 1BE6C42767A7C67BA31AE32B293B37A3 ] risdptsk C:\Windows\system32\DRIVERS\risdptsk.sys
14:29:33.0163 2928 risdptsk - ok
14:29:33.0194 2928 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
14:29:33.0271 2928 RpcLocator - ok
14:29:33.0311 2928 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\system32\rpcss.dll
14:29:33.0386 2928 RpcSs - ok
14:29:33.0448 2928 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
14:29:33.0539 2928 rspndr - ok
14:29:33.0605 2928 [ 065A51298212455584F1811B033B617E ] RTHDMIAzAudService C:\Windows\system32\drivers\RtHDMIV.sys
14:29:33.0641 2928 RTHDMIAzAudService - ok
14:29:33.0714 2928 [ DF1970AB067B4BA4221F0AD0AB9EBB30 ] RtkAudioService C:\Windows\RtkAudioService.exe
14:29:33.0733 2928 RtkAudioService ( UnsignedFile.Multi.Generic ) - warning
14:29:33.0733 2928 RtkAudioService - detected UnsignedFile.Multi.Generic (1)
14:29:33.0773 2928 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
14:29:33.0804 2928 SamSs - ok
14:29:33.0830 2928 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
14:29:33.0869 2928 sbp2port - ok
14:29:33.0941 2928 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
14:29:34.0007 2928 SCardSvr - ok
14:29:34.0062 2928 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
14:29:34.0181 2928 Schedule - ok
14:29:34.0202 2928 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
14:29:34.0246 2928 SCPolicySvc - ok
14:29:34.0302 2928 [ 126EA89BCC413EE45E3004FB0764888F ] sdbus C:\Windows\system32\DRIVERS\sdbus.sys
14:29:34.0393 2928 sdbus - ok
14:29:34.0438 2928 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
14:29:34.0507 2928 SDRSVC - ok
14:29:34.0523 2928 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
14:29:34.0630 2928 secdrv - ok
14:29:34.0691 2928 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
14:29:34.0751 2928 seclogon - ok
14:29:34.0769 2928 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\System32\sens.dll
14:29:34.0841 2928 SENS - ok
14:29:34.0875 2928 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
14:29:34.0962 2928 Serenum - ok
14:29:35.0012 2928 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
14:29:35.0112 2928 Serial - ok
14:29:35.0146 2928 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
14:29:35.0209 2928 sermouse - ok
14:29:35.0325 2928 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
14:29:35.0379 2928 SessionEnv - ok
14:29:35.0430 2928 [ 8B7C1768D2CDE2E02E09A66563DDFD16 ] SFEP C:\Windows\system32\DRIVERS\SFEP.sys
14:29:35.0473 2928 SFEP - ok
14:29:35.0572 2928 [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
14:29:35.0618 2928 sffdisk - ok
14:29:35.0676 2928 [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
14:29:35.0770 2928 sffp_mmc - ok
14:29:35.0811 2928 [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
14:29:35.0867 2928 sffp_sd - ok
14:29:35.0918 2928 [ C33BFBD6E9E41FCD9FFEF9729E9FAED6 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
14:29:36.0031 2928 sfloppy - ok
14:29:36.0067 2928 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
14:29:36.0179 2928 SharedAccess - ok
14:29:36.0261 2928 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:29:36.0350 2928 ShellHWDetection - ok
14:29:36.0393 2928 [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp C:\Windows\system32\drivers\sisagp.sys
14:29:36.0433 2928 sisagp - ok
14:29:36.0458 2928 [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
14:29:36.0496 2928 SiSRaid2 - ok
14:29:36.0526 2928 [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
14:29:36.0567 2928 SiSRaid4 - ok
14:29:36.0785 2928 [ 388AE59FE75F1B959DFA0900923C61BB ] Skype C2C Service C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
14:29:37.0012 2928 Skype C2C Service - ok
14:29:37.0100 2928 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe
14:29:37.0214 2928 SkypeUpdate - ok
14:29:37.0393 2928 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
14:29:37.0765 2928 slsvc - ok
14:29:37.0822 2928 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
14:29:37.0886 2928 SLUINotify - ok
14:29:37.0949 2928 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
14:29:38.0002 2928 Smb - ok
14:29:38.0106 2928 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
14:29:38.0148 2928 SNMPTRAP - ok
14:29:38.0224 2928 [ 1A9DD46C547646A54CDB4065C1996A07 ] SOHCImp C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
14:29:38.0252 2928 SOHCImp - ok
14:29:38.0283 2928 [ 2E1B0D8278BB616148DDCA13DAE87544 ] SOHDms C:\Program Files\Sony\VAIO Media plus\SOHDms.exe
14:29:38.0346 2928 SOHDms - ok
14:29:38.0397 2928 [ 892529EE03211C35AEA7132E119F4862 ] SOHDs C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
14:29:38.0429 2928 SOHDs - ok
14:29:38.0564 2928 [ 5177D14A78E60FD61DCFC6B388E7E971 ] Sony PC Companion C:\Program Files\Sony\Sony PC Companion\PCCService.exe
14:29:38.0613 2928 Sony PC Companion - ok
14:29:38.0721 2928 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
14:29:38.0771 2928 spldr - ok
14:29:38.0834 2928 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
14:29:38.0929 2928 Spooler - ok
14:29:38.0968 2928 [ F63102F289AE2039940B22E9B2A8E0BD ] SPTISRV C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
14:29:38.0994 2928 SPTISRV ( UnsignedFile.Multi.Generic ) - warning
14:29:38.0994 2928 SPTISRV - detected UnsignedFile.Multi.Generic (1)
14:29:39.0047 2928 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
14:29:39.0136 2928 srv - ok
14:29:39.0194 2928 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
14:29:39.0268 2928 srv2 - ok
14:29:39.0296 2928 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
14:29:39.0337 2928 srvnet - ok
14:29:39.0386 2928 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
14:29:39.0441 2928 SSDPSRV - ok
14:29:39.0487 2928 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\Windows\system32\DRIVERS\ssmdrv.sys
14:29:39.0532 2928 ssmdrv - ok
14:29:39.0621 2928 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
14:29:39.0695 2928 SstpSvc - ok
14:29:39.0750 2928 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
14:29:39.0867 2928 stisvc - ok
14:29:39.0907 2928 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
14:29:39.0943 2928 swenum - ok
14:29:40.0025 2928 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
14:29:40.0112 2928 swprv - ok
14:29:40.0127 2928 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
14:29:40.0163 2928 Symc8xx - ok
14:29:40.0284 2928 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
14:29:40.0325 2928 Sym_hi - ok
14:29:40.0359 2928 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
14:29:40.0393 2928 Sym_u3 - ok
14:29:40.0436 2928 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
14:29:40.0535 2928 SysMain - ok
14:29:40.0584 2928 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
14:29:40.0619 2928 TabletInputService - ok
14:29:40.0671 2928 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
14:29:40.0765 2928 TapiSrv - ok
14:29:40.0792 2928 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
14:29:40.0861 2928 TBS - ok
14:29:40.0920 2928 [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
14:29:41.0006 2928 Tcpip - ok
14:29:41.0031 2928 [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
14:29:41.0091 2928 Tcpip6 - ok
14:29:41.0148 2928 [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
14:29:41.0210 2928 tcpipreg - ok
14:29:41.0274 2928 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
14:29:41.0358 2928 TDPIPE - ok
14:29:41.0389 2928 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
14:29:41.0444 2928 TDTCP - ok
14:29:41.0492 2928 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
14:29:41.0542 2928 tdx - ok
14:29:41.0579 2928 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
14:29:41.0618 2928 TermDD - ok
14:29:41.0654 2928 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
14:29:41.0719 2928 TermService - ok
14:29:41.0747 2928 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
14:29:41.0796 2928 Themes - ok
14:29:41.0809 2928 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
14:29:41.0861 2928 THREADORDER - ok
14:29:41.0911 2928 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
14:29:41.0974 2928 TrkWks - ok
14:29:42.0039 2928 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:29:42.0123 2928 TrustedInstaller - ok
14:29:42.0171 2928 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
14:29:42.0247 2928 tssecsrv - ok
14:29:42.0324 2928 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
14:29:42.0406 2928 tunmp - ok
14:29:42.0434 2928 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
14:29:42.0512 2928 tunnel - ok
14:29:42.0562 2928 [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35 C:\Windows\system32\drivers\uagp35.sys
14:29:42.0606 2928 uagp35 - ok
14:29:42.0669 2928 [ 63F6D08C54D5B3C1B12A6172032055C7 ] uCamMonitor C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
14:29:42.0712 2928 uCamMonitor - ok
14:29:42.0765 2928 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
14:29:42.0810 2928 udfs - ok
14:29:42.0859 2928 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
14:29:42.0966 2928 UI0Detect - ok
14:29:42.0975 2928 UIUSys - ok
14:29:43.0025 2928 [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
14:29:43.0065 2928 uliagpkx - ok
14:29:43.0098 2928 [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci C:\Windows\system32\drivers\uliahci.sys
14:29:43.0144 2928 uliahci - ok
14:29:43.0178 2928 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
14:29:43.0218 2928 UlSata - ok
14:29:43.0287 2928 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
14:29:43.0330 2928 ulsata2 - ok
14:29:43.0362 2928 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
14:29:43.0463 2928 umbus - ok
14:29:43.0540 2928 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
14:29:43.0635 2928 upnphost - ok
14:29:43.0735 2928 [ 83CAFCB53201BBAC04D822F32438E244 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
14:29:43.0800 2928 USBAAPL - ok
14:29:43.0844 2928 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
14:29:43.0894 2928 usbccgp - ok
14:29:43.0946 2928 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
14:29:44.0066 2928 usbcir - ok
14:29:44.0115 2928 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
14:29:44.0172 2928 usbehci - ok
14:29:44.0207 2928 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
14:29:44.0297 2928 usbhub - ok
14:29:44.0351 2928 [ 38DBC7DD6CC5A72011F187425384388B ] usbohci C:\Windows\system32\drivers\usbohci.sys
14:29:44.0437 2928 usbohci - ok
14:29:44.0484 2928 [ B51E52ACF758BE00EF3A58EA452FE360 ] usbprint C:\Windows\system32\drivers\usbprint.sys
14:29:44.0573 2928 usbprint - ok
14:29:44.0650 2928 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:29:44.0731 2928 USBSTOR - ok
14:29:44.0783 2928 [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
14:29:44.0829 2928 usbuhci - ok
14:29:44.0874 2928 [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
14:29:44.0976 2928 usbvideo - ok
14:29:45.0009 2928 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
14:29:45.0062 2928 UxSms - ok
14:29:45.0175 2928 [ 2A640DC735CB0112AC1DCD1E1549B27E ] VAIO Entertainment TV Device Arbitration Service C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
14:29:45.0238 2928 VAIO Entertainment TV Device Arbitration Service ( UnsignedFile.Multi.Generic ) - warning
14:29:45.0238 2928 VAIO Entertainment TV Device Arbitration Service - detected UnsignedFile.Multi.Generic (1)
14:29:45.0272 2928 [ 2C3DBB9B671AB95245DED1EFC5276CE9 ] VAIO Event Service C:\Program Files\sony\VAIO Event Service\VESMgr.exe
14:29:45.0312 2928 VAIO Event Service - ok
14:29:45.0432 2928 [ C1ED0F71D3B9EA8D774FC7C4CBF7EE7F ] VAIO Power Management C:\Program Files\Sony\VAIO Power Management\SPMService.exe
14:29:45.0465 2928 VAIO Power Management - ok
14:29:45.0563 2928 [ 7773EB681E99217FD92E5E8A5A199AE5 ] VCFw C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
14:29:45.0625 2928 VCFw ( UnsignedFile.Multi.Generic ) - warning
14:29:45.0625 2928 VCFw - detected UnsignedFile.Multi.Generic (1)
14:29:45.0689 2928 [ 2686B87EDC54ED215CE479AC9B7675DE ] VcmIAlzMgr C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
14:29:45.0738 2928 VcmIAlzMgr - ok
14:29:45.0784 2928 [ BB5781ED436D3E121F85617C3BBB7AD5 ] VcmXmlIfHelper C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
14:29:45.0820 2928 VcmXmlIfHelper - ok
14:29:45.0825 2928 Vcsw - ok
14:29:45.0892 2928 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
14:29:46.0033 2928 vds - ok
14:29:46.0070 2928 [ 87B06E1F30B749A114F74622D013F8D4 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
14:29:46.0125 2928 vga - ok
14:29:46.0155 2928 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
14:29:46.0213 2928 VgaSave - ok
14:29:46.0245 2928 [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp C:\Windows\system32\drivers\viaagp.sys
14:29:46.0283 2928 viaagp - ok
14:29:46.0325 2928 [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7 C:\Windows\system32\drivers\viac7.sys
14:29:46.0383 2928 ViaC7 - ok
14:29:46.0400 2928 [ AADF5587A4063F52C2C3FED7887426FC ] viaide C:\Windows\system32\drivers\viaide.sys
14:29:46.0436 2928 viaide - ok
14:29:46.0452 2928 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
14:29:46.0491 2928 volmgr - ok
14:29:46.0561 2928 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
14:29:46.0627 2928 volmgrx - ok
14:29:46.0691 2928 [ 786DB5771F05EF300390399F626BF30A ] volsnap C:\Windows\system32\drivers\volsnap.sys
14:29:46.0741 2928 volsnap - ok
14:29:46.0792 2928 [ 587253E09325E6BF226B299774B728A9 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
14:29:46.0834 2928 vsmraid - ok
14:29:46.0975 2928 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
14:29:47.0167 2928 VSS - ok
14:29:47.0283 2928 [ 071634532066C2E29350D450C3412837 ] VzCdbSvc C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
14:29:47.0294 2928 VzCdbSvc ( UnsignedFile.Multi.Generic ) - warning
14:29:47.0294 2928 VzCdbSvc - detected UnsignedFile.Multi.Generic (1)
14:29:47.0342 2928 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
14:29:47.0425 2928 W32Time - ok
14:29:47.0479 2928 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
14:29:47.0581 2928 WacomPen - ok
14:29:47.0628 2928 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
14:29:47.0678 2928 Wanarp - ok
14:29:47.0684 2928 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
14:29:47.0726 2928 Wanarpv6 - ok
14:29:47.0781 2928 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
14:29:47.0827 2928 wcncsvc - ok
14:29:47.0887 2928 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:29:47.0966 2928 WcsPlugInService - ok
14:29:47.0997 2928 [ 78FE9542363F297B18C027B2D7E7C07F ] Wd C:\Windows\system32\drivers\wd.sys
14:29:48.0033 2928 Wd - ok
14:29:48.0096 2928 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
14:29:48.0164 2928 Wdf01000 - ok
14:29:48.0197 2928 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
14:29:48.0257 2928 WdiServiceHost - ok
14:29:48.0266 2928 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
14:29:48.0321 2928 WdiSystemHost - ok
14:29:48.0373 2928 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
14:29:48.0410 2928 WebClient - ok
14:29:48.0474 2928 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
14:29:48.0555 2928 Wecsvc - ok
14:29:48.0609 2928 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
14:29:48.0692 2928 wercplsupport - ok
14:29:48.0764 2928 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
14:29:48.0810 2928 WerSvc - ok
14:29:48.0857 2928 [ 090A2B8F055343815556A01F725F6C35 ] WimFltr C:\Windows\system32\DRIVERS\wimfltr.sys
14:29:48.0889 2928 WimFltr - ok
14:29:48.0939 2928 [ 5A77AC34A0FFB70CE8B35B524FEDE9BA ] winachsf C:\Windows\system32\DRIVERS\HSX_CNXT.sys
14:29:49.0063 2928 winachsf - ok
14:29:49.0204 2928 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
14:29:49.0251 2928 WinDefend - ok
14:29:49.0265 2928 WinHttpAutoProxySvc - ok
14:29:49.0395 2928 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
14:29:49.0454 2928 Winmgmt - ok
14:29:49.0582 2928 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
14:29:49.0757 2928 WinRM - ok
14:29:49.0874 2928 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
14:29:49.0955 2928 Wlansvc - ok
14:29:50.0005 2928 [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
14:29:50.0053 2928 WmiAcpi - ok
14:29:50.0113 2928 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
14:29:50.0155 2928 wmiApSrv - ok
14:29:50.0314 2928 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
14:29:50.0451 2928 WMPNetworkSvc - ok
14:29:50.0492 2928 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
14:29:50.0581 2928 WPCSvc - ok
14:29:50.0702 2928 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
14:29:50.0758 2928 WPDBusEnum - ok
14:29:50.0811 2928 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
14:29:50.0849 2928 WpdUsb - ok
14:29:51.0074 2928 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
14:29:51.0147 2928 WPFFontCache_v0400 - ok
14:29:51.0191 2928 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
14:29:51.0289 2928 ws2ifsl - ok
14:29:51.0353 2928 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\System32\wscsvc.dll
14:29:51.0431 2928 wscsvc - ok
14:29:51.0438 2928 WSearch - ok
14:29:51.0568 2928 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
14:29:51.0680 2928 wuauserv - ok
14:29:51.0744 2928 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
14:29:51.0826 2928 WudfPf - ok
14:29:51.0876 2928 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
14:29:51.0918 2928 WUDFRd - ok
14:29:51.0958 2928 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
14:29:52.0029 2928 wudfsvc - ok
14:29:52.0063 2928 [ 88AF537264F2B818DA15479CEEAF5D7C ] XAudio C:\Windows\system32\DRIVERS\xaudio.sys
14:29:52.0140 2928 XAudio - ok
14:29:52.0194 2928 [ 15A317674A08DF26BE65164D959E9203 ] XAudioService C:\Windows\system32\DRIVERS\xaudio.exe
14:29:52.0321 2928 XAudioService - ok
14:29:52.0423 2928 [ 67E3D2AF24C3873E6A0CAC89DE78D63B ] yukonwlh C:\Windows\system32\DRIVERS\yk60x86.sys
14:29:52.0491 2928 yukonwlh - ok
14:29:52.0508 2928 ================ Scan global ===============================
14:29:52.0542 2928 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
14:29:52.0618 2928 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
14:29:52.0658 2928 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
14:29:52.0722 2928 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
14:29:52.0729 2928 [Global] - ok
14:29:52.0730 2928 ================ Scan MBR ==================================
14:29:52.0787 2928 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
14:29:53.0730 2928 \Device\Harddisk0\DR0 - ok
14:29:53.0731 2928 ================ Scan VBR ==================================
14:29:53.0760 2928 [ 3680D8967E8093D54E8AF8B723B0A986 ] \Device\Harddisk0\DR0\Partition1
14:29:53.0762 2928 \Device\Harddisk0\DR0\Partition1 - ok
14:29:53.0763 2928 ============================================================
14:29:53.0763 2928 Scan finished
14:29:53.0763 2928 ============================================================
14:29:53.0785 4892 Detected object count: 12
14:29:53.0785 4892 Actual detected object count: 12
|
|
04.02.2013, 16:39
| #6 | |
| /// Malware-holic | GUV Trojaner / Auswertung OTL logfiles hi combofix: Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ --> GUV Trojaner / Auswertung OTL logfiles |
|
04.02.2013, 16:41
| #7 | |
| /// Malware-holic | GUV Trojaner / Auswertung OTL logfiles hi 1. http://download.bleepingcomputer.com...ta/Winmgmt.reg Laden, doppelklicken, Nachfrage bestätigen, neustarten. 2. combofix: Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
04.02.2013, 17:20
| #8 |
| | GUV Trojaner / Auswertung OTL logfiles Habe alles gemacht wie beschrieben, allerdings kann ich keine combofix.txt auf c:\ finden. Dort befindet sich zwar eine Datei die combofix heißt, diese scheint jedoch "eine Art Ordner zu sein" hinter der sich wieder der Inhalt von c: befindet. Habe ich etwas falsch gemacht? |
|
04.02.2013, 18:01
| #9 |
| /// Malware-holic | GUV Trojaner / Auswertung OTL logfiles das log geht doch automatisch auf. lass es noch mal laufen und öffne dann zusätzlich c:\qoobox quarantained file.txt und poste deren Inhalt
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
05.02.2013, 22:00
| #10 |
| | GUV Trojaner / Auswertung OTL logfiles Hi, also irgendwas funktioniert nicht. Hab es jetzt insg. 4 mal laufen lassen und es kam keine combofix.txt logfile. Nach 3x hat sich einfach gar nicht getan, gestern kam dann ein blaues Fenster in dem sinngemäß stand: Ihr Computer wird geprüft, dies dauert i.d.R. 10 min, bei stark verseuchten Computern kann es auch doppelt so lang dauern. Dann wurde EWIG geprüft (hab das auch über Nacht laufen lassen) und dann nach c. 12 Stunden abgebrochen. Die einzige Datei die unter C.\qoobox\quarantine war ist catchme.txt mit folgendem Inhalt: Code:
ATTFilter -------- 2013-02-04 - 17:02:19 -------------
-------- 2013-02-04 - 18:09:47 -------------
error: 31
Gruß |
|
05.02.2013, 22:01
| #11 |
| /// Malware-holic | GUV Trojaner / Auswertung OTL logfiles starte neu, drücke f8 wähle abgesicherter Modus, melde dich in deinem Konto an, versuchs dort erneut. dann wieder in den normalen Modus starten, und log posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
05.02.2013, 23:08
| #12 |
| | GUV Trojaner / Auswertung OTL logfiles hat geklappt Code:
ATTFilter ComboFix 13-02-03.03 - Nora 05.02.2013 22:35:09.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3038.2581 [GMT 1:00]
ausgeführt von:: c:\users\Nora\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\LMUB1fPE.exe.b
c:\programdata\Roaming
c:\programdata\windows
c:\users\Nora\AppData\Roaming\AcroIEHelpe.txt
c:\users\Nora\AppData\Roaming\Help\coredb\storage
c:\users\Nora\AppData\Roaming\Kefef
c:\users\Nora\AppData\Roaming\Kefef\maynhy.tmp
c:\users\Nora\AppData\Roaming\Kefef\maynhy.unq
c:\users\Nora\AppData\Roaming\srvblck5.tmp
c:\windows\security\Database\tmp.edb
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\Thumbs.db
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_NPF
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-01-05 bis 2013-02-05 ))))))))))))))))))))))))))))))
.
.
2013-02-05 21:46 . 2013-02-05 21:52 -------- d-----w- c:\users\Nora\AppData\Local\temp
2013-02-05 21:46 . 2013-02-05 21:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-02-05 20:56 . 2013-01-18 11:17 6991832 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED53E9E7-7C80-4540-846F-82CEAF31D5F6}\mpengine.dll
2013-02-04 18:55 . 2013-02-04 18:55 -------- d-----w- C:\_OTL
2013-02-04 18:55 . 2011-07-13 02:55 2237440 ----a-r- C:\OTLPE.exe
2013-02-04 15:37 . 2013-02-04 15:37 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2013-02-04 15:37 . 2013-02-04 15:37 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2013-02-04 15:37 . 2013-02-04 15:37 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-02-04 15:37 . 2013-02-04 15:37 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-02-04 15:37 . 2013-02-04 15:37 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-02-04 15:37 . 2013-02-04 15:37 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-02-04 15:37 . 2013-02-04 15:37 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-02-04 15:37 . 2013-02-04 15:37 -------- d-----w- c:\program files\QuickTime
2013-02-04 15:20 . 2013-02-04 15:20 -------- d-----w- c:\users\Nora\AppData\Roaming\Malwarebytes
2013-02-04 15:20 . 2013-02-04 15:20 -------- d-----w- c:\programdata\Malwarebytes
2013-02-04 15:19 . 2013-02-04 15:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-02-04 15:19 . 2012-12-14 15:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-02-04 15:13 . 2012-10-30 22:51 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-02-04 15:13 . 2012-10-30 22:51 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-02-04 15:13 . 2012-10-30 22:51 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-02-04 15:13 . 2012-10-30 22:51 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2013-02-04 15:13 . 2012-10-30 22:51 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-02-04 15:13 . 2012-10-30 22:51 58680 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-02-04 15:13 . 2012-10-30 22:51 41224 ----a-w- c:\windows\avastSS.scr
2013-02-04 15:13 . 2012-10-30 22:50 227648 ----a-w- c:\windows\system32\aswBoot.exe
2013-02-04 15:12 . 2013-02-04 15:12 -------- d-----w- c:\programdata\AVAST Software
2013-02-04 15:12 . 2013-02-04 15:12 -------- d-----w- c:\program files\AVAST Software
2013-02-04 14:17 . 2013-02-04 14:17 -------- d-----w- c:\program files\Common Files\DivX Shared
2013-02-04 14:14 . 2013-02-04 14:19 -------- d-----w- c:\programdata\DivX
2013-02-04 14:12 . 2013-02-04 14:11 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-02-04 14:06 . 2013-02-04 14:06 -------- d-----w- c:\program files\FileHippo.com
2013-02-04 13:10 . 2013-02-04 14:11 861088 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-01-23 17:52 . 2013-01-23 17:52 -------- d-----w- c:\program files\Common Files\Citrix
2013-01-20 22:39 . 2013-01-03 18:34 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2013-01-20 22:39 . 2012-11-20 04:22 204288 ----a-w- c:\windows\system32\ncrypt.dll
2013-01-20 22:39 . 2012-11-23 01:35 2048000 ----a-w- c:\windows\system32\win32k.sys
2013-01-20 22:36 . 2012-11-02 10:19 1400832 ----a-w- c:\windows\system32\msxml6.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-04 14:11 . 2010-05-21 13:47 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-02-04 13:25 . 2012-10-07 17:59 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-04 13:25 . 2011-06-03 21:34 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-17 00:28 . 2010-05-21 17:13 232336 ------w- c:\windows\system32\MpSigStub.exe
2012-12-16 13:12 . 2012-12-21 16:29 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-16 10:50 . 2012-12-21 16:29 293376 ----a-w- c:\windows\system32\atmfd.dll
2012-12-05 15:23 . 2012-12-05 15:23 73544 ----a-w- c:\windows\system32\drivers\ctxusbm.sys
2012-11-13 20:29 . 2012-11-13 20:29 354216 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
2012-11-13 01:29 . 2012-12-13 16:36 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-09 10:42 . 2012-12-13 16:36 916992 ----a-w- c:\windows\system32\wininet.dll
2012-11-09 10:37 . 2012-12-13 16:36 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-11-09 10:36 . 2012-12-13 16:36 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-11-09 10:36 . 2012-12-13 16:36 71680 ----a-w- c:\windows\system32\iesetup.dll
2012-11-09 10:36 . 2012-12-13 16:36 109056 ----a-w- c:\windows\system32\iesysprep.dll
2012-11-09 09:01 . 2012-12-13 16:36 385024 ----a-w- c:\windows\system32\html.iec
2012-11-09 07:13 . 2012-12-13 16:36 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-11-22 270336]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Sony PC Companion"="c:\program files\Sony\Sony PC Companion\PCCompanion.exe" [2013-01-07 446648]
"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"Facebook Update"="c:\users\Nora\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-08-22 138096]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2012-11-23 307712]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2008-09-30 122880]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-11 30192]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-03 317280]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2008-12-08 24576]
"AML"="c:\program files\Sony\VAIO Launcher\AML.exe" [2008-09-09 1097728]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-05-01 202256]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-10-09 421736]
"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2012-12-14 383544]
"DivXMediaServer"="c:\program files\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2012-11-30 1263512]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
.
c:\users\Nora\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-8-24 101784]
OneNote Inhaltsverzeichnis.onetoc2 [2012-7-7 3656]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-10-14 776744]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-11-05 17:32 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\browse~1\261123~1.78\{61d8b~1\browse~1.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
S2 accvssvc;AccSys WLAN Control Service;c:\program files\Common Files\AccSys\AccVSSvc.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-07 13:25]
.
2012-11-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3256999809-2769954180-380837127-1000Core.job
- c:\users\Nora\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-22 16:13]
.
2012-11-07 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3256999809-2769954180-380837127-1000UA.job
- c:\users\Nora\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-22 16:13]
.
2012-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-27 19:20]
.
2012-11-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-27 19:20]
.
2012-11-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3256999809-2769954180-380837127-1000Core.job
- c:\users\Nora\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-18 19:10]
.
2012-11-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3256999809-2769954180-380837127-1000UA.job
- c:\users\Nora\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-18 19:10]
.
2013-01-20 c:\windows\Tasks\ReclaimerUpdateFiles_Nora.job
- c:\users\Nora\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-26 20:02]
.
2013-01-20 c:\windows\Tasks\ReclaimerUpdateXML_Nora.job
- c:\users\Nora\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-26 20:02]
.
2013-01-20 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Nora.job
- c:\users\Nora\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-26 20:02]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: nibc.com\xs4
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-pasui - (no file)
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre7\bin\jusched.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-02-05 22:51
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000042
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3328)
c:\windows\system32\btmmhook.dll
c:\windows\system32\btncopy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\RtkAudioService.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\programdata\Browser Manager\2.6.1123.78\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe
c:\windows\system32\schtasks.exe
c:\programdata\Browser Manager\2.6.1123.78\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\sony\Network Utility\NSUService.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe
c:\program files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
c:\program files\sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
c:\windows\system32\DllHost.exe
c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\sony\VAIO Event Service\VESMgrSub.exe
c:\windows\system32\DllHost.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Apoint\ApMsgFwd.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\sony\Sony PC Companion\PCCompanionInfo.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Apoint\Apntex.exe
c:\program files\Sony\VAIO Power Management\SPMService.exe
c:\program files\Citrix\Receiver\Receiver.exe
c:\program files\Common Files\Apple\Apple Application Support\distnoted.exe
c:\program files\Citrix\ICA Client\wfcrun32.exe
c:\program files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Sony\VAIO Power Management\SPMgr.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-02-05 22:58:52 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-02-05 21:58
.
Vor Suchlauf: 8 Verzeichnis(se), 244.650.868.736 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 246.552.834.048 Bytes frei
.
- - End Of File - - 857859C16C6628F333BD2AC2FD5549B0
|
|
05.02.2013, 23:18
| #13 |
| /// Malware-holic | GUV Trojaner / Auswertung OTL logfiles hi poste mir mal alle Malwarebytes Logs mit Funden http://www.trojaner-board.de/125889-...en-posten.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
06.02.2013, 08:07
| #14 |
| | GUV Trojaner / Auswertung OTL logfiles Malware log: Code:
ATTFilter Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Datenbank Version: v2013.02.04.06 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 8.0.6001.19393 Nora :: NORA-PC [Administrator] 05.02.2013 23:20:38 MBAM-log-2013-02-06 (08-06-03).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 405895 Laufzeit: 3 Stunde(n), 19 Minute(n), 9 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F99BD4F5-D402-4c21-A8BC-510830B6BE37} (Trojan.Banker) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> Keine Aktion durchgeführt. Infizierte Dateien: 4 C:\Users\Nora\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\1fd07233-5908227c (Trojan.FakeMS) -> Keine Aktion durchgeführt. C:\Users\Nora\Desktop\ssk_claro.exe (PUP.BundleInstaller.IB) -> Keine Aktion durchgeführt. C:\_OTL\MovedFiles\02042013_135539\C_Users\Nora\wgsdgsdgdsgsd.exe (Trojan.FakeMS) -> Keine Aktion durchgeführt. C:\ProgramData\IBUpdaterService\repository.xml (PUP.InstallBrain) -> Keine Aktion durchgeführt. (Ende) |
|
06.02.2013, 12:53
| #15 |
| /// Malware-holic | GUV Trojaner / Auswertung OTL logfiles hi, Funde gelöscht? laut Log nicht.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu GUV Trojaner / Auswertung OTL logfiles |
| adobe, antivir, avira, bho, bonjour, browser, browser manager, defender, desktop, error, firefox, format, guv trojaner, home, hängen, infizierte, limited.com/facebook, logfile, object, photoshop, plug-in, realtek, registry, rundll, scan, software, trojaner, trojaner-board, vista |
Linear-Darstellung
