GVU Trojaner auf Windows 7 PC

oly22 · 24.05.2013, 22:23

Hallo allerseits, auch ich habe mitr den GVU-Trojaner eingefangen. Der Pc startet weder normal, noch in irgendeiner Variation des abgesicherten Moduses. Immer kommt nach kurzer Zeit der Sperrbildschirm. Über OTLPE ist es mir gelungen eine OTL.txt zu erstellen und NUR die. Ich hänge Sie hier an in der Hoffnung, das ihr mir helfen könnt! Vielen Dank im voraus!

markusg · 24.05.2013, 22:27

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

ATTFilter

:OTL
O4 - HKU\Cecil-Peine_ON_C..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Cecil-Peine\Documents\68a99b6f.exe ()
O20 - HKU\Cecil-Peine_ON_C Winlogon: Shell - (cmd.exe) - C:\Windows\System32\cmd.exe (Microsoft Corporation)
[2013/05/24 08:16:43 | 000,003,536 | ---- | C] () -- C:\bootsqm.dat
[2013/05/24 06:54:59 | 000,163,049 | ---- | C] () -- C:\Users\Cecil-Peine\AppData\Roaming\2433f433
[2013/05/24 06:54:59 | 000,163,014 | ---- | C] () -- C:\Users\Cecil-Peine\AppData\Local\2433f433
[2013/05/24 06:54:59 | 000,163,000 | ---- | C] () -- C:\ProgramData\2433f433
[2013/05/24 06:54:58 | 000,037,376 | ---- | C] () -- C:\Users\Cecil-Peine\Documents\68a99b6f.dll
[2013/05/24 06:54:54 | 000,037,376 | ---- | C] () -- C:\Users\Cecil-Peine\Documents\68a99b6f.exe
[2013/05/08 00:56:00 | 000,114,176 | ---- | C] () -- C:\Users\Cecil-Peine\AppData\Roaming\BabMaint.exe
:Files
:Commands
[EMPTYFLASH] 
[emptytemp]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

oly22 · 24.05.2013, 22:53

Danke für die superschnelle Antwort. Bin wieder im Rechner! bei der Erstellung des Zip ordners kam ein Rotes Alarmzeichen von AVG "Bedrohung erkannt" c:_\OTL\movedfiles\05252013_023732\C_users\cecil-peine\documents\68a99b6f.dll

und drei Möglichkeiten werden mir angeboten:
1: in Quarantäne verschieben
2: Gehe zu Datei
3: Ignorieren
... was soll ich jetzt machen???

markusg · 24.05.2013, 22:54

Nimm quarantäne, packe dann noch mal und lad den Rest hoch

oly22 · 24.05.2013, 22:59

Quarantäne genommen...
erneut vewrsucht zu "zippen"
KAM FEHLERMELDUNG: Datei nicht gefunden oder keine LEsebestätigung

Dann wieder das selbe "Alarmfenster" wievor.
Der Trojaner heißt: Backdoor.Generic17.JGS (weitere Informationen)

markusg · 24.05.2013, 22:59

ok dann lassen wir das.
nimm Qarantäne, dann:
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

oly22 · 24.05.2013, 23:10

03:04:49.0822 4852 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
03:04:51.0113 4852 ============================================================
03:04:51.0113 4852 Current date / time: 2013/05/25 03:04:51.0113
03:04:51.0113 4852 SystemInfo:
03:04:51.0113 4852
03:04:51.0113 4852 OS Version: 6.1.7601 ServicePack: 1.0
03:04:51.0113 4852 Product type: Workstation
03:04:51.0113 4852 ComputerName: BUERO1
03:04:51.0113 4852 UserName: Cecil-Peine
03:04:51.0113 4852 Windows directory: C:\Windows
03:04:51.0113 4852 System windows directory: C:\Windows
03:04:51.0113 4852 Processor architecture: Intel x86
03:04:51.0113 4852 Number of processors: 4
03:04:51.0113 4852 Page size: 0x1000
03:04:51.0113 4852 Boot type: Normal boot
03:04:51.0113 4852 ============================================================
03:04:52.0052 4852 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
03:04:52.0054 4852 ============================================================
03:04:52.0054 4852 \Device\Harddisk0\DR0:
03:04:52.0054 4852 MBR partitions:
03:04:52.0054 4852 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02
03:04:52.0054 4852 ============================================================
03:04:52.0069 4852 C: <-> \Device\Harddisk0\DR0\Partition1
03:04:52.0069 4852 ============================================================
03:04:52.0069 4852 Initialize success
03:04:52.0069 4852 ============================================================
03:05:36.0632 5164 ============================================================
03:05:36.0632 5164 Scan started
03:05:36.0632 5164 Mode: Manual; SigCheck; TDLFS;
03:05:36.0632 5164 ============================================================
03:05:37.0449 5164 ================ Scan system memory ========================
03:05:37.0450 5164 System memory - ok
03:05:37.0451 5164 ================ Scan services =============================
03:05:37.0524 5164 [ C0393EB99A6C72C6BEF9BFC4A72B33A6 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
03:05:37.0628 5164 !SASCORE ( UnsignedFile.Multi.Generic ) - warning
03:05:37.0628 5164 !SASCORE - detected UnsignedFile.Multi.Generic (1)
03:05:37.0763 5164 [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
03:05:37.0801 5164 1394ohci - ok
03:05:37.0900 5164 [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
03:05:37.0914 5164 ACDaemon - ok
03:05:37.0942 5164 [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys
03:05:37.0955 5164 ACPI - ok
03:05:37.0975 5164 [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
03:05:38.0039 5164 AcpiPmi - ok
03:05:38.0098 5164 [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
03:05:38.0130 5164 AdobeARMservice - ok
03:05:38.0172 5164 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
03:05:38.0189 5164 AdobeFlashPlayerUpdateSvc - ok
03:05:38.0223 5164 [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
03:05:38.0248 5164 adp94xx - ok
03:05:38.0269 5164 [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
03:05:38.0291 5164 adpahci - ok
03:05:38.0309 5164 [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
03:05:38.0327 5164 adpu320 - ok
03:05:38.0348 5164 [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
03:05:38.0409 5164 AeLookupSvc - ok
03:05:38.0456 5164 [ FE3EA6E9AFC1A78E6EDCA121E006AFB7 ] Afc C:\Windows\system32\drivers\Afc.sys
03:05:38.0466 5164 Afc - ok
03:05:38.0488 5164 [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD C:\Windows\system32\drivers\afd.sys
03:05:38.0517 5164 AFD - ok
03:05:38.0558 5164 [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys
03:05:38.0569 5164 aic78xx - ok
03:05:38.0597 5164 [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG C:\Windows\System32\alg.exe
03:05:38.0659 5164 ALG - ok
03:05:38.0684 5164 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide C:\Windows\system32\drivers\aliide.sys
03:05:38.0717 5164 aliide - ok
03:05:38.0733 5164 [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp C:\Windows\system32\drivers\amdagp.sys
03:05:38.0749 5164 amdagp - ok
03:05:38.0771 5164 [ CD5914170297126B6266860198D1D4F0 ] amdide C:\Windows\system32\drivers\amdide.sys
03:05:38.0787 5164 amdide - ok
03:05:38.0805 5164 [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
03:05:38.0843 5164 AmdK8 - ok
03:05:38.0876 5164 [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
03:05:38.0911 5164 AmdPPM - ok
03:05:38.0932 5164 [ D320BF87125326F996D4904FE24300FC ] amdsata C:\Windows\system32\drivers\amdsata.sys
03:05:38.0949 5164 amdsata - ok
03:05:38.0965 5164 [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
03:05:38.0985 5164 amdsbs - ok
03:05:38.0996 5164 [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata C:\Windows\system32\drivers\amdxata.sys
03:05:39.0006 5164 amdxata - ok
03:05:39.0033 5164 [ AEA177F783E20150ACE5383EE368DA19 ] AppID C:\Windows\system32\drivers\appid.sys
03:05:39.0072 5164 AppID - ok
03:05:39.0111 5164 [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc C:\Windows\System32\appidsvc.dll
03:05:39.0155 5164 AppIDSvc - ok
03:05:39.0212 5164 [ EACFDF31921F51C097629F1F3C9129B4 ] Appinfo C:\Windows\System32\appinfo.dll
03:05:39.0243 5164 Appinfo - ok
03:05:39.0319 5164 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
03:05:39.0355 5164 Apple Mobile Device - ok
03:05:39.0390 5164 [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt C:\Windows\System32\appmgmts.dll
03:05:39.0464 5164 AppMgmt - ok
03:05:39.0501 5164 [ 2932004F49677BD84DBC72EDB754FFB3 ] arc C:\Windows\system32\DRIVERS\arc.sys
03:05:39.0518 5164 arc - ok
03:05:39.0531 5164 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
03:05:39.0549 5164 arcsas - ok
03:05:39.0584 5164 [ 2B4E66FAC6503494A2C6F32BB6AB3826 ] AsIO C:\Windows\system32\drivers\AsIO.sys
03:05:39.0598 5164 AsIO - ok
03:05:39.0610 5164 [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
03:05:39.0659 5164 AsyncMac - ok
03:05:39.0693 5164 [ 338C86357871C167A96AB976519BF59E ] atapi C:\Windows\system32\drivers\atapi.sys
03:05:39.0704 5164 atapi - ok
03:05:39.0748 5164 [ 44FA26470D4C8123CCF71F4200B782D3 ] athrusb C:\Windows\system32\DRIVERS\athrusb.sys
03:05:39.0810 5164 athrusb - ok
03:05:39.0837 5164 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
03:05:39.0888 5164 AudioEndpointBuilder - ok
03:05:39.0896 5164 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv C:\Windows\System32\Audiosrv.dll
03:05:39.0920 5164 Audiosrv - ok
03:05:39.0963 5164 [ D30B785AB801A0E2B0AD922D66F971F3 ] Avgfwfd C:\Windows\system32\DRIVERS\avgfwd6x.sys
03:05:39.0972 5164 Avgfwfd - ok
03:05:40.0080 5164 [ 2F0C5AE2352F22B587EDC2829C971262 ] avgfws C:\Program Files\AVG\AVG10\avgfws.exe
03:05:40.0189 5164 avgfws - ok
03:05:40.0344 5164 [ 7A0F6A3E0E41425B9BA54616B482668A ] AVGIDSAgent C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
03:05:40.0504 5164 AVGIDSAgent - ok
03:05:40.0517 5164 [ B9ACB889BA1E0561868C025F95D63E25 ] AVGIDSDriver C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys
03:05:40.0528 5164 AVGIDSDriver - ok
03:05:40.0537 5164 [ 13256FC72FA5B3F6D6E8C5957E579B7C ] AVGIDSEH C:\Windows\system32\DRIVERS\AVGIDSEH.Sys
03:05:40.0546 5164 AVGIDSEH - ok
03:05:40.0555 5164 [ FA0685CC51DE5CFD804E7DEAA6488E0E ] AVGIDSFilter C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys
03:05:40.0564 5164 AVGIDSFilter - ok
03:05:40.0577 5164 [ F788B51100D0F40EA176798CCE954A1A ] AVGIDSShim C:\Windows\system32\DRIVERS\AVGIDSShim.Sys
03:05:40.0587 5164 AVGIDSShim - ok
03:05:40.0625 5164 [ 901EB73F900D8DD1E8862C40427B83AE ] Avgldx86 C:\Windows\system32\DRIVERS\avgldx86.sys
03:05:40.0639 5164 Avgldx86 - ok
03:05:40.0664 5164 [ 5639DE66B37D02BD22DF4CF3155FBA60 ] Avgmfx86 C:\Windows\system32\DRIVERS\avgmfx86.sys
03:05:40.0673 5164 Avgmfx86 - ok
03:05:40.0693 5164 [ D1BAF652EDA0AE70896276A1FB32C2D4 ] Avgrkx86 C:\Windows\system32\DRIVERS\avgrkx86.sys
03:05:40.0702 5164 Avgrkx86 - ok
03:05:40.0741 5164 [ AAF0EBCAD95F2164CFFB544E00392498 ] Avgtdix C:\Windows\system32\DRIVERS\avgtdix.sys
03:05:40.0780 5164 Avgtdix - ok
03:05:40.0812 5164 [ 02A43ADBA362B89B7D5715221D5F3010 ] avgtp C:\Windows\system32\drivers\avgtpx86.sys
03:05:40.0845 5164 avgtp - ok
03:05:40.0868 5164 [ FC2BC51120A945F7C70376495E4E7737 ] avgwd C:\Program Files\AVG\AVG10\avgwdsvc.exe
03:05:40.0884 5164 avgwd - ok
03:05:40.0915 5164 [ AC3B76727695DC33E423152269F10ACA ] AVMCOWAN C:\Windows\system32\DRIVERS\AVMCOWAN.sys
03:05:40.0968 5164 AVMCOWAN - ok
03:05:41.0006 5164 [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll
03:05:41.0077 5164 AxInstSV - ok
03:05:41.0100 5164 [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys
03:05:41.0180 5164 b06bdrv - ok
03:05:41.0202 5164 [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys
03:05:41.0260 5164 b57nd60x - ok
03:05:41.0296 5164 [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC C:\Windows\System32\bdesvc.dll
03:05:41.0352 5164 BDESVC - ok
03:05:41.0376 5164 [ 505506526A9D467307B3C393DEDAF858 ] Beep C:\Windows\system32\drivers\Beep.sys
03:05:41.0434 5164 Beep - ok
03:05:41.0475 5164 [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE C:\Windows\System32\bfe.dll
03:05:41.0536 5164 BFE - ok
03:05:41.0575 5164 [ E585445D5021971FAE10393F0F1C3961 ] BITS C:\Windows\System32\qmgr.dll
03:05:41.0603 5164 BITS - ok
03:05:41.0689 5164 [ 686045905787B68D829CE647A6DFAD2B ] Blackberry Device Manager C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
03:05:41.0700 5164 Blackberry Device Manager ( UnsignedFile.Multi.Generic ) - warning
03:05:41.0701 5164 Blackberry Device Manager - detected UnsignedFile.Multi.Generic (1)
03:05:41.0724 5164 [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
03:05:41.0757 5164 blbdrive - ok
03:05:41.0803 5164 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
03:05:41.0817 5164 Bonjour Service - ok
03:05:41.0854 5164 [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
03:05:41.0908 5164 bowser - ok
03:05:41.0934 5164 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
03:05:41.0992 5164 BrFiltLo - ok
03:05:42.0023 5164 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
03:05:42.0072 5164 BrFiltUp - ok
03:05:42.0104 5164 [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser C:\Windows\System32\browser.dll
03:05:42.0129 5164 Browser - ok
03:05:42.0149 5164 [ 845B8CE732E67F3B4133164868C666EA ] Brserid C:\Windows\System32\Drivers\Brserid.sys
03:05:42.0190 5164 Brserid - ok
03:05:42.0201 5164 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
03:05:42.0243 5164 BrSerWdm - ok
03:05:42.0270 5164 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
03:05:42.0311 5164 BrUsbMdm - ok
03:05:42.0335 5164 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
03:05:42.0376 5164 BrUsbSer - ok
03:05:42.0401 5164 [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
03:05:42.0441 5164 BTHMODEM - ok
03:05:42.0481 5164 [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv C:\Windows\system32\bthserv.dll
03:05:42.0570 5164 bthserv - ok
03:05:42.0601 5164 [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
03:05:42.0637 5164 cdfs - ok
03:05:42.0667 5164 [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
03:05:42.0700 5164 cdrom - ok
03:05:42.0740 5164 [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc C:\Windows\System32\certprop.dll
03:05:42.0793 5164 CertPropSvc - ok
03:05:42.0814 5164 [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
03:05:42.0833 5164 circlass - ok
03:05:42.0870 5164 [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS C:\Windows\system32\CLFS.sys
03:05:42.0913 5164 CLFS - ok
03:05:42.0959 5164 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
03:05:42.0993 5164 clr_optimization_v2.0.50727_32 - ok
03:05:43.0055 5164 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
03:05:43.0080 5164 clr_optimization_v4.0.30319_32 - ok
03:05:43.0098 5164 [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
03:05:43.0115 5164 CmBatt - ok
03:05:43.0126 5164 [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide C:\Windows\system32\drivers\cmdide.sys
03:05:43.0141 5164 cmdide - ok
03:05:43.0175 5164 [ 42F158036BD4C2FF3122BF142E60E6FD ] CNG C:\Windows\system32\Drivers\cng.sys
03:05:43.0202 5164 CNG - ok
03:05:43.0218 5164 [ A6023D3823C37043986713F118A89BEE ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
03:05:43.0229 5164 Compbatt - ok
03:05:43.0260 5164 [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
03:05:43.0365 5164 CompositeBus - ok
03:05:43.0376 5164 COMSysApp - ok
03:05:43.0403 5164 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
03:05:43.0414 5164 crcdisk - ok
03:05:43.0447 5164 [ 96C0E38905CFD788313BE8E11DAE3F2F ] CryptSvc C:\Windows\system32\cryptsvc.dll
03:05:43.0514 5164 CryptSvc - ok
03:05:43.0540 5164 [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC C:\Windows\system32\drivers\csc.sys
03:05:43.0577 5164 CSC - ok
03:05:43.0645 5164 [ 15F93B37F6801943360D9EB42485D5D3 ] CscService C:\Windows\System32\cscsvc.dll
03:05:43.0717 5164 CscService - ok
03:05:43.0763 5164 [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch C:\Windows\system32\rpcss.dll
03:05:43.0823 5164 DcomLaunch - ok
03:05:43.0852 5164 [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc C:\Windows\System32\defragsvc.dll
03:05:43.0891 5164 defragsvc - ok
03:05:43.0919 5164 [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
03:05:43.0956 5164 DfsC - ok
03:05:43.0999 5164 [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp C:\Windows\system32\dhcpcore.dll
03:05:44.0021 5164 Dhcp - ok
03:05:44.0041 5164 [ 1A050B0274BFB3890703D490F330C0DA ] discache C:\Windows\system32\drivers\discache.sys
03:05:44.0076 5164 discache - ok
03:05:44.0107 5164 [ 565003F326F99802E68CA78F2A68E9FF ] Disk C:\Windows\system32\DRIVERS\disk.sys
03:05:44.0118 5164 Disk - ok
03:05:44.0145 5164 [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache C:\Windows\System32\dnsrslvr.dll
03:05:44.0210 5164 Dnscache - ok
03:05:44.0240 5164 [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc C:\Windows\System32\dot3svc.dll
03:05:44.0311 5164 dot3svc - ok
03:05:44.0342 5164 [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS C:\Windows\system32\dps.dll
03:05:44.0404 5164 DPS - ok
03:05:44.0435 5164 [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
03:05:44.0473 5164 drmkaud - ok
03:05:44.0519 5164 [ 16498EBC04AE9DD07049A8884B205C05 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
03:05:44.0550 5164 DXGKrnl - ok
03:05:44.0568 5164 [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost C:\Windows\System32\eapsvc.dll
03:05:44.0623 5164 EapHost - ok
03:05:44.0685 5164 [ 70B997B168AE99C900B3F6B00FB231D3 ] EaseUS Agent C:\Program Files\EaseUS\Todo Backup\bin\Agent.exe
03:05:44.0699 5164 EaseUS Agent - ok
03:05:44.0771 5164 [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv C:\Windows\system32\DRIVERS\evbdx.sys
03:05:44.0852 5164 ebdrv - ok
03:05:44.0881 5164 [ 81951F51E318AECC2D68559E47485CC4 ] EFS C:\Windows\System32\lsass.exe
03:05:44.0929 5164 EFS - ok
03:05:44.0972 5164 [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
03:05:45.0046 5164 ehRecvr - ok
03:05:45.0059 5164 [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched C:\Windows\ehome\ehsched.exe
03:05:45.0077 5164 ehSched - ok
03:05:45.0105 5164 [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
03:05:45.0122 5164 elxstor - ok
03:05:45.0135 5164 [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev C:\Windows\system32\drivers\errdev.sys
03:05:45.0167 5164 ErrDev - ok
03:05:45.0213 5164 [ DE3A2EA4D8ADCB66A4A480D50C351F0D ] EUBAKUP C:\Windows\system32\drivers\eubakup.sys
03:05:45.0241 5164 EUBAKUP - ok
03:05:45.0259 5164 [ C53EB687B7428EE0F106528AB0B1068F ] EUBKMON C:\Windows\system32\drivers\EUBKMON.sys
03:05:45.0288 5164 EUBKMON - ok
03:05:45.0300 5164 [ BFC9821147B594257F1EBC4B55B5664C ] EUDSKACS C:\Windows\system32\drivers\eudskacs.sys
03:05:45.0313 5164 EUDSKACS - ok
03:05:45.0331 5164 [ F4A7310C48CBA35A204A1442650ECD7C ] EUFDDISK C:\Windows\system32\drivers\EuFdDisk.sys
03:05:45.0347 5164 EUFDDISK - ok
03:05:45.0371 5164 [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem C:\Windows\system32\es.dll
03:05:45.0428 5164 EventSystem - ok
03:05:45.0469 5164 [ 2DC9108D74081149CC8B651D3A26207F ] exfat C:\Windows\system32\drivers\exfat.sys
03:05:45.0526 5164 exfat - ok
03:05:45.0564 5164 [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat C:\Windows\system32\drivers\fastfat.sys
03:05:45.0609 5164 fastfat - ok
03:05:45.0651 5164 [ 967EA5B213E9984CBE270205DF37755B ] Fax C:\Windows\system32\fxssvc.exe
03:05:45.0716 5164 Fax - ok
03:05:45.0735 5164 [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc C:\Windows\system32\DRIVERS\fdc.sys
03:05:45.0767 5164 fdc - ok
03:05:45.0803 5164 [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost C:\Windows\system32\fdPHost.dll
03:05:45.0843 5164 fdPHost - ok
03:05:45.0870 5164 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub C:\Windows\system32\fdrespub.dll
03:05:45.0909 5164 FDResPub - ok
03:05:45.0933 5164 FEE_FB - ok
03:05:45.0945 5164 [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
03:05:45.0956 5164 FileInfo - ok
03:05:45.0969 5164 [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
03:05:45.0990 5164 Filetrace - ok
03:05:46.0000 5164 [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
03:05:46.0030 5164 flpydisk - ok
03:05:46.0057 5164 [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
03:05:46.0070 5164 FltMgr - ok
03:05:46.0111 5164 [ E12C4928B32ACE04610259647F072635 ] FontCache C:\Windows\system32\FntCache.dll
03:05:46.0220 5164 FontCache - ok
03:05:46.0256 5164 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
03:05:46.0270 5164 FontCache3.0.0.0 - ok
03:05:46.0302 5164 [ C7C101E4026574EEA2075D6988F4F963 ] FPCIBASE C:\Windows\system32\DRIVERS\fpcibase.sys
03:05:46.0347 5164 FPCIBASE - ok
03:05:46.0385 5164 [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
03:05:46.0401 5164 FsDepends - ok
03:05:46.0427 5164 [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
03:05:46.0438 5164 Fs_Rec - ok
03:05:46.0476 5164 [ E306A24D9694C724FA2491278BF50FDB ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
03:05:46.0491 5164 fvevol - ok
03:05:46.0504 5164 [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
03:05:46.0516 5164 gagp30kx - ok
03:05:46.0541 5164 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
03:05:46.0549 5164 GEARAspiWDM - ok
03:05:46.0578 5164 [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc C:\Windows\System32\gpsvc.dll
03:05:46.0623 5164 gpsvc - ok
03:05:46.0654 5164 [ A09BD5E75C4BDACA295F9F1D9C5DFE38 ] Guard Agent C:\Program Files\EaseUS\Todo Backup\bin\GuardAgent.exe
03:05:46.0664 5164 Guard Agent - ok
03:05:46.0719 5164 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
03:05:46.0748 5164 gupdate - ok
03:05:46.0771 5164 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
03:05:46.0798 5164 gupdatem - ok
03:05:46.0822 5164 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
03:05:46.0838 5164 gusvc - ok
03:05:46.0867 5164 [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
03:05:46.0934 5164 hcw85cir - ok
03:05:46.0977 5164 [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
03:05:47.0019 5164 HdAudAddService - ok
03:05:47.0062 5164 [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
03:05:47.0096 5164 HDAudBus - ok
03:05:47.0132 5164 [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
03:05:47.0172 5164 HidBatt - ok
03:05:47.0202 5164 [ 89448F40E6DF260C206A193A4683BA78 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
03:05:47.0238 5164 HidBth - ok
03:05:47.0271 5164 [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
03:05:47.0291 5164 HidIr - ok
03:05:47.0315 5164 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv C:\Windows\system32\hidserv.dll
03:05:47.0344 5164 hidserv - ok
03:05:47.0382 5164 [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
03:05:47.0414 5164 HidUsb - ok
03:05:47.0446 5164 [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc C:\Windows\system32\kmsvc.dll
03:05:47.0484 5164 hkmsvc - ok
03:05:47.0515 5164 [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
03:05:47.0541 5164 HomeGroupListener - ok
03:05:47.0557 5164 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
03:05:47.0605 5164 HomeGroupProvider - ok
03:05:47.0647 5164 [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
03:05:47.0660 5164 HpSAMD - ok
03:05:47.0699 5164 [ 871917B07A141BFF43D76D8844D48106 ] HTTP C:\Windows\system32\drivers\HTTP.sys
03:05:47.0784 5164 HTTP - ok
03:05:47.0801 5164 [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
03:05:47.0818 5164 hwpolicy - ok
03:05:47.0841 5164 [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
03:05:47.0877 5164 i8042prt - ok
03:05:47.0904 5164 [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
03:05:47.0926 5164 iaStorV - ok
03:05:47.0954 5164 [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
03:05:47.0977 5164 idsvc - ok
03:05:47.0997 5164 [ 4173FF5708F3236CF25195FECD742915 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
03:05:48.0008 5164 iirsp - ok
03:05:48.0047 5164 [ AD5DF6F4FBBC798636EDC66BFEC7D0DE ] IJPLMSVC C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
03:05:48.0057 5164 IJPLMSVC - ok
03:05:48.0081 5164 [ F95622F161474511B8D80D6B093AA610 ] IKEEXT C:\Windows\System32\ikeext.dll
03:05:48.0109 5164 IKEEXT - ok
03:05:48.0128 5164 [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide C:\Windows\system32\drivers\intelide.sys
03:05:48.0139 5164 intelide - ok
03:05:48.0171 5164 [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
03:05:48.0203 5164 intelppm - ok
03:05:48.0236 5164 [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
03:05:48.0328 5164 IPBusEnum - ok
03:05:48.0351 5164 [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
03:05:48.0393 5164 IpFilterDriver - ok
03:05:48.0434 5164 [ 58F67245D041FBE7AF88F4EAF79DF0FA ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
03:05:48.0470 5164 iphlpsvc - ok
03:05:48.0499 5164 [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
03:05:48.0535 5164 IPMIDRV - ok
03:05:48.0564 5164 [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT C:\Windows\system32\drivers\ipnat.sys
03:05:48.0606 5164 IPNAT - ok
03:05:48.0655 5164 [ E46B17060D3962A384AE484094614788 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
03:05:48.0704 5164 iPod Service - ok
03:05:48.0728 5164 [ 9F7E491FB0BA0F9E370163834FC1FE31 ] irda C:\Windows\system32\DRIVERS\irda.sys
03:05:48.0781 5164 irda - ok
03:05:48.0815 5164 [ 42996CFF20A3084A56017B7902307E9F ] IRENUM C:\Windows\system32\drivers\irenum.sys
03:05:48.0836 5164 IRENUM - ok
03:05:48.0856 5164 [ 4220D2F03D5C4226D0A1AA4B84025E45 ] Irmon C:\Windows\System32\irmon.dll
03:05:48.0895 5164 Irmon - ok
03:05:48.0931 5164 [ D04DA73127FFED720DFC4EB673A23E04 ] irsir C:\Windows\system32\DRIVERS\irsir.sys
03:05:48.0986 5164 irsir - ok
03:05:48.0999 5164 [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp C:\Windows\system32\drivers\isapnp.sys
03:05:49.0016 5164 isapnp - ok
03:05:49.0037 5164 [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
03:05:49.0057 5164 iScsiPrt - ok
03:05:49.0078 5164 [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
03:05:49.0095 5164 kbdclass - ok
03:05:49.0121 5164 [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
03:05:49.0152 5164 kbdhid - ok
03:05:49.0176 5164 [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso C:\Windows\system32\lsass.exe
03:05:49.0187 5164 KeyIso - ok
03:05:49.0209 5164 [ 4635935FC972C582632BF45C26BFCB0E ] KMService C:\Windows\system32\srvany.exe
03:05:49.0215 5164 KMService ( UnsignedFile.Multi.Generic ) - warning
03:05:49.0215 5164 KMService - detected UnsignedFile.Multi.Generic (1)
03:05:49.0234 5164 [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
03:05:49.0245 5164 KSecDD - ok
03:05:49.0264 5164 [ 5FE1ABF1AF591A3458C9CF24ED9A4D35 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
03:05:49.0276 5164 KSecPkg - ok
03:05:49.0297 5164 [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm C:\Windows\system32\msdtckrm.dll
03:05:49.0337 5164 KtmRm - ok
03:05:49.0374 5164 [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer C:\Windows\system32\srvsvc.dll
03:05:49.0414 5164 LanmanServer - ok
03:05:49.0434 5164 [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
03:05:49.0483 5164 LanmanWorkstation - ok
03:05:49.0530 5164 [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
03:05:49.0603 5164 lltdio - ok
03:05:49.0626 5164 [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc C:\Windows\System32\lltdsvc.dll
03:05:49.0664 5164 lltdsvc - ok
03:05:49.0670 5164 [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts C:\Windows\System32\lmhsvc.dll
03:05:49.0703 5164 lmhosts - ok
03:05:49.0729 5164 [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
03:05:49.0741 5164 LSI_FC - ok
03:05:49.0755 5164 [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
03:05:49.0767 5164 LSI_SAS - ok
03:05:49.0785 5164 [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
03:05:49.0796 5164 LSI_SAS2 - ok
03:05:49.0809 5164 [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
03:05:49.0821 5164 LSI_SCSI - ok
03:05:49.0836 5164 [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv C:\Windows\system32\drivers\luafv.sys
03:05:49.0878 5164 luafv - ok
03:05:49.0910 5164 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
03:05:49.0923 5164 Mcx2Svc - ok
03:05:49.0936 5164 [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
03:05:49.0948 5164 megasas - ok
03:05:49.0960 5164 [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
03:05:49.0974 5164 MegaSR - ok
03:05:50.0027 5164 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
03:05:50.0060 5164 Microsoft Office Groove Audit Service - ok
03:05:50.0082 5164 [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS C:\Windows\system32\mmcss.dll
03:05:50.0162 5164 MMCSS - ok
03:05:50.0185 5164 [ F001861E5700EE84E2D4E52C712F4964 ] Modem C:\Windows\system32\drivers\modem.sys
03:05:50.0230 5164 Modem - ok
03:05:50.0260 5164 [ 79D10964DE86B292320E9DFE02282A23 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
03:05:50.0295 5164 monitor - ok
03:05:50.0330 5164 [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
03:05:50.0343 5164 mouclass - ok
03:05:50.0364 5164 [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
03:05:50.0398 5164 mouhid - ok
03:05:50.0432 5164 [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
03:05:50.0444 5164 mountmgr - ok
03:05:50.0480 5164 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio C:\Windows\system32\drivers\mpio.sys
03:05:50.0494 5164 mpio - ok
03:05:50.0506 5164 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
03:05:50.0544 5164 mpsdrv - ok
03:05:50.0580 5164 [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc C:\Windows\system32\mpssvc.dll
03:05:50.0634 5164 MpsSvc - ok
03:05:50.0661 5164 [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
03:05:50.0692 5164 MRxDAV - ok
03:05:50.0734 5164 [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
03:05:50.0747 5164 mrxsmb - ok
03:05:50.0761 5164 [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
03:05:50.0798 5164 mrxsmb10 - ok
03:05:50.0822 5164 [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
03:05:50.0834 5164 mrxsmb20 - ok
03:05:50.0843 5164 [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci C:\Windows\system32\drivers\msahci.sys
03:05:50.0854 5164 msahci - ok
03:05:50.0871 5164 [ 55055F8AD8BE27A64C831322A780A228 ] msdsm C:\Windows\system32\drivers\msdsm.sys
03:05:50.0883 5164 msdsm - ok
03:05:50.0906 5164 [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC C:\Windows\System32\msdtc.exe
03:05:50.0942 5164 MSDTC - ok
03:05:50.0990 5164 [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs C:\Windows\system32\drivers\Msfs.sys
03:05:51.0011 5164 Msfs - ok
03:05:51.0023 5164 [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
03:05:51.0065 5164 mshidkmdf - ok
03:05:51.0099 5164 [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
03:05:51.0109 5164 msisadrv - ok
03:05:51.0138 5164 [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
03:05:51.0181 5164 MSiSCSI - ok
03:05:51.0185 5164 msiserver - ok
03:05:51.0211 5164 [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
03:05:51.0233 5164 MSKSSRV - ok
03:05:51.0242 5164 [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
03:05:51.0286 5164 MSPCLOCK - ok
03:05:51.0305 5164 [ F456E973590D663B1073E9C463B40932 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
03:05:51.0346 5164 MSPQM - ok
03:05:51.0372 5164 [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
03:05:51.0385 5164 MsRPC - ok
03:05:51.0411 5164 [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
03:05:51.0420 5164 mssmbios - ok
03:05:51.0429 5164 [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
03:05:51.0451 5164 MSTEE - ok
03:05:51.0465 5164 [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
03:05:51.0493 5164 MTConfig - ok
03:05:51.0530 5164 [ 0F24624106D8042E7F27882D9D6FF5C0 ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys
03:05:51.0558 5164 MTsensor - ok
03:05:51.0583 5164 [ 159FAD02F64E6381758C990F753BCC80 ] Mup C:\Windows\system32\Drivers\mup.sys
03:05:51.0594 5164 Mup - ok
03:05:51.0612 5164 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent C:\Windows\system32\qagentRT.dll
03:05:51.0653 5164 napagent - ok
03:05:51.0694 5164 [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
03:05:51.0744 5164 NativeWifiP - ok
03:05:51.0796 5164 [ 8C9C922D71F1CD4DEF73F186416B7896 ] NDIS C:\Windows\system32\drivers\ndis.sys
03:05:51.0844 5164 NDIS - ok
03:05:51.0857 5164 [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
03:05:51.0905 5164 NdisCap - ok
03:05:51.0931 5164 [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
03:05:51.0974 5164 NdisTapi - ok
03:05:52.0004 5164 [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
03:05:52.0045 5164 Ndisuio - ok
03:05:52.0069 5164 [ 38FBE267E7E6983311179230FACB1017 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
03:05:52.0108 5164 NdisWan - ok
03:05:52.0136 5164 [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
03:05:52.0157 5164 NDProxy - ok
03:05:52.0171 5164 [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
03:05:52.0213 5164 NetBIOS - ok
03:05:52.0250 5164 [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
03:05:52.0285 5164 NetBT - ok
03:05:52.0313 5164 NETFRITZ - ok
03:05:52.0323 5164 [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon C:\Windows\system32\lsass.exe
03:05:52.0333 5164 Netlogon - ok
03:05:52.0372 5164 [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman C:\Windows\System32\netman.dll
03:05:52.0466 5164 Netman - ok
03:05:52.0492 5164 [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm C:\Windows\System32\netprofm.dll
03:05:52.0522 5164 netprofm - ok
03:05:52.0540 5164 [ F476EC40033CDB91EFBE73EB99B8362D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
03:05:52.0553 5164 NetTcpPortSharing - ok
03:05:52.0580 5164 [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
03:05:52.0593 5164 nfrd960 - ok
03:05:52.0612 5164 [ 374071043F9E4231EE43BE2BB48DD36D ] NlaSvc C:\Windows\System32\nlasvc.dll
03:05:52.0652 5164 NlaSvc - ok
03:05:52.0676 5164 [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs C:\Windows\system32\drivers\Npfs.sys
03:05:52.0702 5164 Npfs - ok
03:05:52.0712 5164 [ BA387E955E890C8A88306D9B8D06BF17 ] nsi C:\Windows\system32\nsisvc.dll
03:05:52.0735 5164 nsi - ok
03:05:52.0748 5164 [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
03:05:52.0788 5164 nsiproxy - ok
03:05:52.0843 5164 [ 5E43D2B0EE64123D4880DFA6626DEFDE ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
03:05:52.0885 5164 Ntfs - ok
03:05:52.0895 5164 [ F9756A98D69098DCA8945D62858A812C ] Null C:\Windows\system32\drivers\Null.sys
03:05:52.0937 5164 Null - ok
03:05:52.0973 5164 [ B5E37E31C053BC9950455A257526514B ] NVENETFD C:\Windows\system32\DRIVERS\nvm62x32.sys
03:05:53.0012 5164 NVENETFD - ok
03:05:53.0236 5164 [ 9A77B1C13BCCEDDF78DFD7AFC25B4F5E ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
03:05:53.0492 5164 nvlddmkm - ok
03:05:53.0533 5164 [ 1DE923088878B495CD4219E47BA34EB8 ] NVNET C:\Windows\system32\DRIVERS\nvmf6232.sys
03:05:53.0546 5164 NVNET - ok
03:05:53.0562 5164 [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid C:\Windows\system32\drivers\nvraid.sys
03:05:53.0575 5164 nvraid - ok
03:05:53.0595 5164 [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor C:\Windows\system32\DRIVERS\nvstor.sys
03:05:53.0605 5164 nvstor - ok
03:05:53.0627 5164 [ 31B8835B003CAA6D31BEAD83DDBF98E5 ] nvsvc C:\Windows\system32\nvvsvc.exe
03:05:53.0648 5164 nvsvc - ok
03:05:53.0757 5164 [ F935E817409F78FA50C5921DB39124B3 ] nvUpdatusService C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
03:05:53.0828 5164 nvUpdatusService - ok
03:05:53.0848 5164 [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
03:05:53.0862 5164 nv_agp - ok
03:05:53.0918 5164 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
03:05:53.0937 5164 odserv - ok
03:05:53.0963 5164 [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
03:05:53.0993 5164 ohci1394 - ok
03:05:54.0040 5164 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
03:05:54.0053 5164 ose - ok
03:05:54.0078 5164 [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
03:05:54.0135 5164 p2pimsvc - ok
03:05:54.0160 5164 [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc C:\Windows\system32\p2psvc.dll
03:05:54.0196 5164 p2psvc - ok
03:05:54.0237 5164 [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport C:\Windows\system32\DRIVERS\parport.sys
03:05:54.0274 5164 Parport - ok
03:05:54.0307 5164 [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr C:\Windows\system32\drivers\partmgr.sys
03:05:54.0334 5164 partmgr - ok
03:05:54.0342 5164 [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys
03:05:54.0377 5164 Parvdm - ok
03:05:54.0400 5164 [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc C:\Windows\System32\pcasvc.dll
03:05:54.0422 5164 PcaSvc - ok
03:05:54.0438 5164 [ 673E55C3498EB970088E812EA820AA8F ] pci C:\Windows\system32\drivers\pci.sys
03:05:54.0457 5164 pci - ok
03:05:54.0479 5164 [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide C:\Windows\system32\drivers\pciide.sys
03:05:54.0494 5164 pciide - ok
03:05:54.0512 5164 [ F396431B31693E71E8A80687EF523506 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
03:05:54.0531 5164 pcmcia - ok
03:05:54.0549 5164 [ 250F6B43D2B613172035C6747AEEB19F ] pcw C:\Windows\system32\drivers\pcw.sys
03:05:54.0560 5164 pcw - ok
03:05:54.0582 5164 [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH C:\Windows\system32\drivers\peauth.sys
03:05:54.0629 5164 PEAUTH - ok
03:05:54.0678 5164 [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
03:05:54.0730 5164 PeerDistSvc - ok
03:05:54.0781 5164 [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla C:\Windows\system32\pla.dll
03:05:54.0845 5164 pla - ok
03:05:54.0902 5164 [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay C:\Windows\system32\umpnpmgr.dll
03:05:54.0999 5164 PlugPlay - ok
03:05:55.0028 5164 [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
03:05:55.0082 5164 PNRPAutoReg - ok
03:05:55.0110 5164 [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
03:05:55.0129 5164 PNRPsvc - ok
03:05:55.0154 5164 [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
03:05:55.0212 5164 PolicyAgent - ok
03:05:55.0246 5164 [ F87D30E72E03D579A5199CCB3831D6EA ] Power C:\Windows\system32\umpo.dll
03:05:55.0289 5164 Power - ok
03:05:55.0327 5164 [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
03:05:55.0361 5164 PptpMiniport - ok
03:05:55.0373 5164 [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor C:\Windows\system32\DRIVERS\processr.sys
03:05:55.0404 5164 Processor - ok
03:05:55.0443 5164 [ CADEFAC453040E370A1BDFF3973BE00D ] ProfSvc C:\Windows\system32\profsvc.dll
03:05:55.0506 5164 ProfSvc - ok
03:05:55.0519 5164 [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
03:05:55.0530 5164 ProtectedStorage - ok
03:05:55.0552 5164 [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched C:\Windows\system32\DRIVERS\pacer.sys
03:05:55.0573 5164 Psched - ok
03:05:55.0607 5164 [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
03:05:55.0650 5164 ql2300 - ok
03:05:55.0668 5164 [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
03:05:55.0680 5164 ql40xx - ok
03:05:55.0698 5164 [ 31AC809E7707EB580B2BDB760390765A ] QWAVE C:\Windows\system32\qwave.dll
03:05:55.0728 5164 QWAVE - ok
03:05:55.0752 5164 [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
03:05:55.0766 5164 QWAVEdrv - ok
03:05:55.0779 5164 [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
03:05:55.0816 5164 RasAcd - ok
03:05:55.0843 5164 [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
03:05:55.0864 5164 RasAgileVpn - ok
03:05:55.0876 5164 [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto C:\Windows\System32\rasauto.dll
03:05:55.0901 5164 RasAuto - ok
03:05:55.0909 5164 [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
03:05:55.0932 5164 Rasl2tp - ok
03:05:55.0959 5164 [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan C:\Windows\System32\rasmans.dll
03:05:55.0997 5164 RasMan - ok
03:05:56.0020 5164 [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
03:05:56.0042 5164 RasPppoe - ok
03:05:56.0068 5164 [ 44101F495A83EA6401D886E7FD70096B ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
03:05:56.0105 5164 RasSstp - ok
03:05:56.0132 5164 [ D528BC58A489409BA40334EBF96A311B ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
03:05:56.0187 5164 rdbss - ok
03:05:56.0207 5164 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
03:05:56.0220 5164 rdpbus - ok
03:05:56.0241 5164 [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
03:05:56.0278 5164 RDPCDD - ok
03:05:56.0305 5164 [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
03:05:56.0329 5164 RDPDR - ok
03:05:56.0344 5164 [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
03:05:56.0365 5164 RDPENCDD - ok
03:05:56.0376 5164 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
03:05:56.0417 5164 RDPREFMP - ok
03:05:56.0463 5164 [ 65375DF758CA1872AB7EBBBA457FD5E6 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
03:05:56.0526 5164 RdpVideoMiniport - ok
03:05:56.0556 5164 [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
03:05:56.0618 5164 RDPWD - ok
03:05:56.0642 5164 [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
03:05:56.0661 5164 rdyboost - ok
03:05:56.0685 5164 [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess C:\Windows\System32\mprdim.dll
03:05:56.0733 5164 RemoteAccess - ok
03:05:56.0769 5164 [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry C:\Windows\system32\regsvc.dll
03:05:56.0820 5164 RemoteRegistry - ok
03:05:56.0857 5164 [ BBCE96557881586683611C561FB06269 ] RimUsb C:\Windows\system32\Drivers\RimUsb.sys
03:05:56.0903 5164 RimUsb - ok
03:05:56.0923 5164 [ C4F4FCD5AE48BDD31648981DDF8EF993 ] RimVSerPort C:\Windows\system32\DRIVERS\RimSerial.sys
03:05:56.0942 5164 RimVSerPort - ok
03:05:56.0969 5164 [ 564297827D213F52C7A3A2FF749568CA ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys
03:05:57.0005 5164 ROOTMODEM - ok
03:05:57.0027 5164 [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
03:05:57.0071 5164 RpcEptMapper - ok
03:05:57.0100 5164 [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator C:\Windows\system32\locator.exe
03:05:57.0130 5164 RpcLocator - ok
03:05:57.0157 5164 [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs C:\Windows\system32\rpcss.dll
03:05:57.0179 5164 RpcSs - ok
03:05:57.0198 5164 [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
03:05:57.0222 5164 rspndr - ok
03:05:57.0256 5164 [ 3983CEA05BB855351D75F5482B6C42CE ] RTL8167 C:\Windows\system32\DRIVERS\Rt86win7.sys
03:05:57.0292 5164 RTL8167 - ok
03:05:57.0312 5164 [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
03:05:57.0361 5164 s3cap - ok
03:05:57.0384 5164 [ 81951F51E318AECC2D68559E47485CC4 ] SamSs C:\Windows\system32\lsass.exe
03:05:57.0418 5164 SamSs - ok
03:05:57.0467 5164 [ 307A3B0279A0D1848E57509B28F8EAE3 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
03:05:57.0474 5164 Suspicious file (Forged): C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS. Real md5: 307A3B0279A0D1848E57509B28F8EAE3, Fake md5: 29AEDA4211E2789370B0131C90DFD5CF
03:05:57.0475 5164 SASDIFSV ( ForgedFile.Multi.Generic ) - warning
03:05:57.0475 5164 SASDIFSV - detected ForgedFile.Multi.Generic (1)
03:05:57.0503 5164 [ B1BD3B812F9DA208EFE20860403D8A27 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
03:05:57.0509 5164 Suspicious file (Forged): C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS. Real md5: B1BD3B812F9DA208EFE20860403D8A27, Fake md5: 518CCE3882B4A3046647E18EDAE6ABAB
03:05:57.0510 5164 SASKUTIL ( ForgedFile.Multi.Generic ) - warning
03:05:57.0510 5164 SASKUTIL - detected ForgedFile.Multi.Generic (1)
03:05:57.0541 5164 [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
03:05:57.0572 5164 sbp2port - ok
03:05:57.0594 5164 [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr C:\Windows\System32\SCardSvr.dll
03:05:57.0649 5164 SCardSvr - ok
03:05:57.0674 5164 [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
03:05:57.0709 5164 scfilter - ok
03:05:57.0754 5164 [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule C:\Windows\system32\schedsvc.dll
03:05:57.0806 5164 Schedule - ok
03:05:57.0840 5164 [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc C:\Windows\System32\certprop.dll
03:05:57.0859 5164 SCPolicySvc - ok
03:05:57.0877 5164 [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC C:\Windows\System32\SDRSVC.dll
03:05:57.0924 5164 SDRSVC - ok
03:05:57.0951 5164 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
03:05:57.0973 5164 secdrv - ok
03:05:57.0992 5164 [ A59B3A4442C52060CC7A85293AA3546F ] seclogon C:\Windows\system32\seclogon.dll
03:05:58.0032 5164 seclogon - ok
03:05:58.0054 5164 [ DCB7FCDCC97F87360F75D77425B81737 ] SENS C:\Windows\System32\sens.dll
03:05:58.0096 5164 SENS - ok
03:05:58.0127 5164 [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc C:\Windows\system32\sensrsvc.dll
03:05:58.0197 5164 SensrSvc - ok
03:05:58.0210 5164 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
03:05:58.0261 5164 Serenum - ok
03:05:58.0300 5164 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial C:\Windows\system32\DRIVERS\serial.sys
03:05:58.0335 5164 Serial - ok
03:05:58.0367 5164 [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
03:05:58.0384 5164 sermouse - ok
03:05:58.0416 5164 [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv C:\Windows\system32\sessenv.dll
03:05:58.0450 5164 SessionEnv - ok
03:05:58.0465 5164 [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
03:05:58.0519 5164 sffdisk - ok
03:05:58.0531 5164 [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
03:05:58.0561 5164 sffp_mmc - ok
03:05:58.0583 5164 [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
03:05:58.0609 5164 sffp_sd - ok
03:05:58.0641 5164 [ DB96666CC8312EBC45032F30B007A547 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
03:05:58.0667 5164 sfloppy - ok
03:05:58.0700 5164 [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess C:\Windows\System32\ipnathlp.dll
03:05:58.0747 5164 SharedAccess - ok
03:05:58.0783 5164 [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
03:05:58.0808 5164 ShellHWDetection - ok
03:05:58.0830 5164 [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
03:05:58.0840 5164 SiSRaid2 - ok
03:05:58.0853 5164 [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
03:05:58.0865 5164 SiSRaid4 - ok
03:05:58.0886 5164 [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb C:\Windows\system32\DRIVERS\smb.sys
03:05:58.0910 5164 Smb - ok
03:05:58.0940 5164 [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
03:05:58.0953 5164 SNMPTRAP - ok
03:05:58.0962 5164 [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr C:\Windows\system32\drivers\spldr.sys
03:05:58.0972 5164 spldr - ok
03:05:58.0991 5164 [ 9AEA093B8F9C37CF45538382CABA2475 ] Spooler C:\Windows\System32\spoolsv.exe
03:05:59.0057 5164 Spooler - ok
03:05:59.0151 5164 [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc C:\Windows\system32\sppsvc.exe
03:05:59.0255 5164 sppsvc - ok
03:05:59.0271 5164 [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify C:\Windows\system32\sppuinotify.dll
03:05:59.0322 5164 sppuinotify - ok
03:05:59.0355 5164 [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv C:\Windows\system32\DRIVERS\srv.sys
03:05:59.0385 5164 srv - ok
03:05:59.0416 5164 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
03:05:59.0446 5164 srv2 - ok
03:05:59.0466 5164 [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
03:05:59.0502 5164 srvnet - ok
03:05:59.0530 5164 [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
03:05:59.0554 5164 SSDPSRV - ok
03:05:59.0569 5164 [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc C:\Windows\system32\sstpsvc.dll
03:05:59.0607 5164 SstpSvc - ok
03:05:59.0638 5164 [ DB32D325C192B801DF274BFD12A7E72B ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
03:05:59.0649 5164 stexstor - ok
03:05:59.0684 5164 [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc C:\Windows\System32\wiaservc.dll
03:05:59.0725 5164 StiSvc - ok
03:05:59.0755 5164 [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
03:05:59.0788 5164 storflt - ok
03:05:59.0809 5164 [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc C:\Windows\system32\drivers\storvsc.sys
03:05:59.0844 5164 storvsc - ok
03:05:59.0857 5164 [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum C:\Windows\system32\drivers\swenum.sys
03:05:59.0873 5164 swenum - ok
03:05:59.0892 5164 [ A28BD92DF340E57B024BA433165D34D7 ] swprv C:\Windows\System32\swprv.dll
03:05:59.0932 5164 swprv - ok
03:05:59.0942 5164 Synth3dVsc - ok
03:05:59.0975 5164 [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain C:\Windows\system32\sysmain.dll
03:06:00.0017 5164 SysMain - ok
03:06:00.0044 5164 [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
03:06:00.0079 5164 TabletInputService - ok
03:06:00.0110 5164 [ 613BF4820361543956909043A265C6AC ] TapiSrv C:\Windows\System32\tapisrv.dll
03:06:00.0134 5164 TapiSrv - ok
03:06:00.0143 5164 [ B799D9FDB26111737F58288D8DC172D9 ] TBS C:\Windows\System32\tbssvc.dll
03:06:00.0184 5164 TBS - ok
03:06:00.0229 5164 [ 7C0507D2391AF5933600CBCED799F277 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
03:06:00.0271 5164 Tcpip - ok
03:06:00.0299 5164 [ 7C0507D2391AF5933600CBCED799F277 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
03:06:00.0322 5164 TCPIP6 - ok
03:06:00.0348 5164 [ 3EEBD3BD93DA46A26E89893C7AB2FF3B ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
03:06:00.0380 5164 tcpipreg - ok
03:06:00.0409 5164 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
03:06:00.0450 5164 TDPIPE - ok
03:06:00.0462 5164 [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
03:06:00.0490 5164 TDTCP - ok
03:06:00.0518 5164 [ B459575348C20E8121D6039DA063C704 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
03:06:00.0557 5164 tdx - ok
03:06:00.0664 5164 [ 2BBB318EA9F34FDC508CEA4AAB98D770 ] TeamViewer7 C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
03:06:00.0776 5164 TeamViewer7 - ok
03:06:00.0799 5164 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD C:\Windows\system32\drivers\termdd.sys
03:06:00.0812 5164 TermDD - ok
03:06:00.0855 5164 [ 382C804C92811BE57829D8E550A900E2 ] TermService C:\Windows\System32\termsrv.dll
03:06:00.0909 5164 TermService - ok
03:06:00.0936 5164 [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes C:\Windows\system32\themeservice.dll
03:06:00.0954 5164 Themes - ok
03:06:00.0962 5164 [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER C:\Windows\system32\mmcss.dll
03:06:00.0987 5164 THREADORDER - ok
03:06:01.0006 5164 [ B0B3122BFF3910E0BA97014045467778 ] tifsfilter C:\Windows\system32\DRIVERS\tifsfilt.sys
03:06:01.0028 5164 tifsfilter - ok
03:06:01.0045 5164 [ 13BFE330880AC0CE8672D00AA5AFF738 ] timounter C:\Windows\system32\DRIVERS\timntr.sys
03:06:01.0060 5164 timounter - ok
03:06:01.0071 5164 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks C:\Windows\System32\trkwks.dll
03:06:01.0111 5164 TrkWks - ok
03:06:01.0157 5164 [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
03:06:01.0179 5164 TrustedInstaller - ok
03:06:01.0193 5164 [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
03:06:01.0215 5164 tssecsrv - ok
03:06:01.0233 5164 [ 9CE253214ACAA5A7D323327D2055EFAA ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
03:06:01.0264 5164 TsUsbFlt - ok
03:06:01.0268 5164 tsusbhub - ok
03:06:01.0361 5164 [ AF5F31156EE89D35AD6EC3179A805D23 ] TuneUp.UtilitiesSvc C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe
03:06:01.0433 5164 TuneUp.UtilitiesSvc - ok
03:06:01.0468 5164 [ F2107C9D85EC0DF116939CCCE06AE697 ] TuneUpUtilitiesDrv C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys
03:06:01.0481 5164 TuneUpUtilitiesDrv - ok
03:06:01.0509 5164 [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
03:06:01.0546 5164 tunnel - ok
03:06:01.0575 5164 [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
03:06:01.0586 5164 uagp35 - ok
03:06:01.0607 5164 [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs C:\Windows\system32\DRIVERS\udfs.sys
03:06:01.0650 5164 udfs - ok
03:06:01.0686 5164 [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
03:06:01.0721 5164 UI0Detect - ok
03:06:01.0759 5164 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
03:06:01.0770 5164 uliagpkx - ok
03:06:01.0785 5164 [ D295BED4B898F0FD999FCFA9B32B071B ] umbus C:\Windows\system32\drivers\umbus.sys
03:06:01.0798 5164 umbus - ok
03:06:01.0809 5164 [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
03:06:01.0839 5164 UmPass - ok
03:06:01.0867 5164 [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService C:\Windows\System32\umrdp.dll
03:06:01.0900 5164 UmRdpService - ok
03:06:01.0934 5164 [ 833FBB672460EFCE8011D262175FAD33 ] upnphost C:\Windows\System32\upnphost.dll
03:06:01.0959 5164 upnphost - ok
03:06:01.0978 5164 [ 8BF5D980CDCE35FB26F05047144BB57E ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
03:06:01.0992 5164 USBAAPL ( UnsignedFile.Multi.Generic ) - warning
03:06:01.0992 5164 USBAAPL - detected UnsignedFile.Multi.Generic (1)
03:06:02.0016 5164 [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
03:06:02.0050 5164 usbccgp - ok
03:06:02.0075 5164 [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir C:\Windows\system32\drivers\usbcir.sys
03:06:02.0117 5164 usbcir - ok
03:06:02.0143 5164 [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
03:06:02.0155 5164 usbehci - ok
03:06:02.0179 5164 [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
03:06:02.0192 5164 usbhub - ok
03:06:02.0205 5164 [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
03:06:02.0217 5164 usbohci - ok
03:06:02.0234 5164 [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
03:06:02.0267 5164 usbprint - ok
03:06:02.0308 5164 [ 576096CCBC07E7C4EA4F5E6686D6888F ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
03:06:02.0368 5164 usbscan - ok
03:06:02.0393 5164 [ F991AB9CC6B908DB552166768176896A ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
03:06:02.0450 5164 USBSTOR - ok
03:06:02.0471 5164 [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
03:06:02.0488 5164 usbuhci - ok
03:06:02.0513 5164 [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms C:\Windows\System32\uxsms.dll
03:06:02.0546 5164 UxSms - ok
03:06:02.0586 5164 [ 6275822AC454A8A831D063841A4DBB5D ] UxTuneUp C:\Windows\System32\uxtuneup.dll
03:06:02.0596 5164 UxTuneUp - ok
03:06:02.0604 5164 [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc C:\Windows\system32\lsass.exe
03:06:02.0614 5164 VaultSvc - ok
03:06:02.0627 5164 [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
03:06:02.0637 5164 vdrvroot - ok
03:06:02.0661 5164 [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds C:\Windows\System32\vds.exe
03:06:02.0702 5164 vds - ok
03:06:02.0735 5164 [ 17C408214EA61696CEC9C66E388B14F3 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
03:06:02.0763 5164 vga - ok
03:06:02.0781 5164 [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave C:\Windows\System32\drivers\vga.sys
03:06:02.0802 5164 VgaSave - ok
03:06:02.0816 5164 VGPU - ok
03:06:02.0840 5164 [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
03:06:02.0853 5164 vhdmp - ok
03:06:02.0873 5164 [ C829317A37B4BEA8F39735D4B076E923 ] viaagp C:\Windows\system32\drivers\viaagp.sys
03:06:02.0884 5164 viaagp - ok
03:06:02.0895 5164 [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7 C:\Windows\system32\DRIVERS\viac7.sys
03:06:02.0921 5164 ViaC7 - ok
03:06:02.0945 5164 [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide C:\Windows\system32\drivers\viaide.sys
03:06:02.0956 5164 viaide - ok
03:06:02.0969 5164 [ C2F2911156FDC7817C52829C86DA494E ] vmbus C:\Windows\system32\drivers\vmbus.sys
03:06:02.0983 5164 vmbus - ok
03:06:02.0998 5164 [ D4D77455211E204F370D08F4963063CE ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
03:06:03.0011 5164 VMBusHID - ok
03:06:03.0023 5164 [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr C:\Windows\system32\drivers\volmgr.sys
03:06:03.0036 5164 volmgr - ok
03:06:03.0051 5164 [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
03:06:03.0067 5164 volmgrx - ok
03:06:03.0077 5164 [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap C:\Windows\system32\drivers\volsnap.sys
03:06:03.0092 5164 volsnap - ok
03:06:03.0117 5164 [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
03:06:03.0130 5164 vsmraid - ok
03:06:03.0165 5164 [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS C:\Windows\system32\vssvc.exe
03:06:03.0220 5164 VSS - ok
03:06:03.0318 5164 [ 4B817450226F93C31ADD5BCC27FED27A ] vToolbarUpdater15.2.0 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
03:06:03.0369 5164 vToolbarUpdater15.2.0 - ok
03:06:03.0383 5164 [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
03:06:03.0419 5164 vwifibus - ok
03:06:03.0458 5164 [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time C:\Windows\system32\w32time.dll
03:06:03.0489 5164 W32Time - ok
03:06:03.0509 5164 [ DE3721E89C653AA281428C8A69745D90 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
03:06:03.0542 5164 WacomPen - ok
03:06:03.0580 5164 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
03:06:03.0605 5164 WANARP - ok
03:06:03.0609 5164 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
03:06:03.0632 5164 Wanarpv6 - ok
03:06:03.0662 5164 [ 691E3285E53DCA558E1A84667F13E15A ] wbengine C:\Windows\system32\wbengine.exe
03:06:03.0737 5164 wbengine - ok
03:06:03.0746 5164 [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
03:06:03.0776 5164 WbioSrvc - ok
03:06:03.0807 5164 [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc C:\Windows\System32\wcncsvc.dll
03:06:03.0841 5164 wcncsvc - ok
03:06:03.0863 5164 [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
03:06:03.0926 5164 WcsPlugInService - ok
03:06:03.0943 5164 [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd C:\Windows\system32\DRIVERS\wd.sys
03:06:03.0955 5164 Wd - ok
03:06:03.0991 5164 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
03:06:04.0010 5164 Wdf01000 - ok
03:06:04.0019 5164 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost C:\Windows\system32\wdi.dll
03:06:04.0054 5164 WdiServiceHost - ok
03:06:04.0057 5164 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost C:\Windows\system32\wdi.dll
03:06:04.0070 5164 WdiSystemHost - ok
03:06:04.0091 5164 [ A9D880F97530D5B8FEE278923349929D ] WebClient C:\Windows\System32\webclnt.dll
03:06:04.0123 5164 WebClient - ok
03:06:04.0157 5164 [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc C:\Windows\system32\wecsvc.dll
03:06:04.0181 5164 Wecsvc - ok
03:06:04.0195 5164 [ AC804569BB2364FB6017370258A4091B ] wercplsupport C:\Windows\System32\wercplsupport.dll
03:06:04.0216 5164 wercplsupport - ok
03:06:04.0232 5164 [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc C:\Windows\System32\WerSvc.dll
03:06:04.0274 5164 WerSvc - ok
03:06:04.0312 5164 [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
03:06:04.0377 5164 WfpLwf - ok
03:06:04.0396 5164 [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount C:\Windows\system32\drivers\wimmount.sys
03:06:04.0417 5164 WIMMount - ok
03:06:04.0474 5164 [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
03:06:04.0522 5164 WinDefend - ok
03:06:04.0546 5164 WinHttpAutoProxySvc - ok
03:06:04.0586 5164 [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
03:06:04.0619 5164 Winmgmt - ok
03:06:04.0659 5164 [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM C:\Windows\system32\WsmSvc.dll
03:06:04.0729 5164 WinRM - ok
03:06:04.0769 5164 [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
03:06:04.0804 5164 WinUsb - ok
03:06:04.0845 5164 [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc C:\Windows\System32\wlansvc.dll
03:06:04.0869 5164 Wlansvc - ok
03:06:04.0887 5164 [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
03:06:04.0921 5164 WmiAcpi - ok
03:06:04.0956 5164 [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
03:06:04.0984 5164 wmiApSrv - ok
03:06:05.0059 5164 [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
03:06:05.0167 5164 WMPNetworkSvc - ok
03:06:05.0183 5164 [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc C:\Windows\System32\wpcsvc.dll
03:06:05.0214 5164 WPCSvc - ok
03:06:05.0233 5164 [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
03:06:05.0296 5164 WPDBusEnum - ok
03:06:05.0320 5164 [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
03:06:05.0362 5164 ws2ifsl - ok
03:06:05.0387 5164 [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc C:\Windows\System32\wscsvc.dll
03:06:05.0420 5164 wscsvc - ok
03:06:05.0424 5164 WSearch - ok
03:06:05.0484 5164 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
03:06:05.0539 5164 wuauserv - ok
03:06:05.0565 5164 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
03:06:05.0592 5164 WudfPf - ok
03:06:05.0621 5164 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
03:06:05.0635 5164 WUDFRd - ok
03:06:05.0657 5164 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
03:06:05.0670 5164 wudfsvc - ok
03:06:05.0702 5164 [ 3C5E51C05BE9B56EAFF4E388C3AB25E4 ] WwanSvc C:\Windows\System32\wwansvc.dll
03:06:05.0764 5164 WwanSvc - ok
03:06:05.0822 5164 [ 24FB8DB6D1D55E2C5D0A53DFE48E6AF8 ] Yontoo Desktop Updater C:\Program Files\Yontoo\Y2Desktop.Updater.exe
03:06:05.0835 5164 Yontoo Desktop Updater ( UnsignedFile.Multi.Generic ) - warning
03:06:05.0835 5164 Yontoo Desktop Updater - detected UnsignedFile.Multi.Generic (1)
03:06:05.0863 5164 ZDCNDIS5 - ok
03:06:05.0907 5164 [ BE701D39FB0543083DDF74227638BCF3 ] ZY202_VS C:\Windows\system32\DRIVERS\WlanGZG.sys
03:06:06.0000 5164 ZY202_VS - ok
03:06:06.0049 5164 ================ Scan global ===============================
03:06:06.0066 5164 [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
03:06:06.0087 5164 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
03:06:06.0097 5164 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
03:06:06.0116 5164 [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
03:06:06.0134 5164 [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
03:06:06.0139 5164 [Global] - ok
03:06:06.0139 5164 ================ Scan MBR ==================================
03:06:06.0150 5164 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
03:06:06.0542 5164 \Device\Harddisk0\DR0 - ok
03:06:06.0543 5164 ================ Scan VBR ==================================
03:06:06.0575 5164 [ 38BC9F6676AA86810DEAC4D8F68C44FF ] \Device\Harddisk0\DR0\Partition1
03:06:06.0579 5164 \Device\Harddisk0\DR0\Partition1 - ok
03:06:06.0580 5164 ============================================================
03:06:06.0580 5164 Scan finished
03:06:06.0580 5164 ============================================================
03:06:06.0753 5148 Detected object count: 7
03:06:06.0753 5148 Actual detected object count: 7

markusg · 24.05.2013, 23:18

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

oly22 · 24.05.2013, 23:33

Wie lange dauert denn Combofix, bis es durchgelaufen ist?! Der grüne Balken oben im Fenster ist fast ganz durch, jetzt steht er aber seit gut 5min stikll und es sind im Fenster nach lauter "Dekomprimiere" zwei mal Zielverzeichnis: C:\ und zahlen-ubuchstaben als Dateinamen...
ist das so noch ok?

nach wie vor unverändert.... aufgehängt?

seit gut 30min tut sich nix mehr auf dem bildschirm....

markusg · 25.05.2013, 15:36

starte mal neu in den abgesicherten modus, melde dich in deinem Konto an und versuch combofix erneut.
in den abges Modus kommst du bei neustart via f8

oly22 · 27.05.2013, 07:41

Hallo,
auch im abgesicherten Modus bleibt Combofix bei den Zielverzeichnissen hängen...

Hallo,
auch im abgesicherten Modus bleibt Combofix an bei den Zielverzeichnissen hängen...

markusg · 27.05.2013, 18:33

Oki,
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

oly22 · 28.05.2013, 07:06

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2013.05.28.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16576
Cecil-Peine :: BUERO1 [Administrator]

28.05.2013 07:05:40
mbam-log-2013-05-28 (07-05-40).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 400013
Laufzeit: 53 Minute(n), 17 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> 2328 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Löschen bei Neustart.
C:\Users\Cecil-Peine\Documents\5a86bf2d.exe (Trojan.Winlock) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Das ist Logdatei, die nach der Beendigung vom Scanvorgang ausgeworfen wurde. Wie von dem Programm gefordert habe ich "Alle Ergebnisse löschen" angeklickt und den Pc neu gestartet...

markusg · 28.05.2013, 09:59

C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Löschen bei Neustart.
die Verwendung von Keygens ist illegal, dies unterstützen wi
http://www.trojaner-board.de/95393-c...-software.html
deswegen gibts nur Hilfe beim neu aufsetzen
1. Datenrettung:

deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
dann sichere Daten auf nen externen datenträger: http://www.trojaner-board.de/82533-d...ted-magic.html
Bilder, Dokumente, Musik Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neu instalieren:

nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
recovery cd oder recovery partition.
falls dies ein fertig pc ist, nenne hersteller + typ.
Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

24.05.2013, 22:54	#4
markusg /// Malware-holic	GVU Trojaner auf Windows 7 PC Nimm quarantäne, packe dann noch mal und lad den Rest hoch __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

GVU Trojaner auf Windows 7 PC

Log-Analyse und Auswertung: GVU Trojaner auf Windows 7 PC