(GVU)PC springt aus beim booten mit Reatogo...

Truemas · 30.05.2013, 14:07

Guten Tag zusammen.

Ich habe mir diesen Polizeitrojaner (niederländische Variante ) eingefangen und mich so weit im Forum schlau gemacht das ich Reatogo gebrannt habe und meinen Laptop damit gebooted habe. Erst kam ein Bluescreen und beim weiterer Forensuche habe ich gesehen das ich meinen Mode von Atralala auf IDE wechseln musste. Jetzt komme ich bis zum Ladebildschirm von Reatogo doch dann "patsch" springt mein PC aus. Auch google hilft mir da gerade nicht weiter.

Markantes Detail: Nur der abgesicherte Modus mit Eingabeaufforderung funktioniert. Bei allen anderen Varianten wird der Computer heruntergefahren nach startup.
Hatte mit Hilfe der Eingabeaufforderung antivir laufen lassen der auch fündig wurde. Jetzt findet es nichts mehr aber das Problem ist immer noch vorhanden.

Ich hoffe da kann mir jemand weiterhelfen. Ich habe Windows 7 Ultimate 32bit. Rechner wird nicht für Onlinebanking benutzt sondern nur für Studentenkram und Aufnahmen mit meinem E-drumkit. Daten sind soweit gesichert aber ich möchte mir ein lästiges Neuregistrieren der Musiksoftwareprogramme ersparen.

MfG
Thomas

markusg · 30.05.2013, 14:09

kannst du via eingabeaufforderung otl laufen lassen:

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die
Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Truemas · 30.05.2013, 16:57

Danke für den Tip, beim 2. mal hat es aber dann doch mit der CD variante geklappt. Hier meine Ergebnisse:

OTL:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 5/30/2013 10:50:30 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 65.70 Mb Free Space | 65.70% Space Free | Partition Type: NTFS
Drive D: | 19.43 Gb Total Space | 0.30 Gb Free Space | 1.55% Space Free | Partition Type: NTFS
Drive E: | 129.52 Gb Total Space | 84.82 Gb Free Space | 65.49% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 6.50 Gb Free Space | 87.21% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto] --  -- (SkypeUpdate)
SRV - File not found [Auto] --  -- (AntiVirService)
SRV - File not found [Auto] --  -- (AntiVirSchedulerService)
SRV - File not found [Auto] --  -- (AAV UpdateService)
SRV - [2013/05/15 17:35:08 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/08/30 12:04:44 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/08/17 20:36:08 | 000,176,128 | ---- | M] (AMD) [Auto] -- D:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (VGPU)
DRV - File not found [Kernel | On_Demand] --  -- (tsusbhub)
DRV - File not found [Kernel | On_Demand] --  -- (Synth3dVsc)
DRV - [2012/09/07 14:26:05 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/09/07 14:26:05 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012/09/07 14:26:05 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012/02/22 06:30:54 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System] -- D:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 06:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/06/17 09:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/09/28 04:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand] -- D:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/08/21 09:06:08 | 000,052,008 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\iLokDrvr.sys -- (iLokDrvr)
DRV - [2009/08/21 09:05:40 | 000,090,472 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | Boot] -- D:\Windows\System32\drivers\TPkd.sys -- (TPkd)
DRV - [2009/08/17 21:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/07/13 18:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009/06/26 08:36:26 | 000,023,696 | ---- | M] (Steinberg Media Technologies GmbH) [Kernel | On_Demand] -- D:\Windows\System32\drivers\synasusb.sys -- (SynasUSB)
DRV - [2007/06/15 04:28:32 | 000,123,664 | ---- | M] (BridgeCo AG) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Phonic_1394.sys -- (Phonic_1394)
DRV - [2007/06/15 04:28:32 | 000,051,472 | ---- | M] (BridgeCo AG) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Phonic_avs.sys -- (Phonic_avs)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Audio_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
IE - HKU\Truemas_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://online.han.nl/sites/8-he-fys-80424/1213%20ziekenhuis%202/3a/productie.aspx
IE - HKU\Truemas_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Truemas_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Truemas_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 A7 85 20 10 BE CB 01  [binary data]
IE - HKU\Truemas_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Truemas_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin:  File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files\AutocompletePro\support@predictad.com [2010/05/04 10:35:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: D:\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: D:\Mozilla Thunderbird\plugins
 
[2013/04/11 08:27:20 | 000,032,440 | ---- | M] () -- D:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - D:\Program Files\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -  File not found
O3 - HKU\Truemas_ON_D\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [avgnt]  File not found
O4 - HKLM..\Run: [QuickTime Task]  File not found
O4 - HKU\Truemas_ON_D..\Run: [DAEMON Tools Lite]  File not found
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Lync-Add-On - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -  File not found
O9 - Extra 'Tools' menuitem : Lync-Add-On - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -  File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Truemas_ON_D Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Truemas_ON_D Winlogon: Shell - (C:\Users\Truemas\AppData\Roaming\skype.dat) - D:\Users\Truemas\AppData\Roaming\skype.dat ()
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/05/16 02:59:09 | 000,420,864 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\vbscript.dll
[2013/05/16 02:59:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll
[2013/05/16 02:59:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieUnatt.exe
[2013/05/16 02:59:08 | 000,065,024 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jsproxy.dll
[2013/05/16 02:59:07 | 000,717,824 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript.dll
[2013/05/16 02:59:07 | 000,607,744 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msfeeds.dll
[2013/05/16 02:59:06 | 001,800,704 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript9.dll
[2013/05/16 02:59:06 | 000,231,936 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\url.dll
[2013/05/16 02:59:05 | 001,427,968 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\inetcpl.cpl
[2013/05/16 02:58:48 | 000,000,000 | ---D | C] -- D:\Program Files\Mozilla Firefox
[2013/05/16 02:55:22 | 002,382,848 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\mshtml.tlb
[2013/05/16 02:00:11 | 002,347,520 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\win32k.sys
[2013/05/16 02:00:07 | 000,218,984 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\drivers\dxgmms1.sys
[2013/05/16 02:00:01 | 001,796,096 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\authui.dll
[2013/05/16 02:00:01 | 000,101,720 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\consent.exe
[2013/05/05 18:11:18 | 003,968,856 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntkrnlpa.exe
[2013/05/05 18:11:18 | 003,913,560 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntoskrnl.exe
[2013/05/05 18:11:17 | 000,038,912 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\csrsrv.dll
[2013/05/05 18:11:11 | 000,131,584 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\aaclient.dll
[2013/05/05 18:11:11 | 000,036,864 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\tsgqec.dll
[2 D:\*.tmp files -> D:\*.tmp -> ]
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/30 08:05:22 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2013/05/30 08:05:16 | 000,014,416 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/30 08:05:15 | 000,014,416 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/30 08:04:56 | 000,001,096 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/30 08:04:40 | 2212,126,720 | -HS- | M] () -- D:\hiberfil.sys
[2013/05/26 14:18:40 | 000,000,000 | ---- | M] () -- D:\Users\Truemas\AppData\Roaming\skype.ini
[2013/05/24 13:35:00 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/24 13:33:27 | 000,001,100 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/24 05:41:50 | 000,654,400 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2013/05/24 05:41:50 | 000,616,242 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2013/05/24 05:41:50 | 000,134,796 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2013/05/24 05:41:50 | 000,106,622 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2013/05/16 14:52:16 | 000,455,872 | ---- | M] () -- D:\Windows\System32\FNTCACHE.DAT
[2013/05/16 02:58:50 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Lync
[2013/05/15 17:35:05 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerApp.exe
[2013/05/15 17:35:05 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/05/15 16:44:18 | 000,002,441 | ---- | M] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/05/05 18:04:52 | 000,002,129 | ---- | M] () -- D:\Users\Public\Desktop\Google Chrome.lnk
[2013/05/05 15:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- D:\Windows\System32\mshtml.tlb
[2 D:\*.tmp files -> D:\*.tmp -> ]
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/05/24 13:26:14 | 000,000,000 | ---- | C] () -- D:\Users\Truemas\AppData\Roaming\skype.ini
[2012/10/02 06:49:59 | 000,000,000 | ---- | C] () -- D:\Users\Truemas\AppData\Roaming\AVSMediaPlayer.m3u
[2012/05/22 14:38:19 | 000,000,064 | ---- | C] () -- D:\Windows\wininit.ini
[2012/01/24 06:57:17 | 000,000,766 | ---- | C] () -- D:\Windows\wiso.ini
[2012/01/11 06:21:46 | 000,155,648 | ---- | C] () -- D:\Users\Truemas\AppData\Roaming\skype.dat
[2011/07/02 13:17:14 | 000,080,896 | ---- | C] () -- D:\Windows\System32\RDVGHelper.exe
[2011/07/02 13:16:25 | 000,252,928 | ---- | C] () -- D:\Windows\System32\DShowRdpFilter.dll
[2011/07/02 13:15:10 | 000,066,048 | ---- | C] () -- D:\Windows\System32\PrintBrmUi.exe
[2011/02/06 16:35:14 | 000,066,936 | -HS- | C] () -- D:\Windows\dlinfo_0.drv
[2011/02/06 16:35:02 | 000,061,440 | ---- | C] () -- D:\Windows\diabunin.exe
[2011/02/06 16:02:29 | 000,086,528 | ---- | C] () -- D:\Windows\bnetunin.exe
[2010/11/12 12:37:59 | 000,000,056 | -H-- | C] () -- D:\ProgramData\ezsidmv.dat
[2010/08/15 12:10:53 | 000,000,045 | ---- | C] () -- D:\Windows\System32\SYNSOPOS.exe.cfg
[2010/04/09 14:38:37 | 000,165,376 | ---- | C] () -- D:\Windows\System32\unrar.dll
[2009/10/31 16:43:37 | 000,209,040 | ---- | C] () -- D:\Windows\System32\IVIresizeW7.dll
[2009/10/31 16:43:37 | 000,204,944 | ---- | C] () -- D:\Windows\System32\IVIresizeA6.dll
[2009/10/31 16:43:37 | 000,196,752 | ---- | C] () -- D:\Windows\System32\IVIresizeP6.dll
[2009/10/31 16:43:37 | 000,196,752 | ---- | C] () -- D:\Windows\System32\IVIresizeM6.dll
[2009/10/31 16:43:37 | 000,192,656 | ---- | C] () -- D:\Windows\System32\IVIresizePX.dll
[2009/10/31 16:43:37 | 000,024,720 | ---- | C] () -- D:\Windows\System32\IVIresize.dll
[2009/10/27 07:31:21 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat
[2009/10/27 07:10:02 | 000,002,892 | ---- | C] () -- D:\Windows\System32\audcon.sys
[2009/10/27 06:59:42 | 000,086,016 | ---- | C] () -- D:\Windows\System32\SYNSOPOS.exe
[2009/10/15 12:05:55 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin
[2009/07/14 04:47:43 | 000,654,400 | ---- | C] () -- D:\Windows\System32\perfh007.dat
[2009/07/14 04:47:43 | 000,295,922 | ---- | C] () -- D:\Windows\System32\perfi007.dat
[2009/07/14 04:47:43 | 000,134,796 | ---- | C] () -- D:\Windows\System32\perfc007.dat
[2009/07/14 04:47:43 | 000,038,104 | ---- | C] () -- D:\Windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,455,872 | ---- | C] () -- D:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,616,242 | ---- | C] () -- D:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- D:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,106,622 | ---- | C] () -- D:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- D:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- D:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- D:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- D:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\System32\BWContextHandler.dll
[2009/06/18 13:29:04 | 000,197,654 | ---- | C] () -- D:\Windows\System32\atiicdxx.dat
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\System32\mlang.dat
[2006/03/09 10:58:00 | 001,060,424 | ---- | C] () -- D:\Windows\System32\WdfCoInstaller01000.dll
 
========== LOP Check ==========
 
[2013/03/25 13:49:17 | 000,000,000 | ---D | M] -- D:\ProgramData\AAV
[2009/10/15 12:11:37 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2012/09/27 03:39:00 | 000,000,000 | ---D | M] -- D:\ProgramData\AVG2012
[2013/03/28 06:05:55 | 000,000,000 | ---D | M] -- D:\ProgramData\Buhl Data Service GmbH
[2011/03/14 15:15:54 | 000,000,000 | -H-D | M] -- D:\ProgramData\Common Files
[2011/02/06 15:59:43 | 000,000,000 | ---D | M] -- D:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2009/10/15 12:11:37 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2010/08/15 12:12:43 | 000,000,000 | ---D | M] -- D:\ProgramData\eLicenser
[2011/08/31 12:06:58 | 000,000,000 | ---D | M] -- D:\ProgramData\elsterformular
[2009/10/15 12:11:37 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2009/10/31 16:43:38 | 000,000,000 | ---D | M] -- D:\ProgramData\InterVideo
[2012/09/26 10:05:04 | 000,000,000 | ---D | M] -- D:\ProgramData\MFAData
[2012/03/10 16:34:29 | 000,000,000 | ---D | M] -- D:\ProgramData\Nitro PDF
[2009/10/27 08:15:47 | 000,000,000 | ---D | M] -- D:\ProgramData\PACE Anti-Piracy
[2009/10/31 16:44:14 | 000,000,000 | ---D | M] -- D:\ProgramData\SmartSound Software Inc
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2009/10/15 12:11:37 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2011/08/16 12:17:15 | 000,000,000 | ---D | M] -- D:\ProgramData\Steinberg
[2009/10/27 07:10:02 | 000,000,000 | ---D | M] -- D:\ProgramData\Syncrosoft
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2009/10/31 16:45:00 | 000,000,000 | ---D | M] -- D:\ProgramData\Ulead Systems
[2009/10/15 12:11:37 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2010/04/15 13:03:17 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/26 10:46:15 | 000,000,000 | ---D | M] -- D:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2013/05/24 17:23:08 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 994 bytes -> D:\ProgramData\Microsoft:5aIc3ryQpfX5F2WOD3ObGMpn8
@Alternate Data Stream - 1093 bytes -> D:\ProgramData\Microsoft:OPfbplbFhTiC7hcM6D
@Alternate Data Stream - 1066 bytes -> D:\Program Files\Common Files\microsoft shared:NzxXT2JD4Uc6h7VHQd6IbDceHMtO
< End of report >

--- --- ---

Extras:OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 5/30/2013 10:50:30 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 65.70 Mb Free Space | 65.70% Space Free | Partition Type: NTFS
Drive D: | 19.43 Gb Total Space | 0.30 Gb Free Space | 1.55% Space Free | Partition Type: NTFS
Drive E: | 129.52 Gb Total Space | 84.82 Gb Free Space | 65.49% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 6.50 Gb Free Space | 87.21% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- D:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- D:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{009AC76E-1A66-4682-82B7-417E77F3C648}" = Superior Drummer Installer
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1D33BCF7-B5B6-4148-B888-9CC2EC208556}" = Konz 2012
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{25613C10-27D2-410B-942B-D922D5C3A7BE}" = Interlok driver setup x32
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{46F24D1B-89F9-4D7E-BB14-3BBF9AC7A1D6}" = Steinberg Cubase Essential 5
"{4785CED6-73B3-45FA-AFE6-EDEDFDE67842}" = Steuer 2011
"{490BF87E-1F75-4453-BF55-9F540543A3CA}" = Steinberg Drum Loop Expansion 01
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4D0EAA2D-8EE2-43AB-BE00-18A1D0A9281C}" = STEUEReasy 2013
"{4D454CF8-12FD-464D-B57B-B46FE27B78BB}" = Steinberg LoopMash Content
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{532B917B-8235-4FA5-BE36-643A8BB053A5}" = Steinberg REVerence Content 01
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5866520C-8857-4986-833A-039F4584C3F7}" = Toontrack solo
"{58A013B1-1613-4978-881A-FCA43710C84A}" = Microsoft Lync 2010
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{865D9ED1-EAC2-436D-AFA7-0B750EB5AAAB}" = Steinberg HALionOne Studio Drum Set
"{87B1660B-E441-4FB5-9C24-FCF21E423504}" = PDFlib TET PDF IFilter 4.1p3 32-bit
"{88C337F0-4CF2-4098-BDC0-D94859ECA2B4}" = Steinberg LoopMash Content 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CBA7E47-48DA-47DC-8E98-6984BA830295}" = Steinberg VST Amp Rack Content 01
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A5051ABF-A497-4C3C-85EA-F7A4D5C19B82}" = Steinberg HALion Sonic SE Content
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABC887FA-1BAC-411B-9F0F-21BA16702F15}" = VideoStudio
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{AC997F93-0757-4ED4-A701-F40C2D654D09}" = Steinberg HALionOne GM Drum Set
"{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}" = AAVUpdateManager
"{BD86F1AC-B594-46E4-85DC-1258AC9E2232}" = Steinberg Groove Agent ONE Content
"{C6200FF8-999D-4C58-9047-08D2E065BDBB}" = Steinberg Cubase 6
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D03482C5-9AD8-496D-B388-692AE04C93AF}" = Bonjour
"{D23CBFDA-C46B-4920-BA70-FC7878A3F05A}" = Steinberg HALionOne Studio Set
"{D82CDA0D-C182-42C8-8FF2-5649C98D6003}" = Steinberg HALionOne Pro Set
"{DBF4BC99-53F1-4C97-84C3-7557D103E182}" = Steinberg Groove Agent ONE Vintage Beatboxes
"{E22AD5D3-EB60-4A8F-835C-6C10E369DCE2}" = Steinberg HALionOne Expression Set
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E70E7159-93B1-470D-9FBD-D8E9EF34B538}" = Steinberg HALionOne
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EF7800A8-575E-4776-95A5-A9D904A85D5F}" = Steinberg HALion Sonic SE
"{F057965A-D974-4C64-ADB1-4381CD4B8956}" = Steinberg HALionOne GM Set
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"AP Tuner 3.08" = AP Tuner 3.08
"Audiograbber" = Audiograbber 1.83 SE 
"AutocompletePro2_is1" = AutocompletePro
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVS Media Player_is1" = AVS Media Player 3.1
"Battle.net" = Battle.net
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo" = Diablo
"DivX Setup.divx.com" = DivX-Setup
"eLicenser Control" = eLicenser Control
"ElsterFormular für Privatanwender 12.3.2.6814p" = ElsterFormular für Privatanwender
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"Free Metronome" = Free Metronome 1.1.0 r1 
"Free Sound Recorder_is1" = Free Sound Recorder 2010 v8.2.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228
"GCH Guitar academy" = GCH Guitar academy
"Google Chrome" = Google Chrome
"InstallShield_{1D33BCF7-B5B6-4148-B888-9CC2EC208556}" = Konz 2012
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{ABC887FA-1BAC-411B-9F0F-21BA16702F15}" = Ulead VideoStudio 11 SE DVD
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Miranda IM" = Miranda IM 0.9.15
"MOTU Symphonic Instrument" = MOTU Symphonic Instrument
"Mozilla Thunderbird (3.1.7)" = Mozilla Thunderbird (3.1.7)
"Phonic Firewire Driver 2.44.0 Setup" = Phonic Firewire Driver 2.44.0
"Recuva" = Recuva
"SecureW2 EAP Suite" = SecureW2 EAP Suite 2.0.4 for Windows
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Warcraft III" = Warcraft III
"Winamp" = Winamp
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\Truemas_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
< End of report >

--- --- ---

markusg · 30.05.2013, 17:11

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

ATTFilter

:OTL
O20 - HKU\Truemas_ON_D Winlogon: Shell - (C:\Users\Truemas\AppData\Roaming\skype.dat) - D:\Users\Truemas\AppData\Roaming\skype.dat ()
[2013/05/26 14:18:40 | 000,000,000 | ---- | M] () -- D:\Users\Truemas\AppData\Roaming\skype.ini
:Files
:Commands
[EMPTYFLASH] 
[emptytemp]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

Truemas · 30.05.2013, 18:33

Nachdem ich mit "run fix" die fix.txt geladen habe reagiert OTLPE nur noch auf "Minimieren", "Vollbild" und "Schließen". Der Text wird unten bei "Custom Scans/Fixes" angezeigt aber es scheint sich weiter nichts zu tun.

Edit: Könnte das an der Versionsnummer liegen? Habe Version 3.1.48.0.

markusg · 30.05.2013, 20:58

Hi und deswegen steht da ja auch, Fix evtl.manuell eintragen

Truemas · 30.05.2013, 21:56

Ja stimmt, mein Fehler. Hier mein Fix Report:

Mein PC started wieder normal hoch. Was gibt es noch zu beachten?

========== OTL ==========
Registry value HKEY_USERS\Truemas_ON_D\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Truemas\AppData\Roaming\skype.dat deleted successfully.
D:\Users\Truemas\AppData\Roaming\skype.dat moved successfully.
D:\Users\Truemas\AppData\Roaming\skype.ini moved successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYFLASH]
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes

Total Files Cleaned = 0.00 mb

OTLPE by OldTimer - Version 3.1.48.0 log created on 05312013_045221

markusg · 30.05.2013, 22:14

Hi,
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Truemas · 31.05.2013, 13:31

Hier was der TDSS Killer sagt:

20:27:15.0077 2800 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
20:27:15.0123 2800 ============================================================
20:27:15.0123 2800 Current date / time: 2013/05/31 20:27:15.0123
20:27:15.0123 2800 SystemInfo:
20:27:15.0123 2800
20:27:15.0123 2800 OS Version: 6.1.7601 ServicePack: 1.0
20:27:15.0123 2800 Product type: Workstation
20:27:15.0123 2800 ComputerName: VASHMOBIL
20:27:15.0123 2800 UserName: Truemas
20:27:15.0123 2800 Windows directory: C:\Windows
20:27:15.0123 2800 System windows directory: C:\Windows
20:27:15.0123 2800 Processor architecture: Intel x86
20:27:15.0123 2800 Number of processors: 2
20:27:15.0123 2800 Page size: 0x1000
20:27:15.0123 2800 Boot type: Normal boot
20:27:15.0123 2800 ============================================================
20:27:17.0573 2800 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:27:17.0588 2800 Drive \Device\Harddisk1\DR1 - Size: 0x1DD93C000 (7.46 Gb), SectorSize: 0x200, Cylinders: 0x3CE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:27:17.0588 2800 ============================================================
20:27:17.0588 2800 \Device\Harddisk0\DR0:
20:27:17.0588 2800 MBR partitions:
20:27:17.0588 2800 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
20:27:17.0588 2800 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x26DE000
20:27:17.0588 2800 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x2710800, BlocksNum 0x10308000
20:27:17.0588 2800 \Device\Harddisk1\DR1:
20:27:17.0588 2800 MBR partitions:
20:27:17.0588 2800 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x8B, StartLBA 0x6F6F42C3, BlocksNum 0x72652074
20:27:17.0588 2800 ============================================================
20:27:17.0619 2800 C: <-> \Device\Harddisk0\DR0\Partition2
20:27:17.0666 2800 D: <-> \Device\Harddisk0\DR0\Partition3
20:27:17.0666 2800 ============================================================
20:27:17.0666 2800 Initialize success
20:27:17.0666 2800 ============================================================
20:27:44.0919 3116 ============================================================
20:27:44.0919 3116 Scan started
20:27:44.0919 3116 Mode: Manual; SigCheck; TDLFS;
20:27:44.0919 3116 ============================================================
20:27:46.0682 3116 ================ Scan system memory ========================
20:27:46.0682 3116 System memory - ok
20:27:46.0682 3116 ================ Scan services =============================
20:27:47.0103 3116 [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
20:27:47.0322 3116 1394ohci - ok
20:27:47.0353 3116 [ BEB5E6A8C17C3C7485563281E0F9E77E ] 61883 C:\Windows\system32\DRIVERS\61883.sys
20:27:47.0447 3116 61883 - ok
20:27:47.0571 3116 [ 7EEB488346FBFA3731276C3EE8A8FD9E ] AAV UpdateService D:\Program Files\AAVUpdateManager\aavus.exe
20:27:47.0618 3116 AAV UpdateService - ok
20:27:47.0681 3116 [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys
20:27:47.0712 3116 ACPI - ok
20:27:47.0774 3116 [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
20:27:47.0883 3116 AcpiPmi - ok
20:27:48.0008 3116 [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
20:27:48.0039 3116 AdobeARMservice - ok
20:27:48.0149 3116 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:27:48.0211 3116 AdobeFlashPlayerUpdateSvc - ok
20:27:48.0273 3116 [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
20:27:48.0336 3116 adp94xx - ok
20:27:48.0367 3116 [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
20:27:48.0429 3116 adpahci - ok
20:27:48.0445 3116 [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
20:27:48.0492 3116 adpu320 - ok
20:27:48.0539 3116 [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:27:48.0617 3116 AeLookupSvc - ok
20:27:48.0679 3116 [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD C:\Windows\system32\drivers\afd.sys
20:27:48.0773 3116 AFD - ok
20:27:48.0851 3116 [ 7E10E3BB9B258AD8A9300F91214D67B9 ] AgereSoftModem C:\Windows\system32\DRIVERS\AGRSM.sys
20:27:48.0991 3116 AgereSoftModem - ok
20:27:49.0038 3116 [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440 C:\Windows\system32\drivers\agp440.sys
20:27:49.0085 3116 agp440 - ok
20:27:49.0116 3116 [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys
20:27:49.0163 3116 aic78xx - ok
20:27:49.0225 3116 [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG C:\Windows\System32\alg.exe
20:27:49.0287 3116 ALG - ok
20:27:49.0334 3116 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide C:\Windows\system32\drivers\aliide.sys
20:27:49.0365 3116 aliide - ok
20:27:49.0412 3116 [ B19505648F033393E907E2E419FDE8B3 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
20:27:49.0490 3116 AMD External Events Utility - ok
20:27:49.0537 3116 [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp C:\Windows\system32\drivers\amdagp.sys
20:27:49.0568 3116 amdagp - ok
20:27:49.0584 3116 [ CD5914170297126B6266860198D1D4F0 ] amdide C:\Windows\system32\drivers\amdide.sys
20:27:49.0631 3116 amdide - ok
20:27:49.0677 3116 [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
20:27:49.0755 3116 AmdK8 - ok
20:27:49.0787 3116 [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
20:27:49.0865 3116 AmdPPM - ok
20:27:49.0927 3116 [ D320BF87125326F996D4904FE24300FC ] amdsata C:\Windows\system32\drivers\amdsata.sys
20:27:49.0974 3116 amdsata - ok
20:27:50.0021 3116 [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
20:27:50.0067 3116 amdsbs - ok
20:27:50.0099 3116 [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata C:\Windows\system32\drivers\amdxata.sys
20:27:50.0130 3116 amdxata - ok
20:27:50.0223 3116 [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService D:\Avira\AntiVir Desktop\sched.exe
20:27:50.0270 3116 AntiVirSchedulerService - ok
20:27:50.0333 3116 [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService D:\Avira\AntiVir Desktop\avguard.exe
20:27:50.0379 3116 AntiVirService - ok
20:27:50.0442 3116 [ AEA177F783E20150ACE5383EE368DA19 ] AppID C:\Windows\system32\drivers\appid.sys
20:27:50.0582 3116 AppID - ok
20:27:50.0629 3116 [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc C:\Windows\System32\appidsvc.dll
20:27:50.0707 3116 AppIDSvc - ok
20:27:50.0738 3116 [ EACFDF31921F51C097629F1F3C9129B4 ] Appinfo C:\Windows\System32\appinfo.dll
20:27:50.0847 3116 Appinfo - ok
20:27:50.0894 3116 [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt C:\Windows\System32\appmgmts.dll
20:27:50.0957 3116 AppMgmt - ok
20:27:51.0003 3116 [ 2932004F49677BD84DBC72EDB754FFB3 ] arc C:\Windows\system32\DRIVERS\arc.sys
20:27:51.0050 3116 arc - ok
20:27:51.0066 3116 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
20:27:51.0113 3116 arcsas - ok
20:27:51.0144 3116 [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:27:51.0284 3116 AsyncMac - ok
20:27:51.0315 3116 [ 338C86357871C167A96AB976519BF59E ] atapi C:\Windows\system32\drivers\atapi.sys
20:27:51.0347 3116 atapi - ok
20:27:51.0549 3116 [ 04F09923A393E4E0E8453A8F78361E73 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
20:27:51.0815 3116 atikmdag - ok
20:27:51.0877 3116 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:27:52.0002 3116 AudioEndpointBuilder - ok
20:27:52.0017 3116 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv C:\Windows\System32\Audiosrv.dll
20:27:52.0064 3116 Audiosrv - ok
20:27:52.0111 3116 [ C44BDD77E06053CF5AFE046F3A47C16B ] Avc C:\Windows\system32\DRIVERS\avc.sys
20:27:52.0173 3116 Avc - ok
20:27:52.0251 3116 [ D5541F0AFB767E85FC412FC609D96A74 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
20:27:52.0314 3116 avgntflt - ok
20:27:52.0376 3116 [ 7D967A682D4694DF7FA57D63A2DB01FE ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
20:27:52.0423 3116 avipbb - ok
20:27:52.0439 3116 [ 53E56450DA16A1A7F0D002F511113F67 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
20:27:52.0485 3116 avkmgr - ok
20:27:52.0517 3116 [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll
20:27:52.0579 3116 AxInstSV - ok
20:27:52.0626 3116 [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys
20:27:52.0719 3116 b06bdrv - ok
20:27:52.0751 3116 [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys
20:27:52.0829 3116 b57nd60x - ok
20:27:52.0953 3116 [ F9CE9B5E049EFC66B8E6C73C18EE8438 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl6.sys
20:27:53.0063 3116 BCM43XX - ok
20:27:53.0125 3116 [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC C:\Windows\System32\bdesvc.dll
20:27:53.0203 3116 BDESVC - ok
20:27:53.0234 3116 [ 505506526A9D467307B3C393DEDAF858 ] Beep C:\Windows\system32\drivers\Beep.sys
20:27:53.0328 3116 Beep - ok
20:27:53.0390 3116 [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE C:\Windows\System32\bfe.dll
20:27:53.0499 3116 BFE - ok
20:27:53.0531 3116 [ E585445D5021971FAE10393F0F1C3961 ] BITS C:\Windows\System32\qmgr.dll
20:27:53.0655 3116 BITS - ok
20:27:53.0687 3116 [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
20:27:53.0733 3116 blbdrive - ok
20:27:53.0827 3116 [ 1C87705CCB2F60172B0FC86B5D82F00D ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:27:53.0889 3116 Bonjour Service - ok
20:27:53.0921 3116 [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:27:53.0999 3116 bowser - ok
20:27:54.0045 3116 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:27:54.0092 3116 BrFiltLo - ok
20:27:54.0108 3116 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:27:54.0201 3116 BrFiltUp - ok
20:27:54.0248 3116 [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser C:\Windows\System32\browser.dll
20:27:54.0311 3116 Browser - ok
20:27:54.0357 3116 [ 845B8CE732E67F3B4133164868C666EA ] Brserid C:\Windows\System32\Drivers\Brserid.sys
20:27:54.0435 3116 Brserid - ok
20:27:54.0467 3116 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
20:27:54.0513 3116 BrSerWdm - ok
20:27:54.0529 3116 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
20:27:54.0591 3116 BrUsbMdm - ok
20:27:54.0607 3116 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
20:27:54.0654 3116 BrUsbSer - ok
20:27:54.0685 3116 [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
20:27:54.0747 3116 BTHMODEM - ok
20:27:54.0794 3116 [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv C:\Windows\system32\bthserv.dll
20:27:54.0888 3116 bthserv - ok
20:27:54.0919 3116 [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:27:55.0013 3116 cdfs - ok
20:27:55.0059 3116 [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
20:27:55.0122 3116 cdrom - ok
20:27:55.0169 3116 [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc C:\Windows\System32\certprop.dll
20:27:55.0262 3116 CertPropSvc - ok
20:27:55.0278 3116 [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
20:27:55.0309 3116 circlass - ok
20:27:55.0340 3116 [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS C:\Windows\system32\CLFS.sys
20:27:55.0387 3116 CLFS - ok
20:27:55.0465 3116 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:27:55.0512 3116 clr_optimization_v2.0.50727_32 - ok
20:27:55.0605 3116 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:27:55.0621 3116 clr_optimization_v4.0.30319_32 - ok
20:27:55.0668 3116 [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
20:27:55.0699 3116 CmBatt - ok
20:27:55.0746 3116 [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide C:\Windows\system32\drivers\cmdide.sys
20:27:55.0793 3116 cmdide - ok
20:27:55.0839 3116 [ 247B4CE2DAB1160CD422D532D5241E1F ] CNG C:\Windows\system32\Drivers\cng.sys
20:27:55.0933 3116 CNG - ok
20:27:55.0964 3116 [ A6023D3823C37043986713F118A89BEE ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
20:27:56.0011 3116 Compbatt - ok
20:27:56.0058 3116 [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
20:27:56.0105 3116 CompositeBus - ok
20:27:56.0136 3116 COMSysApp - ok
20:27:56.0167 3116 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
20:27:56.0214 3116 crcdisk - ok
20:27:56.0261 3116 [ 96C0E38905CFD788313BE8E11DAE3F2F ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:27:56.0339 3116 CryptSvc - ok
20:27:56.0370 3116 [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC C:\Windows\system32\drivers\csc.sys
20:27:56.0463 3116 CSC - ok
20:27:56.0510 3116 [ 15F93B37F6801943360D9EB42485D5D3 ] CscService C:\Windows\System32\cscsvc.dll
20:27:56.0557 3116 CscService - ok
20:27:56.0604 3116 [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch C:\Windows\system32\rpcss.dll
20:27:56.0651 3116 DcomLaunch - ok
20:27:56.0682 3116 [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc C:\Windows\System32\defragsvc.dll
20:27:56.0791 3116 defragsvc - ok
20:27:56.0838 3116 [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:27:56.0916 3116 DfsC - ok
20:27:56.0963 3116 [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp C:\Windows\system32\dhcpcore.dll
20:27:57.0056 3116 Dhcp - ok
20:27:57.0103 3116 [ 1A050B0274BFB3890703D490F330C0DA ] discache C:\Windows\system32\drivers\discache.sys
20:27:57.0181 3116 discache - ok
20:27:57.0228 3116 [ 565003F326F99802E68CA78F2A68E9FF ] Disk C:\Windows\system32\DRIVERS\disk.sys
20:27:57.0275 3116 Disk - ok
20:27:57.0321 3116 [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:27:57.0384 3116 Dnscache - ok
20:27:57.0431 3116 [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc C:\Windows\System32\dot3svc.dll
20:27:57.0524 3116 dot3svc - ok
20:27:57.0571 3116 [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS C:\Windows\system32\dps.dll
20:27:57.0665 3116 DPS - ok
20:27:57.0696 3116 [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:27:57.0758 3116 drmkaud - ok
20:27:57.0821 3116 [ 687AF6BB383885FF6A64071B189A7F3E ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys
20:27:57.0867 3116 dtsoftbus01 - ok
20:27:57.0945 3116 [ 16498EBC04AE9DD07049A8884B205C05 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:27:58.0023 3116 DXGKrnl - ok
20:27:58.0070 3116 [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost C:\Windows\System32\eapsvc.dll
20:27:58.0164 3116 EapHost - ok
20:27:58.0320 3116 [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv C:\Windows\system32\DRIVERS\evbdx.sys
20:27:58.0538 3116 ebdrv - ok
20:27:58.0569 3116 [ 81951F51E318AECC2D68559E47485CC4 ] EFS C:\Windows\System32\lsass.exe
20:27:58.0616 3116 EFS - ok
20:27:58.0710 3116 [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:27:58.0803 3116 ehRecvr - ok
20:27:58.0835 3116 [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched C:\Windows\ehome\ehsched.exe
20:27:58.0866 3116 ehSched - ok
20:27:58.0913 3116 [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
20:27:58.0991 3116 elxstor - ok
20:27:59.0037 3116 [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev C:\Windows\system32\drivers\errdev.sys
20:27:59.0084 3116 ErrDev - ok
20:27:59.0147 3116 [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem C:\Windows\system32\es.dll
20:27:59.0256 3116 EventSystem - ok
20:27:59.0303 3116 [ 2DC9108D74081149CC8B651D3A26207F ] exfat C:\Windows\system32\drivers\exfat.sys
20:27:59.0381 3116 exfat - ok
20:27:59.0412 3116 [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:27:59.0490 3116 fastfat - ok
20:27:59.0552 3116 [ 967EA5B213E9984CBE270205DF37755B ] Fax C:\Windows\system32\fxssvc.exe
20:27:59.0615 3116 Fax - ok
20:27:59.0646 3116 [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc C:\Windows\system32\DRIVERS\fdc.sys
20:27:59.0693 3116 fdc - ok
20:27:59.0724 3116 [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost C:\Windows\system32\fdPHost.dll
20:27:59.0817 3116 fdPHost - ok
20:27:59.0833 3116 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub C:\Windows\system32\fdrespub.dll
20:27:59.0927 3116 FDResPub - ok
20:27:59.0958 3116 [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:27:59.0989 3116 FileInfo - ok
20:28:00.0005 3116 [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:28:00.0067 3116 Filetrace - ok
20:28:00.0114 3116 [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
20:28:00.0161 3116 flpydisk - ok
20:28:00.0207 3116 [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:28:00.0254 3116 FltMgr - ok
20:28:00.0317 3116 [ B3A5EC6B6B6673DB7E87C2BCDBDDC074 ] FontCache C:\Windows\system32\FntCache.dll
20:28:00.0410 3116 FontCache - ok
20:28:00.0488 3116 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:28:00.0519 3116 FontCache3.0.0.0 - ok
20:28:00.0566 3116 [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
20:28:00.0613 3116 FsDepends - ok
20:28:00.0644 3116 [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:28:00.0691 3116 Fs_Rec - ok
20:28:00.0738 3116 [ 8A73E79089B282100B9393B644CB853B ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
20:28:00.0800 3116 fvevol - ok
20:28:00.0831 3116 [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
20:28:00.0863 3116 gagp30kx - ok
20:28:00.0909 3116 [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc C:\Windows\System32\gpsvc.dll
20:28:01.0034 3116 gpsvc - ok
20:28:01.0112 3116 [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
20:28:01.0143 3116 gupdate - ok
20:28:01.0159 3116 [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
20:28:01.0175 3116 gupdatem - ok
20:28:01.0221 3116 [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
20:28:01.0268 3116 hcw85cir - ok
20:28:01.0331 3116 [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:28:01.0424 3116 HdAudAddService - ok
20:28:01.0455 3116 [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
20:28:01.0502 3116 HDAudBus - ok
20:28:01.0549 3116 [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
20:28:01.0596 3116 HidBatt - ok
20:28:01.0611 3116 [ 89448F40E6DF260C206A193A4683BA78 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
20:28:01.0689 3116 HidBth - ok
20:28:01.0705 3116 [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
20:28:01.0767 3116 HidIr - ok
20:28:01.0814 3116 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv C:\Windows\system32\hidserv.dll
20:28:01.0908 3116 hidserv - ok
20:28:01.0955 3116 [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
20:28:01.0986 3116 HidUsb - ok
20:28:02.0033 3116 [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:28:02.0126 3116 hkmsvc - ok
20:28:02.0157 3116 [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:28:02.0235 3116 HomeGroupListener - ok
20:28:02.0267 3116 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:28:02.0345 3116 HomeGroupProvider - ok
20:28:02.0391 3116 [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
20:28:02.0438 3116 HpSAMD - ok
20:28:02.0485 3116 [ 871917B07A141BFF43D76D8844D48106 ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:28:02.0579 3116 HTTP - ok
20:28:02.0625 3116 [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
20:28:02.0657 3116 hwpolicy - ok
20:28:02.0688 3116 [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
20:28:02.0750 3116 i8042prt - ok
20:28:02.0797 3116 [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
20:28:02.0859 3116 iaStorV - ok
20:28:02.0922 3116 [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:28:03.0031 3116 idsvc - ok
20:28:03.0078 3116 [ 4173FF5708F3236CF25195FECD742915 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
20:28:03.0125 3116 iirsp - ok
20:28:03.0187 3116 [ F95622F161474511B8D80D6B093AA610 ] IKEEXT C:\Windows\System32\ikeext.dll
20:28:03.0312 3116 IKEEXT - ok
20:28:03.0359 3116 [ 1C388D022762CACEAC63D9B28CAF06A0 ] iLokDrvr C:\Windows\system32\DRIVERS\iLokDrvr.sys
20:28:03.0405 3116 iLokDrvr ( UnsignedFile.Multi.Generic ) - warning
20:28:03.0405 3116 iLokDrvr - detected UnsignedFile.Multi.Generic (1)
20:28:03.0437 3116 [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide C:\Windows\system32\drivers\intelide.sys
20:28:03.0483 3116 intelide - ok
20:28:03.0530 3116 [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:28:03.0577 3116 intelppm - ok
20:28:03.0608 3116 [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:28:03.0702 3116 IPBusEnum - ok
20:28:03.0733 3116 [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:28:03.0795 3116 IpFilterDriver - ok
20:28:03.0842 3116 [ 4D65A07B795D6674312F879D09AA7663 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:28:03.0936 3116 iphlpsvc - ok
20:28:03.0967 3116 [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
20:28:04.0029 3116 IPMIDRV - ok
20:28:04.0061 3116 [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT C:\Windows\system32\drivers\ipnat.sys
20:28:04.0170 3116 IPNAT - ok
20:28:04.0201 3116 [ 42996CFF20A3084A56017B7902307E9F ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:28:04.0263 3116 IRENUM - ok
20:28:04.0295 3116 [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp C:\Windows\system32\drivers\isapnp.sys
20:28:04.0341 3116 isapnp - ok
20:28:04.0373 3116 [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
20:28:04.0435 3116 iScsiPrt - ok
20:28:04.0466 3116 [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass C:\Windows\system32\drivers\kbdclass.sys
20:28:04.0513 3116 kbdclass - ok
20:28:04.0544 3116 [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
20:28:04.0591 3116 kbdhid - ok
20:28:04.0622 3116 [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso C:\Windows\system32\lsass.exe
20:28:04.0653 3116 KeyIso - ok
20:28:04.0685 3116 [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:28:04.0731 3116 KSecDD - ok
20:28:04.0763 3116 [ D30159AC9237519FBC62C6EC247D2D46 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
20:28:04.0809 3116 KSecPkg - ok
20:28:04.0872 3116 [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm C:\Windows\system32\msdtckrm.dll
20:28:04.0965 3116 KtmRm - ok
20:28:04.0997 3116 [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer C:\Windows\system32\srvsvc.dll
20:28:05.0090 3116 LanmanServer - ok
20:28:05.0137 3116 [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:28:05.0231 3116 LanmanWorkstation - ok
20:28:05.0277 3116 [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:28:05.0355 3116 lltdio - ok
20:28:05.0402 3116 [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:28:05.0496 3116 lltdsvc - ok
20:28:05.0527 3116 [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts C:\Windows\System32\lmhsvc.dll
20:28:05.0605 3116 lmhosts - ok
20:28:05.0652 3116 [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
20:28:05.0699 3116 LSI_FC - ok
20:28:05.0730 3116 [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
20:28:05.0777 3116 LSI_SAS - ok
20:28:05.0792 3116 [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:28:05.0839 3116 LSI_SAS2 - ok
20:28:05.0870 3116 [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:28:05.0917 3116 LSI_SCSI - ok
20:28:05.0933 3116 [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv C:\Windows\system32\drivers\luafv.sys
20:28:06.0011 3116 luafv - ok
20:28:06.0057 3116 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:28:06.0104 3116 Mcx2Svc - ok
20:28:06.0120 3116 [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
20:28:06.0167 3116 megasas - ok
20:28:06.0198 3116 [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
20:28:06.0245 3116 MegaSR - ok
20:28:06.0291 3116 [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS C:\Windows\system32\mmcss.dll
20:28:06.0369 3116 MMCSS - ok
20:28:06.0385 3116 [ F001861E5700EE84E2D4E52C712F4964 ] Modem C:\Windows\system32\drivers\modem.sys
20:28:06.0463 3116 Modem - ok
20:28:06.0510 3116 [ 79D10964DE86B292320E9DFE02282A23 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:28:06.0557 3116 monitor - ok
20:28:06.0588 3116 [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
20:28:06.0635 3116 mouclass - ok
20:28:06.0666 3116 [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:28:06.0728 3116 mouhid - ok
20:28:06.0775 3116 [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
20:28:06.0822 3116 mountmgr - ok
20:28:06.0853 3116 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio C:\Windows\system32\drivers\mpio.sys
20:28:06.0900 3116 mpio - ok
20:28:06.0947 3116 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:28:07.0025 3116 mpsdrv - ok
20:28:07.0087 3116 [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc C:\Windows\system32\mpssvc.dll
20:28:07.0212 3116 MpsSvc - ok
20:28:07.0259 3116 [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:28:07.0290 3116 MRxDAV - ok
20:28:07.0352 3116 [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:28:07.0430 3116 mrxsmb - ok
20:28:07.0477 3116 [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:28:07.0539 3116 mrxsmb10 - ok
20:28:07.0571 3116 [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:28:07.0617 3116 mrxsmb20 - ok
20:28:07.0664 3116 [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci C:\Windows\system32\drivers\msahci.sys
20:28:07.0711 3116 msahci - ok
20:28:07.0758 3116 [ 55055F8AD8BE27A64C831322A780A228 ] msdsm C:\Windows\system32\drivers\msdsm.sys
20:28:07.0805 3116 msdsm - ok
20:28:07.0820 3116 [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC C:\Windows\System32\msdtc.exe
20:28:07.0883 3116 MSDTC - ok
20:28:07.0929 3116 [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:28:08.0007 3116 Msfs - ok
20:28:08.0023 3116 [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
20:28:08.0085 3116 mshidkmdf - ok
20:28:08.0117 3116 [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
20:28:08.0132 3116 msisadrv - ok
20:28:08.0179 3116 [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:28:08.0257 3116 MSiSCSI - ok
20:28:08.0273 3116 msiserver - ok
20:28:08.0319 3116 [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:28:08.0382 3116 MSKSSRV - ok
20:28:08.0397 3116 [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:28:08.0475 3116 MSPCLOCK - ok
20:28:08.0491 3116 [ F456E973590D663B1073E9C463B40932 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:28:08.0569 3116 MSPQM - ok
20:28:08.0600 3116 [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:28:08.0631 3116 MsRPC - ok
20:28:08.0663 3116 [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
20:28:08.0694 3116 mssmbios - ok
20:28:08.0725 3116 [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:28:08.0803 3116 MSTEE - ok
20:28:08.0819 3116 [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
20:28:08.0865 3116 MTConfig - ok
20:28:08.0881 3116 [ 159FAD02F64E6381758C990F753BCC80 ] Mup C:\Windows\system32\Drivers\mup.sys
20:28:08.0928 3116 Mup - ok
20:28:08.0975 3116 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent C:\Windows\system32\qagentRT.dll
20:28:09.0037 3116 napagent - ok
20:28:09.0068 3116 [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:28:09.0131 3116 NativeWifiP - ok
20:28:09.0162 3116 [ E7C54812A2AAF43316EB6930C1FFA108 ] NDIS C:\Windows\system32\drivers\ndis.sys
20:28:09.0193 3116 NDIS - ok
20:28:09.0240 3116 [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
20:28:09.0318 3116 NdisCap - ok
20:28:09.0333 3116 [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:28:09.0411 3116 NdisTapi - ok
20:28:09.0443 3116 [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:28:09.0521 3116 Ndisuio - ok
20:28:09.0552 3116 [ 38FBE267E7E6983311179230FACB1017 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:28:09.0645 3116 NdisWan - ok
20:28:09.0677 3116 [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:28:09.0755 3116 NDProxy - ok
20:28:09.0786 3116 [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:28:09.0879 3116 NetBIOS - ok
20:28:09.0911 3116 [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
20:28:09.0989 3116 NetBT - ok
20:28:10.0004 3116 [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon C:\Windows\system32\lsass.exe
20:28:10.0035 3116 Netlogon - ok
20:28:10.0098 3116 [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman C:\Windows\System32\netman.dll
20:28:10.0160 3116 Netman - ok
20:28:10.0191 3116 [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm C:\Windows\System32\netprofm.dll
20:28:10.0254 3116 netprofm - ok
20:28:10.0285 3116 [ F476EC40033CDB91EFBE73EB99B8362D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:28:10.0347 3116 NetTcpPortSharing - ok
20:28:10.0394 3116 [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
20:28:10.0441 3116 nfrd960 - ok
20:28:10.0472 3116 [ 912084381D30D8B89EC4E293053F4710 ] NlaSvc C:\Windows\System32\nlasvc.dll
20:28:10.0566 3116 NlaSvc - ok
20:28:10.0581 3116 [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:28:10.0628 3116 Npfs - ok
20:28:10.0659 3116 [ BA387E955E890C8A88306D9B8D06BF17 ] nsi C:\Windows\system32\nsisvc.dll
20:28:10.0706 3116 nsi - ok
20:28:10.0722 3116 [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:28:10.0800 3116 nsiproxy - ok
20:28:10.0893 3116 [ 5E43D2B0EE64123D4880DFA6626DEFDE ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:28:10.0987 3116 Ntfs - ok
20:28:11.0018 3116 [ F9756A98D69098DCA8945D62858A812C ] Null C:\Windows\system32\drivers\Null.sys
20:28:11.0096 3116 Null - ok
20:28:11.0143 3116 [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:28:11.0190 3116 nvraid - ok
20:28:11.0221 3116 [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:28:11.0268 3116 nvstor - ok
20:28:11.0315 3116 [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
20:28:11.0361 3116 nv_agp - ok
20:28:11.0393 3116 [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
20:28:11.0439 3116 ohci1394 - ok
20:28:11.0486 3116 [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
20:28:11.0549 3116 p2pimsvc - ok
20:28:11.0580 3116 [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc C:\Windows\system32\p2psvc.dll
20:28:11.0658 3116 p2psvc - ok
20:28:11.0689 3116 [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport C:\Windows\system32\DRIVERS\parport.sys
20:28:11.0736 3116 Parport - ok
20:28:11.0783 3116 [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:28:11.0829 3116 partmgr - ok
20:28:11.0845 3116 [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys
20:28:11.0892 3116 Parvdm - ok
20:28:11.0907 3116 [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc C:\Windows\System32\pcasvc.dll
20:28:11.0985 3116 PcaSvc - ok
20:28:12.0001 3116 [ 673E55C3498EB970088E812EA820AA8F ] pci C:\Windows\system32\drivers\pci.sys
20:28:12.0032 3116 pci - ok
20:28:12.0063 3116 [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide C:\Windows\system32\drivers\pciide.sys
20:28:12.0095 3116 pciide - ok
20:28:12.0141 3116 [ F396431B31693E71E8A80687EF523506 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
20:28:12.0204 3116 pcmcia - ok
20:28:12.0219 3116 [ 250F6B43D2B613172035C6747AEEB19F ] pcw C:\Windows\system32\drivers\pcw.sys
20:28:12.0266 3116 pcw - ok
20:28:12.0313 3116 [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:28:12.0422 3116 PEAUTH - ok
20:28:12.0485 3116 [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
20:28:12.0563 3116 PeerDistSvc - ok
20:28:12.0609 3116 [ 004D29838DE00E3F8883996B61778A9F ] Phonic_1394 C:\Windows\system32\Drivers\Phonic_1394.sys
20:28:12.0641 3116 Phonic_1394 - ok
20:28:12.0672 3116 [ 77567E563C4282C7BE478B752FB49932 ] Phonic_avs C:\Windows\system32\Drivers\Phonic_avs.sys
20:28:12.0703 3116 Phonic_avs - ok
20:28:12.0781 3116 [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla C:\Windows\system32\pla.dll
20:28:12.0953 3116 pla - ok
20:28:13.0015 3116 [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:28:13.0093 3116 PlugPlay - ok
20:28:13.0124 3116 [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
20:28:13.0187 3116 PNRPAutoReg - ok
20:28:13.0218 3116 [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
20:28:13.0249 3116 PNRPsvc - ok
20:28:13.0311 3116 [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:28:13.0421 3116 PolicyAgent - ok
20:28:13.0467 3116 [ F87D30E72E03D579A5199CCB3831D6EA ] Power C:\Windows\system32\umpo.dll
20:28:13.0530 3116 Power - ok
20:28:13.0577 3116 [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:28:13.0670 3116 PptpMiniport - ok
20:28:13.0686 3116 [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor C:\Windows\system32\DRIVERS\processr.sys
20:28:13.0748 3116 Processor - ok
20:28:13.0811 3116 [ 43CA4CCC22D52FB58E8988F0198851D0 ] ProfSvc C:\Windows\system32\profsvc.dll
20:28:13.0889 3116 ProfSvc - ok
20:28:13.0904 3116 [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:28:13.0935 3116 ProtectedStorage - ok
20:28:13.0951 3116 [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched C:\Windows\system32\DRIVERS\pacer.sys
20:28:14.0029 3116 Psched - ok
20:28:14.0107 3116 [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
20:28:14.0216 3116 ql2300 - ok
20:28:14.0232 3116 [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
20:28:14.0263 3116 ql40xx - ok
20:28:14.0294 3116 [ 31AC809E7707EB580B2BDB760390765A ] QWAVE C:\Windows\system32\qwave.dll
20:28:14.0357 3116 QWAVE - ok
20:28:14.0388 3116 [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:28:14.0435 3116 QWAVEdrv - ok
20:28:14.0466 3116 [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:28:14.0544 3116 RasAcd - ok
20:28:14.0591 3116 [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
20:28:14.0669 3116 RasAgileVpn - ok
20:28:14.0700 3116 [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto C:\Windows\System32\rasauto.dll
20:28:14.0762 3116 RasAuto - ok
20:28:14.0762 3116 [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:28:14.0840 3116 Rasl2tp - ok
20:28:14.0871 3116 [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan C:\Windows\System32\rasmans.dll
20:28:14.0934 3116 RasMan - ok
20:28:14.0965 3116 [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:28:15.0043 3116 RasPppoe - ok
20:28:15.0074 3116 [ 44101F495A83EA6401D886E7FD70096B ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:28:15.0152 3116 RasSstp - ok
20:28:15.0199 3116 [ D528BC58A489409BA40334EBF96A311B ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:28:15.0308 3116 rdbss - ok
20:28:15.0324 3116 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
20:28:15.0339 3116 rdpbus - ok
20:28:15.0386 3116 [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:28:15.0464 3116 RDPCDD - ok
20:28:15.0495 3116 [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
20:28:15.0573 3116 RDPDR - ok
20:28:15.0605 3116 [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:28:15.0683 3116 RDPENCDD - ok
20:28:15.0698 3116 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
20:28:15.0745 3116 RDPREFMP - ok
20:28:15.0807 3116 [ 68A0387F58E226DEEE23D9715955572A ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
20:28:15.0885 3116 RdpVideoMiniport - ok
20:28:15.0917 3116 [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:28:15.0979 3116 RDPWD - ok
20:28:16.0026 3116 [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
20:28:16.0088 3116 rdyboost - ok
20:28:16.0135 3116 [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess C:\Windows\System32\mprdim.dll
20:28:16.0213 3116 RemoteAccess - ok
20:28:16.0260 3116 [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:28:16.0369 3116 RemoteRegistry - ok
20:28:16.0385 3116 [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
20:28:16.0478 3116 RpcEptMapper - ok
20:28:16.0509 3116 [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator C:\Windows\system32\locator.exe
20:28:16.0572 3116 RpcLocator - ok
20:28:16.0587 3116 [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs C:\Windows\system32\rpcss.dll
20:28:16.0665 3116 RpcSs - ok
20:28:16.0697 3116 [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:28:16.0759 3116 rspndr - ok
20:28:16.0790 3116 [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
20:28:16.0837 3116 s3cap - ok
20:28:16.0868 3116 [ 81951F51E318AECC2D68559E47485CC4 ] SamSs C:\Windows\system32\lsass.exe
20:28:16.0899 3116 SamSs - ok
20:28:16.0931 3116 [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
20:28:16.0977 3116 sbp2port - ok
20:28:17.0009 3116 [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:28:17.0071 3116 SCardSvr - ok
20:28:17.0102 3116 [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
20:28:17.0180 3116 scfilter - ok
20:28:17.0243 3116 [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule C:\Windows\system32\schedsvc.dll
20:28:17.0367 3116 Schedule - ok
20:28:17.0399 3116 [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc C:\Windows\System32\certprop.dll
20:28:17.0430 3116 SCPolicySvc - ok
20:28:17.0477 3116 [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:28:17.0539 3116 SDRSVC - ok
20:28:17.0570 3116 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:28:17.0648 3116 secdrv - ok
20:28:17.0679 3116 [ A59B3A4442C52060CC7A85293AA3546F ] seclogon C:\Windows\system32\seclogon.dll
20:28:17.0773 3116 seclogon - ok
20:28:17.0804 3116 [ DCB7FCDCC97F87360F75D77425B81737 ] SENS C:\Windows\System32\sens.dll
20:28:17.0867 3116 SENS - ok
20:28:17.0882 3116 [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc C:\Windows\system32\sensrsvc.dll
20:28:17.0945 3116 SensrSvc - ok
20:28:17.0960 3116 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
20:28:17.0976 3116 Serenum - ok
20:28:18.0023 3116 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial C:\Windows\system32\DRIVERS\serial.sys
20:28:18.0085 3116 Serial - ok
20:28:18.0132 3116 [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
20:28:18.0179 3116 sermouse - ok
20:28:18.0241 3116 [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv C:\Windows\system32\sessenv.dll
20:28:18.0350 3116 SessionEnv - ok
20:28:18.0381 3116 [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
20:28:18.0428 3116 sffdisk - ok
20:28:18.0459 3116 [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
20:28:18.0522 3116 sffp_mmc - ok
20:28:18.0553 3116 [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
20:28:18.0600 3116 sffp_sd - ok
20:28:18.0615 3116 [ DB96666CC8312EBC45032F30B007A547 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
20:28:18.0662 3116 sfloppy - ok
20:28:18.0693 3116 [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:28:18.0787 3116 SharedAccess - ok
20:28:18.0818 3116 [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:28:18.0881 3116 ShellHWDetection - ok
20:28:18.0927 3116 [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp C:\Windows\system32\drivers\sisagp.sys
20:28:18.0959 3116 sisagp - ok
20:28:18.0974 3116 [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:28:19.0005 3116 SiSRaid2 - ok
20:28:19.0037 3116 [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
20:28:19.0083 3116 SiSRaid4 - ok
20:28:19.0146 3116 [ 011E958267FEB6ED72F1BFA80072943C ] SkypeUpdate D:\Program Files\Skype\Updater\Updater.exe
20:28:19.0239 3116 SkypeUpdate - ok
20:28:19.0286 3116 [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:28:19.0364 3116 Smb - ok
20:28:19.0411 3116 [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:28:19.0442 3116 SNMPTRAP - ok
20:28:19.0473 3116 [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr C:\Windows\system32\drivers\spldr.sys
20:28:19.0505 3116 spldr - ok
20:28:19.0567 3116 [ 866A43013535DC8587C258E43579C764 ] Spooler C:\Windows\System32\spoolsv.exe
20:28:19.0676 3116 Spooler - ok
20:28:19.0817 3116 [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc C:\Windows\system32\sppsvc.exe
20:28:20.0004 3116 sppsvc - ok
20:28:20.0051 3116 [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify C:\Windows\system32\sppuinotify.dll
20:28:20.0113 3116 sppuinotify - ok
20:28:20.0175 3116 [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv C:\Windows\system32\DRIVERS\srv.sys
20:28:20.0269 3116 srv - ok
20:28:20.0300 3116 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:28:20.0378 3116 srv2 - ok
20:28:20.0394 3116 [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:28:20.0456 3116 srvnet - ok
20:28:20.0487 3116 [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:28:20.0581 3116 SSDPSRV - ok
20:28:20.0628 3116 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\Windows\system32\DRIVERS\ssmdrv.sys
20:28:20.0659 3116 ssmdrv - ok
20:28:20.0690 3116 [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:28:20.0784 3116 SstpSvc - ok
20:28:20.0815 3116 [ DB32D325C192B801DF274BFD12A7E72B ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
20:28:20.0862 3116 stexstor - ok
20:28:20.0924 3116 [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc C:\Windows\System32\wiaservc.dll
20:28:21.0018 3116 StiSvc - ok
20:28:21.0033 3116 [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
20:28:21.0080 3116 storflt - ok
20:28:21.0111 3116 [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc C:\Windows\system32\drivers\storvsc.sys
20:28:21.0158 3116 storvsc - ok
20:28:21.0174 3116 [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum C:\Windows\system32\drivers\swenum.sys
20:28:21.0205 3116 swenum - ok
20:28:21.0236 3116 [ A28BD92DF340E57B024BA433165D34D7 ] swprv C:\Windows\System32\swprv.dll
20:28:21.0299 3116 swprv - ok
20:28:21.0361 3116 [ AF9A16163545685856FFD8B17AAA5E0B ] SynasUSB C:\Windows\system32\drivers\SynasUSB.sys
20:28:21.0408 3116 SynasUSB - ok
20:28:21.0439 3116 Synth3dVsc - ok
20:28:21.0486 3116 [ F5D926807BD9BC0AF68F9376144DE425 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
20:28:21.0548 3116 SynTP - ok
20:28:21.0611 3116 [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain C:\Windows\system32\sysmain.dll
20:28:21.0689 3116 SysMain - ok
20:28:21.0720 3116 [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:28:21.0798 3116 TabletInputService - ok
20:28:21.0845 3116 [ 613BF4820361543956909043A265C6AC ] TapiSrv C:\Windows\System32\tapisrv.dll
20:28:21.0923 3116 TapiSrv - ok
20:28:21.0954 3116 [ B799D9FDB26111737F58288D8DC172D9 ] TBS C:\Windows\System32\tbssvc.dll
20:28:21.0985 3116 TBS - ok
20:28:22.0063 3116 [ 7C0507D2391AF5933600CBCED799F277 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:28:22.0157 3116 Tcpip - ok
20:28:22.0203 3116 [ 7C0507D2391AF5933600CBCED799F277 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
20:28:22.0235 3116 TCPIP6 - ok
20:28:22.0297 3116 [ CCA24162E055C3714CE5A88B100C64ED ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:28:22.0375 3116 tcpipreg - ok
20:28:22.0406 3116 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:28:22.0453 3116 TDPIPE - ok
20:28:22.0500 3116 [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:28:22.0547 3116 TDTCP - ok
20:28:22.0593 3116 [ B459575348C20E8121D6039DA063C704 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:28:22.0671 3116 tdx - ok
20:28:22.0703 3116 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD C:\Windows\system32\drivers\termdd.sys
20:28:22.0749 3116 TermDD - ok
20:28:22.0812 3116 [ 382C804C92811BE57829D8E550A900E2 ] TermService C:\Windows\System32\termsrv.dll
20:28:22.0937 3116 TermService - ok
20:28:22.0968 3116 [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes C:\Windows\system32\themeservice.dll
20:28:23.0015 3116 Themes - ok
20:28:23.0046 3116 [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER C:\Windows\system32\mmcss.dll
20:28:23.0077 3116 THREADORDER - ok
20:28:23.0124 3116 [ 35255EDEDD214AAA0820F10B2AF0F808 ] TPkd C:\Windows\system32\drivers\TPkd.sys
20:28:23.0202 3116 TPkd ( UnsignedFile.Multi.Generic ) - warning
20:28:23.0202 3116 TPkd - detected UnsignedFile.Multi.Generic (1)
20:28:23.0233 3116 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks C:\Windows\System32\trkwks.dll
20:28:23.0327 3116 TrkWks - ok
20:28:23.0405 3116 [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:28:23.0498 3116 TrustedInstaller - ok
20:28:23.0514 3116 [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:28:23.0576 3116 tssecsrv - ok
20:28:23.0623 3116 [ FD1D6C73E6333BE727CBCC6054247654 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
20:28:23.0685 3116 TsUsbFlt - ok
20:28:23.0701 3116 tsusbhub - ok
20:28:23.0763 3116 [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:28:23.0841 3116 tunnel - ok
20:28:23.0873 3116 [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
20:28:23.0919 3116 uagp35 - ok
20:28:23.0951 3116 [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:28:24.0044 3116 udfs - ok
20:28:24.0075 3116 [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:28:24.0153 3116 UI0Detect - ok
20:28:24.0185 3116 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
20:28:24.0231 3116 uliagpkx - ok
20:28:24.0294 3116 [ D295BED4B898F0FD999FCFA9B32B071B ] umbus C:\Windows\system32\drivers\umbus.sys
20:28:24.0325 3116 umbus - ok
20:28:24.0372 3116 [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
20:28:24.0419 3116 UmPass - ok
20:28:24.0465 3116 [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService C:\Windows\System32\umrdp.dll
20:28:24.0543 3116 UmRdpService - ok
20:28:24.0575 3116 [ 833FBB672460EFCE8011D262175FAD33 ] upnphost C:\Windows\System32\upnphost.dll
20:28:24.0668 3116 upnphost - ok
20:28:24.0731 3116 [ 4B8A9C16B6D9258ED99C512AECB8C555 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
20:28:24.0746 3116 USBAAPL ( UnsignedFile.Multi.Generic ) - warning
20:28:24.0746 3116 USBAAPL - detected UnsignedFile.Multi.Generic (1)
20:28:24.0793 3116 [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:28:24.0840 3116 usbccgp - ok
20:28:24.0887 3116 [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir C:\Windows\system32\drivers\usbcir.sys
20:28:24.0965 3116 usbcir - ok
20:28:24.0996 3116 [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
20:28:25.0043 3116 usbehci - ok
20:28:25.0074 3116 [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:28:25.0152 3116 usbhub - ok
20:28:25.0167 3116 [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
20:28:25.0214 3116 usbohci - ok
20:28:25.0245 3116 [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
20:28:25.0292 3116 usbprint - ok
20:28:25.0323 3116 [ 576096CCBC07E7C4EA4F5E6686D6888F ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
20:28:25.0386 3116 usbscan - ok
20:28:25.0417 3116 [ F991AB9CC6B908DB552166768176896A ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:28:25.0448 3116 USBSTOR - ok
20:28:25.0511 3116 [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
20:28:25.0542 3116 usbuhci - ok
20:28:25.0589 3116 [ 45F4E7BF43DB40A6C6B4D92C76CBC3F2 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
20:28:25.0651 3116 usbvideo - ok
20:28:25.0698 3116 [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms C:\Windows\System32\uxsms.dll
20:28:25.0760 3116 UxSms - ok
20:28:25.0776 3116 [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc C:\Windows\system32\lsass.exe
20:28:25.0791 3116 VaultSvc - ok
20:28:25.0807 3116 [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
20:28:25.0838 3116 vdrvroot - ok
20:28:25.0885 3116 [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds C:\Windows\System32\vds.exe
20:28:25.0994 3116 vds - ok
20:28:26.0041 3116 [ 17C408214EA61696CEC9C66E388B14F3 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:28:26.0072 3116 vga - ok
20:28:26.0103 3116 [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave C:\Windows\System32\drivers\vga.sys
20:28:26.0135 3116 VgaSave - ok
20:28:26.0150 3116 VGPU - ok
20:28:26.0197 3116 [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
20:28:26.0259 3116 vhdmp - ok
20:28:26.0291 3116 [ C829317A37B4BEA8F39735D4B076E923 ] viaagp C:\Windows\system32\drivers\viaagp.sys
20:28:26.0337 3116 viaagp - ok
20:28:26.0353 3116 [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7 C:\Windows\system32\DRIVERS\viac7.sys
20:28:26.0415 3116 ViaC7 - ok
20:28:26.0431 3116 [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide C:\Windows\system32\drivers\viaide.sys
20:28:26.0478 3116 viaide - ok
20:28:26.0525 3116 [ C2F2911156FDC7817C52829C86DA494E ] vmbus C:\Windows\system32\drivers\vmbus.sys
20:28:26.0571 3116 vmbus - ok
20:28:26.0587 3116 [ D4D77455211E204F370D08F4963063CE ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
20:28:26.0618 3116 VMBusHID - ok
20:28:26.0634 3116 [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr C:\Windows\system32\drivers\volmgr.sys
20:28:26.0681 3116 volmgr - ok
20:28:26.0727 3116 [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:28:26.0790 3116 volmgrx - ok
20:28:26.0821 3116 [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap C:\Windows\system32\drivers\volsnap.sys
20:28:26.0868 3116 volsnap - ok
20:28:26.0899 3116 [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
20:28:26.0930 3116 vsmraid - ok
20:28:26.0993 3116 [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS C:\Windows\system32\vssvc.exe
20:28:27.0117 3116 VSS - ok
20:28:27.0149 3116 [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
20:28:27.0180 3116 vwifibus - ok
20:28:27.0227 3116 [ 7090D3436EEB4E7DA3373090A23448F7 ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
20:28:27.0258 3116 vwififlt - ok
20:28:27.0289 3116 [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time C:\Windows\system32\w32time.dll
20:28:27.0398 3116 W32Time - ok
20:28:27.0429 3116 [ DE3721E89C653AA281428C8A69745D90 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
20:28:27.0476 3116 WacomPen - ok
20:28:27.0507 3116 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
20:28:27.0585 3116 WANARP - ok
20:28:27.0585 3116 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:28:27.0632 3116 Wanarpv6 - ok
20:28:27.0710 3116 [ 353A04C273EC58475D8633E75CCD5604 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
20:28:27.0851 3116 WatAdminSvc - ok
20:28:27.0929 3116 [ 691E3285E53DCA558E1A84667F13E15A ] wbengine C:\Windows\system32\wbengine.exe
20:28:28.0038 3116 wbengine - ok
20:28:28.0085 3116 [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
20:28:28.0147 3116 WbioSrvc - ok
20:28:28.0194 3116 [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:28:28.0287 3116 wcncsvc - ok
20:28:28.0319 3116 [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:28:28.0365 3116 WcsPlugInService - ok
20:28:28.0412 3116 [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd C:\Windows\system32\DRIVERS\wd.sys
20:28:28.0443 3116 Wd - ok
20:28:28.0490 3116 [ 9950E3D0F08141C7E89E64456AE7DC73 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:28:28.0568 3116 Wdf01000 - ok
20:28:28.0615 3116 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:28:28.0709 3116 WdiServiceHost - ok
20:28:28.0709 3116 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:28:28.0755 3116 WdiSystemHost - ok
20:28:28.0787 3116 [ A9D880F97530D5B8FEE278923349929D ] WebClient C:\Windows\System32\webclnt.dll
20:28:28.0865 3116 WebClient - ok
20:28:28.0896 3116 [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:28:28.0974 3116 Wecsvc - ok
20:28:28.0989 3116 [ AC804569BB2364FB6017370258A4091B ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:28:29.0036 3116 wercplsupport - ok
20:28:29.0067 3116 [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc C:\Windows\System32\WerSvc.dll
20:28:29.0130 3116 WerSvc - ok
20:28:29.0161 3116 [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
20:28:29.0208 3116 WfpLwf - ok
20:28:29.0239 3116 [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount C:\Windows\system32\drivers\wimmount.sys
20:28:29.0270 3116 WIMMount - ok
20:28:29.0333 3116 [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
20:28:29.0426 3116 WinDefend - ok
20:28:29.0442 3116 WinHttpAutoProxySvc - ok
20:28:29.0504 3116 [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:28:29.0613 3116 Winmgmt - ok
20:28:29.0691 3116 [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM C:\Windows\system32\WsmSvc.dll
20:28:29.0832 3116 WinRM - ok
20:28:29.0894 3116 [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
20:28:29.0957 3116 WinUsb - ok
20:28:30.0019 3116 [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc C:\Windows\System32\wlansvc.dll
20:28:30.0113 3116 Wlansvc - ok
20:28:30.0144 3116 [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
20:28:30.0191 3116 WmiAcpi - ok
20:28:30.0222 3116 [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:28:30.0300 3116 wmiApSrv - ok
20:28:30.0393 3116 [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
20:28:30.0456 3116 WMPNetworkSvc - ok
20:28:30.0487 3116 [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:28:30.0534 3116 WPCSvc - ok
20:28:30.0565 3116 [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:28:30.0627 3116 WPDBusEnum - ok
20:28:30.0690 3116 [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:28:30.0768 3116 ws2ifsl - ok
20:28:30.0783 3116 [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc C:\Windows\System32\wscsvc.dll
20:28:30.0846 3116 wscsvc - ok
20:28:30.0846 3116 WSearch - ok
20:28:30.0955 3116 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
20:28:31.0049 3116 wuauserv - ok
20:28:31.0080 3116 [ E714A1C0354636837E20CCBF00888EE7 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:28:31.0127 3116 WudfPf - ok
20:28:31.0173 3116 [ 1023EE888C9B47178C5293ED5336AB69 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
20:28:31.0251 3116 WUDFRd - ok
20:28:31.0298 3116 [ 8D1E1E529A2C9E9B6A85B55A345F7629 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:28:31.0392 3116 wudfsvc - ok
20:28:31.0423 3116 [ FF2D745B560F7C71B31F30F4D49F73D2 ] WwanSvc C:\Windows\System32\wwansvc.dll
20:28:31.0517 3116 WwanSvc - ok
20:28:31.0579 3116 [ 30B73EB97218A16CBC6DE535782A1B35 ] yukonw7 C:\Windows\system32\DRIVERS\yk62x86.sys
20:28:31.0657 3116 yukonw7 - ok
20:28:31.0688 3116 ================ Scan global ===============================
20:28:31.0735 3116 [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
20:28:31.0797 3116 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
20:28:31.0844 3116 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll
20:28:31.0891 3116 [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
20:28:31.0922 3116 [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
20:28:31.0969 3116 [Global] - ok
20:28:31.0969 3116 ================ Scan MBR ==================================
20:28:31.0985 3116 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:28:32.0265 3116 \Device\Harddisk0\DR0 - ok
20:28:32.0281 3116 [ CD5ADE96F8C0920829FEF0A4D8EB2964 ] \Device\Harddisk1\DR1
20:28:32.0952 3116 \Device\Harddisk1\DR1 - ok
20:28:32.0952 3116 ================ Scan VBR ==================================
20:28:32.0967 3116 [ C044C939BF9D2019724B68C29C7FC556 ] \Device\Harddisk0\DR0\Partition1
20:28:32.0967 3116 \Device\Harddisk0\DR0\Partition1 - ok
20:28:32.0999 3116 [ 97742322055229878E1762667FC40AA2 ] \Device\Harddisk0\DR0\Partition2
20:28:32.0999 3116 \Device\Harddisk0\DR0\Partition2 - ok
20:28:33.0030 3116 [ 7FC71D9E31530100C3C2078B5DCA2AA5 ] \Device\Harddisk0\DR0\Partition3
20:28:33.0030 3116 \Device\Harddisk0\DR0\Partition3 - ok
20:28:33.0045 3116 ============================================================
20:28:33.0045 3116 Scan finished
20:28:33.0045 3116 ============================================================
20:28:33.0077 3124 Detected object count: 3
20:28:33.0077 3124 Actual detected object count: 3
20:29:00.0751 3124 iLokDrvr ( UnsignedFile.Multi.Generic ) - skipped by user
20:29:00.0751 3124 iLokDrvr ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:29:00.0751 3124 TPkd ( UnsignedFile.Multi.Generic ) - skipped by user
20:29:00.0751 3124 TPkd ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:29:00.0767 3124 USBAAPL ( UnsignedFile.Multi.Generic ) - skipped by user
20:29:00.0767 3124 USBAAPL ( UnsignedFile.Multi.Generic ) - User select action: Skip

markusg · 31.05.2013, 13:33

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Truemas · 31.05.2013, 14:38

Hier das combofix log:

[code]
Combofix Logfile:

Code:

ATTFilter

ComboFix 13-05-31.02 - Truemas 31-05-2013  21:22:07.1.2 - x86
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.2813.2073 [GMT 2:00]
ausgeführt von:: c:\users\Truemas\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Outdated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Outdated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\AcRemoteUpdate.exe
c:\program files\AutocompletePro\AutocompletePro.dll
c:\program files\AutocompletePro\InstTracker.exe
c:\program files\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files\AutocompletePro\support@predictad.com\install.rdf
c:\program files\AutocompletePro\TaskScheduler.dll
c:\program files\AutocompletePro\unins000.dat
c:\program files\AutocompletePro\unins000.exe
c:\program files\SecureW2
c:\program files\SecureW2\Uninstall.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\PEAP Manager.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\TTLS Manager.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk
c:\users\Truemas\AppData\Local\TempDIR
c:\users\Truemas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-04-28 bis 2013-05-31  ))))))))))))))))))))))))))))))
.
.
2013-05-31 08:52 . 2013-05-31 08:52	--------	d-----w-	C:\_OTL
2013-05-16 06:55 . 2013-05-05 19:12	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2013-05-16 06:00 . 2013-04-10 03:14	2347520	----a-w-	c:\windows\system32\win32k.sys
2013-05-16 06:00 . 2013-04-10 05:18	728424	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2013-05-16 06:00 . 2013-04-10 05:18	218984	----a-w-	c:\windows\system32\drivers\dxgmms1.sys
2013-05-16 06:00 . 2013-02-27 05:05	101720	----a-w-	c:\windows\system32\consent.exe
2013-05-16 06:00 . 2013-02-27 04:49	1796096	----a-w-	c:\windows\system32\authui.dll
2013-05-16 06:00 . 2013-02-27 04:49	47104	----a-w-	c:\windows\system32\appinfo.dll
2013-05-11 10:37 . 2013-05-11 10:37	209472	----a-w-	c:\program files\Internet Explorer\Plugins\nppdf32.dll
2013-05-05 22:11 . 2013-04-12 13:45	1211752	----a-w-	c:\windows\system32\drivers\ntfs.sys
2013-05-05 22:11 . 2013-03-19 05:04	3968856	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-05-05 22:11 . 2013-03-19 05:04	3913560	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-05-05 22:11 . 2013-03-19 04:48	38912	----a-w-	c:\windows\system32\csrsrv.dll
2013-05-05 22:11 . 2013-03-19 02:49	69632	----a-w-	c:\windows\system32\smss.exe
2013-05-05 22:11 . 2013-02-15 04:37	3217408	----a-w-	c:\windows\system32\mstscax.dll
2013-05-05 22:11 . 2013-02-15 04:34	131584	----a-w-	c:\windows\system32\aaclient.dll
2013-05-05 22:11 . 2013-02-15 03:25	36864	----a-w-	c:\windows\system32\tsgqec.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-15 21:35 . 2012-04-04 07:40	692104	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-05-15 21:35 . 2011-05-15 14:50	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\daemon tools\DTLite.exe" [2012-02-13 3481408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2012-09-07 348664]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Phonic Control Panel.lnk - c:\program files\Phonic\Firewire\Phonic_cpl.exe [2010-7-13 380928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 SkypeUpdate;Skype Updater;d:\program files\Skype\Updater\Updater.exe [x]
R3 iLokDrvr;Usb Driver;c:\windows\system32\DRIVERS\iLokDrvr.sys [x]
R3 Phonic_1394;Phonic_1394;c:\windows\system32\Drivers\Phonic_1394.sys [x]
R3 Phonic_avs;Phonic_avs;c:\windows\system32\Drivers\Phonic_avs.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SynasUSB;eLicenser;c:\windows\system32\drivers\SynasUSB.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AAV UpdateService;AAV UpdateService;d:\program files\AAVUpdateManager\aavus.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;d:\avira\AntiVir Desktop\sched.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 68250318
*Deregistered* - 68250318
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-05 22:04	1642448	----a-w-	c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-31 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 21:35]
.
2013-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-09 16:16]
.
2013-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-09 16:16]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://online.han.nl/sites/8-he-fys-80424/1213%20ziekenhuis%202/3a/productie.aspx
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - d:\micros~1\Office14\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\users\Truemas\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - d:\micros~1\Office14\EXCEL.EXE/3000
TCP: Interfaces\{6F70D6BE-7BA1-413B-9AB1-E22B070B1D33}: NameServer = 131.174.78.16,131.174.78.17
TCP: Interfaces\{7D4E476C-E9A3-411F-8292-7CE624985B16}: NameServer = 131.174.78.16,131.174.78.17
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-AutocompletePro2_is1 - c:\program files\AutocompletePro\unins000.exe
AddRemove-Phonic Firewire Driver 2.44.0 Setup - c:\program files\Phonic\Firewire\uninst.exe Software\Phonic\Firewire\Setup
AddRemove-SecureW2 EAP Suite - c:\program files\SecureW2\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-05-31  21:29:37
ComboFix-quarantined-files.txt  2013-05-31 19:29
.
Vor Suchlauf: 125.669.376 Bytes frei
Nach Suchlauf: 151.543.808 Bytes frei
.
- - End Of File - - D8F3917AE4DAABED88136915643F7A2C

--- --- ---

markusg · 31.05.2013, 17:21

Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Truemas · 31.05.2013, 23:33

Malewarebytes: ( hat einen Trojaner entfernt und den PC neu gestartet. Habe dann die einzige Datei im Logfile ordner jetzt hier geposted )

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.31.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Truemas :: VASHMOBIL [Administrator]

1-6-2013 4:44:30
mbam-log-2013-06-01 (04-44-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 419988
Laufzeit: 1 Stunde(n), 34 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\05312013_045221\D_Users\Truemas\AppData\Roaming\skype.dat (Trojan.FakeCodec) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg · 02.06.2013, 12:22

Hi,

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Truemas · 02.06.2013, 17:24

Code:

ATTFilter

AAVUpdateManager	Wolters Kluwer Deutschland GmbH	25-3-2013	32,0MB	18.00.0000							unbekannt
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	15-10-2009		10.0.32.18						unnötig
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	15-5-2013	6,00MB	11.7.700.202						notwendig
Adobe Reader XI (11.0.03) - Deutsch	Adobe Systems Incorporated	15-5-2013	133MB	11.0.03						notwendig
AFPL Ghostscript 8.54		12-9-2011													unbekannt
AFPL Ghostscript Fonts		12-9-2011													unbekannt
Amazon MP3-Downloader 1.0.9		21-4-2010												unnötig
AP Tuner 3.08		16-2-2012														unnötig
Apple Application Support	Apple Inc.	3-11-2012	61,0MB	2.1.7									unnötig
Apple Software Update	Apple Inc.	30-8-2011	2,38MB	2.1.3.127									unnötig
Audiograbber 1.83 SE	Audiograbber Deutschland	17-4-2010		1.83 SE 							unnötig
Avira Free Antivirus	Avira	26-11-2012	115MB	12.1.9.1236										notwendig
AVS Media Player 3.1	Online Media Technologies Ltd.	27-2-2010										unnötig
Battle.net		6-2-2011														unnötig
Bonjour	Apple Inc.	4-9-2011	745KB	3.0.0.2												unnötig
CCleaner	Piriform	24-5-2013		4.02											notwendig
Compatibility Pack for the 2007 Office system	Microsoft Corporation	9-2-2013	184MB	12.0.6612.1000					unnötig
DAEMON Tools Lite	DT Soft Ltd	21-2-2012		4.45.3.0297									unnötig
Diablo		6-2-2011															unnötig
DivX-Setup	DivX, Inc. 	9-4-2010		1.0.0.450										unnötig
eLicenser Control	Steinberg Media Technologies GmbH	15-8-2010									notwendig
ElsterFormular für Privatanwender	Landesfinanzdirektion Thüringen	31-8-2011		12.3.2.6814p					unnötig
Free M4a to MP3 Converter 6.1	ManiacTools.com	30-10-2009											unnötig
Free Metronome 1.1.0 r1	M	15-4-2010		1.1.0 r1										unnötig
Free Sound Recorder 2010 v8.2.1	Copyright(C) 2005-2010 CoolMedia Software.	4-5-2010	24,5MB						unnötig
Free YouTube to MP3 Converter version 3.10.15.1228	DVDVideoSoft Ltd.	18-2-2012	85,5MB						unnötig
GCH Guitar academy		22-5-2012													unnötig
GIMP 2.6.11	The GIMP Team	8-2-2011	106MB	2.6.11											notwendig
Google Chrome	Google Inc.	9-2-2013		26.0.1410.64										notwendig
Interlok driver setup x32	PACE Anti-Piracy	19-10-2009	127KB	5.8.11								notwendig
IrfanView (remove only)	Irfan Skiljan	12-9-2011	1,50MB	4.30										unnötig
Java(TM) 6 Update 31	Oracle	17-2-2012	95,1MB	6.0.310											notwendig
Konz 2012	USM	24-1-2012	273KB	1.00.0000											unbekannt
Malwarebytes Anti-Malware Version 1.75.0.1300	Malwarebytes Corporation	1-6-2013	19,2MB	1.75.0.1300				unnötig
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	27-1-2011	38,8MB	4.0.30319					unnötig
Microsoft .NET Framework 4 Client Profile DEU Language Pack	Microsoft Corporation	27-1-2011	2,93MB	4.0.30319			unnötig
Microsoft Lync 2010	Microsoft Corporation	16-5-2013	179MB	4.0.7577.4388								unnötig
Microsoft PowerPoint Viewer	Microsoft Corporation	21-12-2012	158MB	14.0.6029.1000							unnötig
Microsoft Silverlight	Microsoft Corporation	14-3-2013	104MB	5.1.20125.0								unnötig
Microsoft SQL Server 2005 Compact Edition [ENU]	Microsoft Corporation	6-8-2010	1,72MB	3.1.0000					unnötig
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053	Microsoft Corporation	24-1-2012	252KB	8.0.50727.4053		unnötig
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	18-6-2011	300KB	8.0.56336					unnötig
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148	Microsoft Corporation	9-8-2010	200KB	9.0.30729.4148		unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	15-10-2009	596KB	9.0.30729			unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	6-5-2011	594KB	9.0.30729.4148			unnötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	18-6-2011	600KB	9.0.30729.6161			unnötig
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	27-9-2012	12,2MB	10.0.40219			unnötig
Miranda IM 0.9.15		30-1-2011													unnötig
MOTU Symphonic Instrument		27-10-2009												notwendig
Mozilla Thunderbird (3.1.7)	Mozilla	26-1-2011		3.1.7 (de)									notwendig
Mozilla Thunderbird 16.0.2 (x86 de)	Mozilla	3-11-2012	42,2MB	16.0.2									notwendig
PDFlib TET PDF IFilter 4.1p3 32-bit	PDFlib GmbH	22-10-2012	8,91MB	4.1.3								unnötig
QuickTime	Apple Inc.	3-11-2012	73,2MB	7.72.80.56										unnötig
Recuva	Piriform	17-12-2011		1.42												unnötig
Skype™ 6.1	Skype Technologies S.A.	9-2-2013	21,1MB	6.1.129										unnötig
SmartSound Quicktracks Plugin	SmartSound Software Inc	31-10-2009	18,0MB	3.0.5.0								notwendig
Steinberg Cubase 6	Steinberg Media Technologies GmbH	16-8-2011	277MB	6.0.0							notwendig
Steinberg Cubase Essential 5	Steinberg Media Technologies GmbH	15-8-2010	124MB	5.1.2						notwendig
Steinberg Drum Loop Expansion 01	Steinberg Media Technologies GmbH	16-8-2011	428MB	2.0.0.0					notwendig
Steinberg Groove Agent ONE Content	Steinberg Media Technologies GmbH	16-8-2011	142MB	1.0.0.003				notwendig
Steinberg Groove Agent ONE Vintage Beatboxes	Steinberg Media Technologies GmbH	16-8-2011	38,0MB	1.0.0.000			notwendig
Steinberg HALion Sonic SE	Steinberg Media Technologies GmbH	16-8-2011	33,1MB	1.5.0						notwendig
Steinberg HALion Sonic SE Content	Steinberg Media Technologies GmbH	16-8-2011	3,12GB	1.0.0.000				notwendig
Steinberg HALionOne	Steinberg Media Technologies GmbH	16-8-2011	387MB	1.1.0.457						notwendig
Steinberg HALionOne Expression Set	Steinberg Media Technologies GmbH	16-8-2011	231MB	1.0.1.0					notwendig
Steinberg HALionOne GM Drum Set	Steinberg Media Technologies GmbH	16-8-2011	23,9MB	1.0.1.457					notwendig
Steinberg HALionOne GM Set	Steinberg Media Technologies GmbH	16-8-2011	63,6MB	1.0.1.457					notwendig
Steinberg HALionOne Pro Set	Steinberg Media Technologies GmbH	16-8-2011	123MB	1.0.1.457					notwendig
Steinberg HALionOne Studio Drum Set	Steinberg Media Technologies GmbH	16-8-2011	48,0MB	1.0.1.457				notwendig
Steinberg HALionOne Studio Set	Steinberg Media Technologies GmbH	16-8-2011	112MB	1.0.1.457					notwendig
Steinberg LoopMash Content	Steinberg Media Technologies GmbH	16-8-2011	617MB	2.0.0.000					notwendig
Steinberg LoopMash Content 2	Steinberg Media Technologies GmbH	16-8-2011	558MB	1.0.0.000					notwendig
Steinberg REVerence Content 01	Steinberg Media Technologies GmbH	16-8-2011	199MB	2.0.1.000					notwendig
Steinberg VST Amp Rack Content 01	Steinberg Media Technologies GmbH	16-8-2011	9,19MB	1.0.0.000				notwendig
Steuer 2011	Buhl Data Service GmbH	24-1-2012		19.00.7304									unnötig
STEUEReasy 2013	Wolters Kluwer Deutschland GmbH	25-3-2013	299MB	18.08									unnötig
Superior Drummer Installer	Toontrack	2-12-2009	26,7MB	2.2.1									notwendig
Synaptics Pointing Device Driver	Synaptics	19-10-2009		11.0.7.0							notwendig
TeamSpeak 3 Client	TeamSpeak Systems GmbH	1-7-2011											unnötig
Toontrack solo	Toontrack	20-10-2009	11,2MB	1.2.2											notwendig
Ulead VideoStudio 11 SE DVD	InterVideo Digital Technology Corporation	31-10-2009	224MB	11.0.0.0000				unnötig
Warcraft III	Blizzard Entertainment	5-6-2010												unnötig
Winamp	Nullsoft, Inc	17-4-2010		5.572 												notwendig
Winamp Erkennungs-Plug-in	Nullsoft, Inc	17-4-2010	125KB	1.0.0.1									notwendig
Windows Live Anmelde-Assistent	Microsoft Corporation	6-8-2010	1,93MB	5.000.818.5							unnötig
Windows Live Essentials	Microsoft Corporation	6-8-2010		14.0.8117.0416								unnötig
Windows Live Sync	Microsoft Corporation	6-8-2010	2,79MB	14.0.8117.416								unnötig
Windows Live-Uploadtool	Microsoft Corporation	6-8-2010	224KB	14.0.8014.1029								unnötig
Windows Media Encoder 9 Series		31-10-2009												unnötig
Windows Media Player Firefox Plugin	Microsoft Corp	11-1-2010	296KB	1.0.0.8								unnötig
WinRAR		14-4-2010															notwendig

30.05.2013, 20:58	#6
markusg /// Malware-holic	(GVU)PC springt aus beim booten mit Reatogo... Hi und deswegen steht da ja auch, Fix evtl.manuell eintragen __________________ --> (GVU)PC springt aus beim booten mit Reatogo...

(GVU)PC springt aus beim booten mit Reatogo...

Plagegeister aller Art und deren Bekämpfung: (GVU)PC springt aus beim booten mit Reatogo...