GVU / BKA Trojaner Win7, abgesicherter Modus m E-Aufforderung möglich

Baulller · 09.07.2013, 00:21

Hallo an alle,

ich hab alles probiert und bin schon seit Ewigkeiten wach, doch bekomm das Problem nicht in den Griff. ich habe Win 7, 64 Bit, es kommt immer nur ein weißer Bildschirm.

Ich komme aber in den abgesicherten Modus mit Eingabeaufforderung!

Was soll ich tun, bitte helft mir!

Liebe Grüße

markusg · 09.07.2013, 00:30

Hi,
Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Baulller · 09.07.2013, 00:40

"boote das System in die System Reparatur Option"

solche Sätze verstehe ich nicht.

Ich hab jetzt Farbar's Recovery Scan Tool runtergeladen und auf meinem infizierten Rechner im abgesicherten Modus gesartet, dabei enstand eine FRST.txt Datei...

Oder hab ich was flasch gemacht?

markusg · 09.07.2013, 00:42

Ja, eigendlich schon, wie du ins recovery system gekommen währst, hättest du gesehen, wenn du die ganze Anleitung aufmerksam gelesen hättest.
das ist nötig für alle Anleitungen die wir posten.
poste mal die txt Datei

Baulller · 09.07.2013, 00:47

Stimmt, wer lesen kann ist klar im Vorteil :-)

Bin n bisschen übermüdet, sorry!

Hier die txt-Datei:
FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-07-2013
Ran by Ali (administrator) on 09-07-2013 01:35:10
Running from E:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\cmd.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe [3179288 2010-01-06] (Dell Inc.)
HKLM\...\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-06-18] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1890088 2010-03-17] (Synaptics Incorporated)
HKLM\...\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [5712896 2010-02-03] (Dell Inc.)
HKLM\...\Run: [M-Audio Taskbar Icon] C:\Windows\system32\M-AudioTaskBarIcon.exe [798216 2009-09-03] (Avid Technology, Inc.)
HKLM\...\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [165184 2010-05-21] (Softthinks)
HKLM-x32\...\Runonce: [GrpConv] grpconv -o [x]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$3b99f81f31d5dbab1bcf87d0107a285a\n. ATTENTION! ====> ZeroAccess
HKCU\...\Run: [Ysvumyuvk] C:\Users\Ali\AppData\Roaming\Ucvetu\esbe.exe [237056 2011-10-20] ()
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Users\Ali\AppData\Roaming\skype.dat [98304 2011-11-17] () <==== ATTENTION 
HKCR\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}\n. ATTENTION! ====> ZeroAccess?
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3760698348-1531322062-719399750-1000\$3b99f81f31d5dbab1bcf87d0107a285a\n. ATTENTION! ====> ZeroAccess?
MountPoints2: {08176d70-330c-11e0-a902-f04da292cc18} - E:\pushinst.exe
MountPoints2: {f20d691a-81bc-11e2-aa2a-f04da292cc18} - G:\pushinst.exe
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-06-08] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [409744 2009-06-24] (Creative Technology Ltd)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-06-02] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [206064 2009-05-21] (SupportSoft, Inc.)
HKLM-x32\...\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU SearchScopes: DefaultScope {777D7234-6F96-4C43-B3E9-81989EA52A52} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADFA_deDE474
SearchScopes: HKCU - {777D7234-6F96-4C43-B3E9-81989EA52A52} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADFA_deDE474
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Ali\AppData\Roaming\Mozilla\Firefox\Profiles\pj48my79.default
FF user.js: detected! => C:\Users\Ali\AppData\Roaming\Mozilla\Firefox\Profiles\pj48my79.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Ali\AppData\Roaming\Mozilla\Firefox\Profiles\pj48my79.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==================== Services (Whitelisted) =================

S2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
S2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [88888 2009-07-28] (AVM Berlin)
S2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE [48128 2010-02-03] (Dell Inc.)
S2 SkypeUpdate; "C:\Program Files (x86)\Skype\Updater\Updater.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
S3 BEHRINGER_PT_MIDI; C:\Windows\System32\drivers\bhrngr_m.sys [43584 2009-12-15] (Ploytec GmbH)
S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [714368 2010-10-22] (AVM GmbH)
S3 MADFUAUDIOPHILE; C:\Windows\System32\DRIVERS\MAudioAudiophile_DFU.sys [46088 2009-09-03] (M-Audio)
S3 MAUSBAUDIOPHILE; C:\Windows\System32\DRIVERS\MAudioAudiophile.sys [187912 2009-09-03] (Avid Technology, Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 01:35 - 2013-07-09 01:35 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-07-09 01:35 - 2013-07-09 01:35 - 00000000 ____D C:\FRST
2013-07-09 01:35 - 2010-09-26 22:26 - 00787722 ____A C:\Windows\System32\perfh007.dat
2013-07-09 01:35 - 2010-09-26 22:26 - 00172832 ____A C:\Windows\System32\perfc007.dat
2013-07-09 01:35 - 2009-07-14 07:13 - 00005430 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-09 01:14 - 2013-05-17 04:01 - 00000004 ____A C:\Users\Ali\AppData\Roaming\skype.ini
2013-07-09 01:13 - 2011-01-19 23:22 - 00000000 ____D C:\Users\Ali\AppData\Local\SoftThinks
2013-07-09 01:13 - 2010-09-26 20:32 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-07-09 01:13 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-09 01:13 - 2009-07-14 06:51 - 00092920 ____A C:\Windows\setupact.log
2013-07-09 01:11 - 2012-07-20 01:20 - 00000000 ____D C:\Users\Ali\AppData\Roaming\BitTorrent
2013-07-09 01:11 - 2011-01-19 23:16 - 00009138 ____A C:\Windows\PFRO.log
2013-07-09 00:53 - 2013-05-13 02:54 - 00000000 ____D C:\Users\Ali\Desktop\Neuer Ordner
2013-07-09 00:13 - 2011-01-19 23:19 - 00000000 ____D C:\users\Ali
2013-07-08 23:28 - 2009-07-14 06:45 - 00013664 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-08 23:28 - 2009-07-14 06:45 - 00013664 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-27 21:05 - 2010-09-26 19:37 - 01125157 ____A C:\Windows\WindowsUpdate.log

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3760698348-1531322062-719399750-1000\$3b99f81f31d5dbab1bcf87d0107a285a

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$3b99f81f31d5dbab1bcf87d0107a285a

ZeroAccess:
C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}
C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}\@
C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}\L
C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}\U
C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}\U\00000001.@
C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}\U\80000000.@
C:\Users\Ali\AppData\Local\{3b99f81f-31d5-dbab-1bcf-87d0107a285a}\U\800000cb.@

Files to move or delete:
====================
C:\Users\Ali\AppData\Roaming\skype.dat
C:\Users\Ali\AppData\Roaming\skype.ini
C:\ProgramData\0tbpw.pad

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-08 23:46

==================== End Of Log ============================

--- --- ---

markusg · 09.07.2013, 00:51

Hi,
dannn solltest du vllt morgen weitermmachen, der PC ist da immernoch infiziert :-)
Du musst den Teil mit der Recovery Konsole auslassen, einfach aus dem abges. Modus mit Eingabeaufforderung arbeiten
Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKCU\...\Run: [Ysvumyuvk] C:\Users\Ali\AppData\Roaming\Ucvetu\esbe.exe [237056 2011-10-20] ()
C:\Users\Ali\AppData\Roaming\Ucvetu
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Users\Ali\AppData\Roaming\skype.dat [98304 2011-11-17] () <==== ATTENTION 
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Users\Ali\AppData\Roaming\skype.dat [98304 2011-11-17] () <==== ATTENTION 
C:\Users\Ali\AppData\Roaming\skype.dat
C:\Users\Ali\AppData\Roaming\skype.ini
C:\ProgramData\0tbpw.pad

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Navigiere bitte zu:
C:\FRST\Quarantine
Rechtsklick, mit Winrar oder einem anderen Archvierer packen und im Uploadchannel hochladen.
Trojaner-Board Upload Channel

Baulller · 09.07.2013, 00:59

Habe eben mit F8 Taste zu Computer reparieren gefunden, hab jetzt aber schon
2 mal Bluescreen gehabt:

1.Fatal System Error

beim 2. Mal: problem has been detected....

Edit: Habs jetzt noch 4 mal probiert, kommt immer: ...problem has been detected...

am Ende steht STOP: 0x000000F4

Edit2: Du hast geschrieben ich soll nochmal in die Reparaturoptionen, da war ich aber nie drin. SOll ich das mit dem Fixen so probieren, dass ich über den abgesicherten Modus im Windows-Explorer den Fix Button drücke?

markusg · 09.07.2013, 01:12

ja, steht ja da, das mit der Konsole weg lassen

Baulller · 09.07.2013, 01:25

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-07-2013
Ran by Ali at 2013-07-09 02:21:46 Run:1
Running from E:\
Boot Mode: Safe Mode (minimal)
==============================================

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Ysvumyuvk] C:\Users\Ali\AppData\Roaming\Ucvetu\esbe.exe [237056 2011-10-20 => Value not found.
C:\Users\Ali\AppData\Roaming\Ucvetu => Moved successfully.
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.
C:\Users\Ali\AppData\Roaming\skype.dat => Moved successfully.
C:\Users\Ali\AppData\Roaming\skype.ini => Moved successfully.
C:\ProgramData\0tbpw.pad => Moved successfully.

==== End of Fixlog ====

Edit: Hab auch die Quarantäne-Datei hochgeladen.zt einfach nen Neustart machn?

Edit 2: Soll ich jetzt einfach nen Neustart machn?

Liebe Grüße

markusg · 09.07.2013, 10:31

Ja, in den normalen Modus bitte.
Wenn dieser funktioniert:
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Baulller · 09.07.2013, 14:36

Hallo,

TDSSKiller hat nichts gefunden, hier der Log:

Edit: Falscher Log...

markusg · 09.07.2013, 14:40

Hi, bitte nach Anleitung konfigurieren und noch mal scannen

Baulller · 09.07.2013, 14:47

Sorry für meine Dummheit, hier der "neue" Log:

Code:

ATTFilter

15:42:02.0847 4792  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
15:42:02.0863 4792  ============================================================
15:42:02.0863 4792  Current date / time: 2013/07/09 15:42:02.0863
15:42:02.0863 4792  SystemInfo:
15:42:02.0863 4792  
15:42:02.0863 4792  OS Version: 6.1.7600 ServicePack: 0.0
15:42:02.0863 4792  Product type: Workstation
15:42:02.0863 4792  ComputerName: ALI-PC
15:42:02.0863 4792  UserName: Ali
15:42:02.0863 4792  Windows directory: C:\Windows
15:42:02.0863 4792  System windows directory: C:\Windows
15:42:02.0863 4792  Running under WOW64
15:42:02.0863 4792  Processor architecture: Intel x64
15:42:02.0863 4792  Number of processors: 4
15:42:02.0863 4792  Page size: 0x1000
15:42:02.0863 4792  Boot type: Normal boot
15:42:02.0863 4792  ============================================================
15:42:03.0221 4792  Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:42:03.0221 4792  Drive \Device\Harddisk1\DR2 - Size: 0x1D1A00000 (7.28 Gb), SectorSize: 0x200, Cylinders: 0x3B5, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
15:42:03.0221 4792  ============================================================
15:42:03.0221 4792  \Device\Harddisk0\DR0:
15:42:03.0221 4792  MBR partitions:
15:42:03.0221 4792  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D4C000
15:42:03.0221 4792  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D7E800, BlocksNum 0x48AD92B0
15:42:03.0221 4792  \Device\Harddisk1\DR2:
15:42:03.0221 4792  MBR partitions:
15:42:03.0221 4792  \Device\Harddisk1\DR2\Partition1: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0xE8CFC1
15:42:03.0221 4792  ============================================================
15:42:03.0299 4792  C: <-> \Device\Harddisk0\DR0\Partition2
15:42:03.0299 4792  ============================================================
15:42:03.0299 4792  Initialize success
15:42:03.0299 4792  ============================================================
15:42:14.0516 4288  ============================================================
15:42:14.0516 4288  Scan started
15:42:14.0516 4288  Mode: Manual; SigCheck; TDLFS; 
15:42:14.0516 4288  ============================================================
15:42:14.0625 4288  ================ Scan system memory ========================
15:42:14.0625 4288  System memory - ok
15:42:14.0625 4288  ================ Scan services =============================
15:42:14.0765 4288  [ 969C91060CBB5D17CB8440B5F78B4C51 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
15:42:14.0890 4288  1394ohci - ok
15:42:14.0968 4288  [ 794FF35015209B9D44F1360C42C9776D ] ACPI            C:\Windows\system32\DRIVERS\ACPI.sys
15:42:15.0015 4288  ACPI - ok
15:42:15.0031 4288  [ 63B05A0420CE4BF0E4AF6DCC7CADA254 ] AcpiPmi         C:\Windows\system32\DRIVERS\acpipmi.sys
15:42:15.0077 4288  AcpiPmi - ok
15:42:15.0140 4288  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
15:42:15.0171 4288  adp94xx - ok
15:42:15.0171 4288  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
15:42:15.0187 4288  adpahci - ok
15:42:15.0202 4288  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
15:42:15.0218 4288  adpu320 - ok
15:42:15.0280 4288  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
15:42:15.0358 4288  AeLookupSvc - ok
15:42:15.0483 4288  [ A6FB9DB8F1A86861D955FD6975977AE0 ] AESTFilters     C:\Program Files\IDT\WDM\AESTSr64.exe
15:42:15.0530 4288  AESTFilters - ok
15:42:15.0608 4288  [ DB9D6C6B2CD95A9CA414D045B627422E ] AFD             C:\Windows\system32\drivers\afd.sys
15:42:15.0655 4288  AFD - ok
15:42:15.0655 4288  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\DRIVERS\agp440.sys
15:42:15.0670 4288  agp440 - ok
15:42:15.0686 4288  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe
15:42:15.0733 4288  ALG - ok
15:42:15.0764 4288  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\DRIVERS\aliide.sys
15:42:15.0779 4288  aliide - ok
15:42:15.0842 4288  [ 388E79AF1C9E4D84A8559FA77F804CF6 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
15:42:15.0889 4288  AMD External Events Utility - ok
15:42:15.0920 4288  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\DRIVERS\amdide.sys
15:42:15.0935 4288  amdide - ok
15:42:15.0935 4288  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
15:42:15.0982 4288  AmdK8 - ok
15:42:16.0154 4288  [ 79A11CB10FF02A8425DABBB040249F7D ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
15:42:16.0279 4288  amdkmdag - ok
15:42:16.0325 4288  [ 6F6D47246FBB0CF65619684A0F89179E ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
15:42:16.0372 4288  amdkmdap - ok
15:42:16.0419 4288  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
15:42:16.0466 4288  AmdPPM - ok
15:42:16.0497 4288  [ EC7EBAB00A4D8448BAB68D1E49B4BEB9 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
15:42:16.0513 4288  amdsata - ok
15:42:16.0559 4288  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
15:42:16.0591 4288  amdsbs - ok
15:42:16.0606 4288  [ DB27766102C7BF7E95140A2AA81D042E ] amdxata         C:\Windows\system32\drivers\amdxata.sys
15:42:16.0622 4288  amdxata - ok
15:42:16.0637 4288  [ 42FD751B27FA0E9C69BB39F39E409594 ] AppID           C:\Windows\system32\drivers\appid.sys
15:42:16.0669 4288  AppID - ok
15:42:16.0715 4288  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
15:42:16.0793 4288  AppIDSvc - ok
15:42:16.0825 4288  [ D065BE66822847B7F127D1F90158376E ] Appinfo         C:\Windows\System32\appinfo.dll
15:42:16.0856 4288  Appinfo - ok
15:42:16.0871 4288  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys
15:42:16.0903 4288  arc - ok
15:42:16.0903 4288  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
15:42:16.0918 4288  arcsas - ok
15:42:16.0934 4288  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
15:42:17.0012 4288  AsyncMac - ok
15:42:17.0043 4288  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\DRIVERS\atapi.sys
15:42:17.0059 4288  atapi - ok
15:42:17.0121 4288  [ 2D648572BA9A610952FCAFBA1E119C2D ] AtiHdmiService  C:\Windows\system32\drivers\AtiHdmi.sys
15:42:17.0199 4288  AtiHdmiService - ok
15:42:17.0215 4288  [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
15:42:17.0308 4288  AudioEndpointBuilder - ok
15:42:17.0308 4288  [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioSrv        C:\Windows\System32\Audiosrv.dll
15:42:17.0355 4288  AudioSrv - ok
15:42:17.0449 4288  [ C6F4C466B654C1BE98AF31418BB5AC30 ] AVM WLAN Connection Service C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
15:42:17.0495 4288  AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - warning
15:42:17.0495 4288  AVM WLAN Connection Service - detected UnsignedFile.Multi.Generic (1)
15:42:17.0542 4288  [ 1DC2F715792CF33428AD7993ACBD224D ] avmeject        C:\Windows\system32\drivers\avmeject.sys
15:42:17.0558 4288  avmeject - ok
15:42:17.0573 4288  [ B20B5FA5CA050E9926E4D1DB81501B32 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
15:42:17.0620 4288  AxInstSV - ok
15:42:17.0651 4288  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
15:42:17.0714 4288  b06bdrv - ok
15:42:17.0729 4288  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
15:42:17.0792 4288  b57nd60a - ok
15:42:17.0870 4288  [ 01A24B415926BB5F772DBE12459D97DE ] BBSvc           C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
15:42:17.0901 4288  BBSvc - ok
15:42:17.0963 4288  [ 785DE7ABDA13309D6065305542829E76 ] BBUpdate        C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
15:42:17.0979 4288  BBUpdate - ok
15:42:18.0057 4288  [ AC4E2D84DE54CD3A013AEFF0CC56095C ] BCM42RLY        C:\Windows\system32\drivers\BCM42RLY.sys
15:42:18.0088 4288  BCM42RLY - ok
15:42:18.0182 4288  [ 8B5D16D20774FC3727F44E161BE2C0AC ] BCM43XX         C:\Windows\system32\DRIVERS\bcmwl664.sys
15:42:18.0244 4288  BCM43XX - ok
15:42:18.0291 4288  [ D224B2E6BB543F1D8F1177D57FEC2950 ] BcmVWL          C:\Windows\system32\DRIVERS\bcmvwl64.sys
15:42:18.0322 4288  BcmVWL - ok
15:42:18.0353 4288  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
15:42:18.0416 4288  BDESVC - ok
15:42:18.0431 4288  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
15:42:18.0509 4288  Beep - ok
15:42:18.0572 4288  [ 27FD9D5BA350B719CF11FD432447D155 ] BEHRINGER_PT_MIDI C:\Windows\system32\drivers\bhrngr_m.sys
15:42:18.0603 4288  BEHRINGER_PT_MIDI - ok
15:42:18.0634 4288  [ 4992C609A6315671463E30F6512BC022 ] BFE             C:\Windows\System32\bfe.dll
15:42:18.0743 4288  BFE - ok
15:42:18.0790 4288  [ 7F0C323FE3DA28AA4AA1BDA3F575707F ] BITS            C:\Windows\System32\qmgr.dll
15:42:18.0868 4288  BITS - ok
15:42:18.0915 4288  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
15:42:18.0962 4288  blbdrive - ok
15:42:19.0009 4288  [ 19D20159708E152267E53B66677A4995 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
15:42:19.0055 4288  bowser - ok
15:42:19.0071 4288  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
15:42:19.0118 4288  BrFiltLo - ok
15:42:19.0133 4288  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
15:42:19.0180 4288  BrFiltUp - ok
15:42:19.0243 4288  [ 6B054C67AAA87843504E8E3C09102009 ] Browser         C:\Windows\System32\browser.dll
15:42:19.0274 4288  Browser - ok
15:42:19.0305 4288  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
15:42:19.0321 4288  Brserid - ok
15:42:19.0336 4288  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
15:42:19.0383 4288  BrSerWdm - ok
15:42:19.0414 4288  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
15:42:19.0461 4288  BrUsbMdm - ok
15:42:19.0477 4288  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
15:42:19.0508 4288  BrUsbSer - ok
15:42:19.0555 4288  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys
15:42:19.0601 4288  BthEnum - ok
15:42:19.0617 4288  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
15:42:19.0648 4288  BTHMODEM - ok
15:42:19.0711 4288  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
15:42:19.0742 4288  BthPan - ok
15:42:19.0804 4288  [ D59773C7FDD3D795D6FE402EEEA8D71E ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys
15:42:19.0835 4288  BTHPORT - ok
15:42:19.0882 4288  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll
15:42:19.0960 4288  bthserv - ok
15:42:19.0991 4288  [ 8504842634DD144C075B6B0C982CCEC4 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
15:42:20.0007 4288  BTHUSB - ok
15:42:20.0038 4288  [ D3466F77C2C49C6E393BA5FBA963A33E ] btusbflt        C:\Windows\system32\drivers\btusbflt.sys
15:42:20.0069 4288  btusbflt - ok
15:42:20.0116 4288  [ AF838D8029AE7C27470862D63FA54D24 ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys
15:42:20.0147 4288  btwaudio - ok
15:42:20.0163 4288  [ 5C849BD7C78791C5CEE9F4651D7FE38D ] btwavdt         C:\Windows\system32\drivers\btwavdt.sys
15:42:20.0179 4288  btwavdt - ok
15:42:20.0241 4288  [ 10FFB5FA51D5713D872B41A59DFC2213 ] btwdins         C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
15:42:20.0257 4288  btwdins - ok
15:42:20.0272 4288  [ 6149301DC3F81D6F9667A3FBAC410975 ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys
15:42:20.0288 4288  btwl2cap - ok
15:42:20.0319 4288  [ 3E1991AFA851A36DC978B0A1B0535C8B ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys
15:42:20.0350 4288  btwrchid - ok
15:42:20.0350 4288  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
15:42:20.0428 4288  cdfs - ok
15:42:20.0475 4288  [ 83D2D75E1EFB81B3450C18131443F7DB ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
15:42:20.0491 4288  cdrom - ok
15:42:20.0506 4288  [ 312E2F82AF11E79906898AC3E3D58A1F ] CertPropSvc     C:\Windows\System32\certprop.dll
15:42:20.0600 4288  CertPropSvc - ok
15:42:20.0615 4288  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
15:42:20.0662 4288  circlass - ok
15:42:20.0709 4288  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
15:42:20.0740 4288  CLFS - ok
15:42:20.0818 4288  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
15:42:20.0834 4288  clr_optimization_v2.0.50727_32 - ok
15:42:20.0865 4288  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
15:42:20.0881 4288  clr_optimization_v2.0.50727_64 - ok
15:42:20.0990 4288  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
15:42:21.0005 4288  clr_optimization_v4.0.30319_32 - ok
15:42:21.0037 4288  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
15:42:21.0037 4288  clr_optimization_v4.0.30319_64 - ok
15:42:21.0083 4288  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
15:42:21.0115 4288  CmBatt - ok
15:42:21.0161 4288  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\DRIVERS\cmdide.sys
15:42:21.0177 4288  cmdide - ok
15:42:21.0208 4288  [ CA7720B73446FDDEC5C69519C1174C98 ] CNG             C:\Windows\system32\Drivers\cng.sys
15:42:21.0271 4288  CNG - ok
15:42:21.0271 4288  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
15:42:21.0286 4288  Compbatt - ok
15:42:21.0302 4288  [ F26B3A86F6FA87CA360B879581AB4123 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
15:42:21.0333 4288  CompositeBus - ok
15:42:21.0333 4288  COMSysApp - ok
15:42:21.0364 4288  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
15:42:21.0380 4288  crcdisk - ok
15:42:21.0395 4288  [ 8C57411B66282C01533CB776F98AD384 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
15:42:21.0473 4288  CryptSvc - ok
15:42:21.0520 4288  [ ED5CF92396A62F4C15110DCDB5E854D9 ] CtClsFlt        C:\Windows\system32\DRIVERS\CtClsFlt.sys
15:42:21.0551 4288  CtClsFlt - ok
15:42:21.0676 4288  [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc          C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
15:42:21.0707 4288  cvhsvc - ok
15:42:21.0739 4288  [ 7266972E86890E2B30C0C322E906B027 ] DcomLaunch      C:\Windows\system32\rpcss.dll
15:42:21.0817 4288  DcomLaunch - ok
15:42:21.0863 4288  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll
15:42:21.0941 4288  defragsvc - ok
15:42:22.0004 4288  [ 9C253CE7311CA60FC11C774692A13208 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
15:42:22.0035 4288  DfsC - ok
15:42:22.0066 4288  [ CE3B9562D997F69B330D181A8875960F ] Dhcp            C:\Windows\system32\dhcpcore.dll
15:42:22.0097 4288  Dhcp - ok
15:42:22.0129 4288  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
15:42:22.0238 4288  discache - ok
15:42:22.0269 4288  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
15:42:22.0300 4288  Disk - ok
15:42:22.0331 4288  [ 85CF424C74A1D5EC33533E1DBFF9920A ] Dnscache        C:\Windows\System32\dnsrslvr.dll
15:42:22.0363 4288  Dnscache - ok
15:42:22.0441 4288  [ 0840ABBBDF438691EE65A20040635CBE ] DockLoginService C:\Program Files\Dell\DellDock\DockLogin.exe
15:42:22.0456 4288  DockLoginService ( UnsignedFile.Multi.Generic ) - warning
15:42:22.0456 4288  DockLoginService - detected UnsignedFile.Multi.Generic (1)
15:42:22.0487 4288  [ 14452ACDB09B70964C8C21BF80A13ACB ] dot3svc         C:\Windows\System32\dot3svc.dll
15:42:22.0581 4288  dot3svc - ok
15:42:22.0597 4288  [ 8C2BA6BEA949EE6E68385F5692BAFB94 ] DPS             C:\Windows\system32\dps.dll
15:42:22.0675 4288  DPS - ok
15:42:22.0690 4288  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
15:42:22.0737 4288  drmkaud - ok
15:42:22.0799 4288  [ 1633B9ABF52784A1331476397A48CBEF ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
15:42:22.0831 4288  DXGKrnl - ok
15:42:22.0846 4288  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll
15:42:22.0909 4288  EapHost - ok
15:42:23.0018 4288  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
15:42:23.0065 4288  ebdrv - ok
15:42:23.0111 4288  [ 156F6159457D0AA7E59B62681B56EB90 ] EFS             C:\Windows\System32\lsass.exe
15:42:23.0158 4288  EFS - ok
15:42:23.0236 4288  [ 47C071994C3F649F23D9CD075AC9304A ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
15:42:23.0299 4288  ehRecvr - ok
15:42:23.0330 4288  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe
15:42:23.0361 4288  ehSched - ok
15:42:23.0392 4288  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
15:42:23.0408 4288  elxstor - ok
15:42:23.0423 4288  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\DRIVERS\errdev.sys
15:42:23.0455 4288  ErrDev - ok
15:42:23.0517 4288  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll
15:42:23.0595 4288  EventSystem - ok
15:42:23.0626 4288  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys
15:42:23.0704 4288  exfat - ok
15:42:23.0735 4288  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys
15:42:23.0813 4288  fastfat - ok
15:42:23.0845 4288  [ D607B2F1BEE3992AA6C2C92C0A2F0855 ] Fax             C:\Windows\system32\fxssvc.exe
15:42:23.0907 4288  Fax - ok
15:42:23.0923 4288  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
15:42:23.0938 4288  fdc - ok
15:42:23.0969 4288  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll
15:42:24.0047 4288  fdPHost - ok
15:42:24.0063 4288  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
15:42:24.0110 4288  FDResPub - ok
15:42:24.0157 4288  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
15:42:24.0172 4288  FileInfo - ok
15:42:24.0188 4288  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
15:42:24.0250 4288  Filetrace - ok
15:42:24.0281 4288  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
15:42:24.0328 4288  flpydisk - ok
15:42:24.0359 4288  [ F7866AF72ABBAF84B1FA5AA195378C59 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
15:42:24.0375 4288  FltMgr - ok
15:42:24.0406 4288  [ CB5E4B9C319E3C6BB363EB7E58A4A051 ] FontCache       C:\Windows\system32\FntCache.dll
15:42:24.0453 4288  FontCache - ok
15:42:24.0531 4288  [ 8D89E3131C27FDD6932189CB785E1B7A ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
15:42:24.0547 4288  FontCache3.0.0.0 - ok
15:42:24.0578 4288  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
15:42:24.0593 4288  FsDepends - ok
15:42:24.0625 4288  [ D3E3F93D67821A2DB2B3D9FAC2DC2064 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
15:42:24.0640 4288  Fs_Rec - ok
15:42:24.0687 4288  [ AE87BA80D0EC3B57126ED2CDC15B24ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
15:42:24.0703 4288  fvevol - ok
15:42:24.0781 4288  [ 15585492E45E2F30768B2D5B57929D99 ] fwlanusbn       C:\Windows\system32\DRIVERS\fwlanusbn.sys
15:42:24.0827 4288  fwlanusbn - ok
15:42:24.0843 4288  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
15:42:24.0859 4288  gagp30kx - ok
15:42:24.0937 4288  [ C1BBCE4B30B45410178EE674C818D10C ] GameConsoleService C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe
15:42:24.0968 4288  GameConsoleService - ok
15:42:25.0015 4288  [ FE5AB4525BC2EC68B9119A6E5D40128B ] gpsvc           C:\Windows\System32\gpsvc.dll
15:42:25.0077 4288  gpsvc - ok
15:42:25.0108 4288  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
15:42:25.0139 4288  hcw85cir - ok
15:42:25.0171 4288  [ 6410F6F415B2A5A9037224C41DA8BF12 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
15:42:25.0217 4288  HdAudAddService - ok
15:42:25.0233 4288  [ 0A49913402747A0B67DE940FB42CBDBB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
15:42:25.0295 4288  HDAudBus - ok
15:42:25.0327 4288  [ B6AC71AAA2B10848F57FC49D55A651AF ] HECIx64         C:\Windows\system32\DRIVERS\HECIx64.sys
15:42:25.0358 4288  HECIx64 - ok
15:42:25.0358 4288  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
15:42:25.0405 4288  HidBatt - ok
15:42:25.0436 4288  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
15:42:25.0483 4288  HidBth - ok
15:42:25.0514 4288  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
15:42:25.0561 4288  HidIr - ok
15:42:25.0576 4288  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll
15:42:25.0654 4288  hidserv - ok
15:42:25.0685 4288  [ B3BF6B5B50006DEF50B66306D99FCF6F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
15:42:25.0701 4288  HidUsb - ok
15:42:25.0717 4288  [ EFA58EDE58DD74388FFD04CB32681518 ] hkmsvc          C:\Windows\system32\kmsvc.dll
15:42:25.0795 4288  hkmsvc - ok
15:42:25.0826 4288  [ 046B2673767CA626E2CFB7FDF735E9E8 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
15:42:25.0857 4288  HomeGroupListener - ok
15:42:25.0904 4288  [ 06A7422224D9865A5613710A089987DF ] HomeGroupProvider C:\Windows\system32\provsvc.dll
15:42:25.0935 4288  HomeGroupProvider - ok
15:42:25.0951 4288  [ 0886D440058F203EBA0E1825E4355914 ] HpSAMD          C:\Windows\system32\DRIVERS\HpSAMD.sys
15:42:25.0966 4288  HpSAMD - ok
15:42:25.0997 4288  [ CEE049CAC4EFA7F4E1E4AD014414A5D4 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
15:42:26.0075 4288  HTTP - ok
15:42:26.0107 4288  [ F17766A19145F111856378DF337A5D79 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
15:42:26.0107 4288  hwpolicy - ok
15:42:26.0138 4288  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
15:42:26.0153 4288  i8042prt - ok
15:42:26.0200 4288  [ 2064090C9FAAD92C090D77E50E735B2E ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
15:42:26.0231 4288  iaStor - ok
15:42:26.0309 4288  [ A9BE186ABF28B3D3D698CB855EDF457E ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
15:42:26.0341 4288  IAStorDataMgrSvc - ok
15:42:26.0387 4288  [ B75E45C564E944A2657167D197AB29DA ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
15:42:26.0419 4288  iaStorV - ok
15:42:26.0465 4288  [ 2F2BE70D3E02B6FA877921AB9516D43C ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
15:42:26.0497 4288  idsvc - ok
15:42:26.0543 4288  [ AC9EBDE25DB39A35E1CEB0441BA7A464 ] IGDCTRL         C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
15:42:26.0559 4288  IGDCTRL - ok
15:42:26.0715 4288  [ A87261EF1546325B559374F5689CF5BC ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
15:42:26.0824 4288  igfx - ok
15:42:26.0840 4288  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
15:42:26.0855 4288  iirsp - ok
15:42:26.0887 4288  [ C5B4683680DF085B57BC53E5EF34861F ] IKEEXT          C:\Windows\System32\ikeext.dll
15:42:26.0949 4288  IKEEXT - ok
15:42:26.0980 4288  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\DRIVERS\intelide.sys
15:42:26.0996 4288  intelide - ok
15:42:27.0011 4288  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
15:42:27.0058 4288  intelppm - ok
15:42:27.0074 4288  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
15:42:27.0152 4288  IPBusEnum - ok
15:42:27.0167 4288  [ 722DD294DF62483CECAAE6E094B4D695 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:42:27.0245 4288  IpFilterDriver - ok
15:42:27.0277 4288  [ E2B4A4494DB7CB9B89B55CA268C337C5 ] IPMIDRV         C:\Windows\system32\DRIVERS\IPMIDrv.sys
15:42:27.0308 4288  IPMIDRV - ok
15:42:27.0323 4288  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
15:42:27.0417 4288  IPNAT - ok
15:42:27.0433 4288  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
15:42:27.0495 4288  IRENUM - ok
15:42:27.0511 4288  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\DRIVERS\isapnp.sys
15:42:27.0542 4288  isapnp - ok
15:42:27.0557 4288  [ FA4D2557DE56D45B0A346F93564BE6E1 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
15:42:27.0589 4288  iScsiPrt - ok
15:42:27.0635 4288  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
15:42:27.0651 4288  kbdclass - ok
15:42:27.0667 4288  [ 6DEF98F8541E1B5DCEB2C822A11F7323 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
15:42:27.0698 4288  kbdhid - ok
15:42:27.0713 4288  [ 156F6159457D0AA7E59B62681B56EB90 ] KeyIso          C:\Windows\system32\lsass.exe
15:42:27.0729 4288  KeyIso - ok
15:42:27.0791 4288  [ 4F4B5FDE429416877DE7143044582EB5 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
15:42:27.0807 4288  KSecDD - ok
15:42:27.0823 4288  [ 6F40465A44ECDC1731BEFAFEC5BDD03C ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
15:42:27.0838 4288  KSecPkg - ok
15:42:27.0869 4288  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
15:42:27.0932 4288  ksthunk - ok
15:42:27.0979 4288  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll
15:42:28.0057 4288  KtmRm - ok
15:42:28.0088 4288  [ 81F1D04D4D0E433099365127375FD501 ] LanmanServer    C:\Windows\system32\srvsvc.dll
15:42:28.0103 4288  LanmanServer - ok
15:42:28.0135 4288  [ 27026EAC8818E8A6C00A1CAD2F11D29A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
15:42:28.0228 4288  LanmanWorkstation - ok
15:42:28.0244 4288  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
15:42:28.0322 4288  lltdio - ok
15:42:28.0353 4288  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll
15:42:28.0431 4288  lltdsvc - ok
15:42:28.0447 4288  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll
15:42:28.0525 4288  lmhosts - ok
15:42:28.0571 4288  [ 5460828F8951D310B42B442877603B8D ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
15:42:28.0603 4288  LMS - ok
15:42:28.0618 4288  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
15:42:28.0634 4288  LSI_FC - ok
15:42:28.0649 4288  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
15:42:28.0665 4288  LSI_SAS - ok
15:42:28.0681 4288  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
15:42:28.0681 4288  LSI_SAS2 - ok
15:42:28.0696 4288  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
15:42:28.0696 4288  LSI_SCSI - ok
15:42:28.0743 4288  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys
15:42:28.0821 4288  luafv - ok
15:42:28.0852 4288  [ 275733EC8CAF681C55BB1A3ED99C864D ] MADFUAUDIOPHILE C:\Windows\system32\DRIVERS\MAudioAudiophile_DFU.sys
15:42:28.0868 4288  MADFUAUDIOPHILE - ok
15:42:28.0930 4288  [ 18BD7FC87A2B898A07D9E8BA9E318E78 ] MAUSBAUDIOPHILE C:\Windows\system32\DRIVERS\MAudioAudiophile.sys
15:42:28.0961 4288  MAUSBAUDIOPHILE - ok
15:42:29.0008 4288  [ F84C8F1000BC11E3B7B23CBD3BAFF111 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
15:42:29.0039 4288  Mcx2Svc - ok
15:42:29.0055 4288  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
15:42:29.0071 4288  megasas - ok
15:42:29.0086 4288  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
15:42:29.0102 4288  MegaSR - ok
15:42:29.0133 4288  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll
15:42:29.0211 4288  MMCSS - ok
15:42:29.0227 4288  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys
15:42:29.0305 4288  Modem - ok
15:42:29.0320 4288  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
15:42:29.0336 4288  monitor - ok
15:42:29.0383 4288  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
15:42:29.0398 4288  mouclass - ok
15:42:29.0414 4288  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
15:42:29.0429 4288  mouhid - ok
15:42:29.0461 4288  [ 791AF66C4D0E7C90A3646066386FB571 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
15:42:29.0461 4288  mountmgr - ok
15:42:29.0476 4288  [ 609D1D87649ECC19796F4D76D4C15CEA ] mpio            C:\Windows\system32\DRIVERS\mpio.sys
15:42:29.0476 4288  mpio - ok
15:42:29.0523 4288  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
15:42:29.0601 4288  mpsdrv - ok
15:42:29.0617 4288  [ 30524261BB51D96D6FCBAC20C810183C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
15:42:29.0663 4288  MRxDAV - ok
15:42:29.0695 4288  [ 040D62A9D8AD28922632137ACDD984F2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
15:42:29.0726 4288  mrxsmb - ok
15:42:29.0757 4288  [ F0067552F8F9B33D7C59403AB808A3CB ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:42:29.0804 4288  mrxsmb10 - ok
15:42:29.0835 4288  [ 3C142D31DE9F2F193218A53FE2632051 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:42:29.0882 4288  mrxsmb20 - ok
15:42:29.0897 4288  [ BCCF16D5FB1109162380E3E28DC9E4E5 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys
15:42:29.0929 4288  msahci - ok
15:42:29.0944 4288  [ 8D27B597229AED79430FB9DB3BCBFBD0 ] msdsm           C:\Windows\system32\DRIVERS\msdsm.sys
15:42:29.0960 4288  msdsm - ok
15:42:29.0975 4288  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe
15:42:30.0022 4288  MSDTC - ok
15:42:30.0069 4288  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
15:42:30.0116 4288  Msfs - ok
15:42:30.0131 4288  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
15:42:30.0209 4288  mshidkmdf - ok
15:42:30.0225 4288  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\DRIVERS\msisadrv.sys
15:42:30.0241 4288  msisadrv - ok
15:42:30.0256 4288  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
15:42:30.0350 4288  MSiSCSI - ok
15:42:30.0350 4288  msiserver - ok
15:42:30.0365 4288  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
15:42:30.0443 4288  MSKSSRV - ok
15:42:30.0475 4288  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
15:42:30.0537 4288  MSPCLOCK - ok
15:42:30.0568 4288  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
15:42:30.0646 4288  MSPQM - ok
15:42:30.0662 4288  [ 89CB141AA8616D8C6A4610FA26C60964 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
15:42:30.0677 4288  MsRPC - ok
15:42:30.0709 4288  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
15:42:30.0709 4288  mssmbios - ok
15:42:30.0740 4288  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
15:42:30.0818 4288  MSTEE - ok
15:42:30.0833 4288  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
15:42:30.0880 4288  MTConfig - ok
15:42:30.0911 4288  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys
15:42:30.0927 4288  Mup - ok
15:42:30.0958 4288  [ 4987E079A4530FA737A128BE54B63B12 ] napagent        C:\Windows\system32\qagentRT.dll
15:42:31.0021 4288  napagent - ok
15:42:31.0036 4288  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
15:42:31.0067 4288  NativeWifiP - ok
15:42:31.0099 4288  [ CAD515DBD07D082BB317D9928CE8962C ] NDIS            C:\Windows\system32\drivers\ndis.sys
15:42:31.0145 4288  NDIS - ok
15:42:31.0161 4288  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
15:42:31.0223 4288  NdisCap - ok
15:42:31.0223 4288  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
15:42:31.0270 4288  NdisTapi - ok
15:42:31.0286 4288  [ F105BA1E22BF1F2EE8F005D4305E4BEC ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
15:42:31.0348 4288  Ndisuio - ok
15:42:31.0379 4288  [ 557DFAB9CA1FCB036AC77564C010DAD3 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
15:42:31.0442 4288  NdisWan - ok
15:42:31.0442 4288  [ 659B74FB74B86228D6338D643CD3E3CF ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
15:42:31.0520 4288  NDProxy - ok
15:42:31.0535 4288  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
15:42:31.0613 4288  NetBIOS - ok
15:42:31.0645 4288  [ 9162B273A44AB9DCE5B44362731D062A ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
15:42:31.0738 4288  NetBT - ok
15:42:31.0754 4288  [ 156F6159457D0AA7E59B62681B56EB90 ] Netlogon        C:\Windows\system32\lsass.exe
15:42:31.0769 4288  Netlogon - ok
15:42:31.0801 4288  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
15:42:31.0879 4288  Netman - ok
15:42:31.0894 4288  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
15:42:31.0941 4288  netprofm - ok
15:42:31.0972 4288  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
15:42:31.0988 4288  NetTcpPortSharing - ok
15:42:32.0003 4288  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
15:42:32.0019 4288  nfrd960 - ok
15:42:32.0066 4288  [ D9A0CE66046D6EFA0C61BAA885CBA0A8 ] NlaSvc          C:\Windows\System32\nlasvc.dll
15:42:32.0128 4288  NlaSvc - ok
15:42:32.0159 4288  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
15:42:32.0222 4288  Npfs - ok
15:42:32.0253 4288  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll
15:42:32.0331 4288  nsi - ok
15:42:32.0347 4288  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
15:42:32.0440 4288  nsiproxy - ok
15:42:32.0503 4288  [ 378E0E0DFEA67D98AE6EA53ADBBD76BC ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
15:42:32.0549 4288  Ntfs - ok
15:42:32.0565 4288  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
15:42:32.0627 4288  Null - ok
15:42:32.0659 4288  [ A4D9C9A608A97F59307C2F2600EDC6A4 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
15:42:32.0674 4288  nvraid - ok
15:42:32.0690 4288  [ 6C1D5F70E7A6A3FD1C90D840EDC048B9 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
15:42:32.0721 4288  nvstor - ok
15:42:32.0737 4288  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\DRIVERS\nv_agp.sys
15:42:32.0752 4288  nv_agp - ok
15:42:32.0768 4288  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
15:42:32.0783 4288  ohci1394 - ok
15:42:32.0846 4288  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
15:42:32.0877 4288  ose - ok
15:42:33.0002 4288  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
15:42:33.0080 4288  osppsvc - ok
15:42:33.0127 4288  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
15:42:33.0158 4288  p2pimsvc - ok
15:42:33.0189 4288  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
15:42:33.0236 4288  p2psvc - ok
15:42:33.0267 4288  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
15:42:33.0314 4288  Parport - ok
15:42:33.0329 4288  [ 7DAA117143316C4A1537E074A5A9EAF0 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
15:42:33.0345 4288  partmgr - ok
15:42:33.0361 4288  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
15:42:33.0407 4288  PcaSvc - ok
15:42:33.0439 4288  [ F36F6504009F2FB0DFD1B17A116AD74B ] pci             C:\Windows\system32\DRIVERS\pci.sys
15:42:33.0439 4288  pci - ok
15:42:33.0470 4288  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\DRIVERS\pciide.sys
15:42:33.0470 4288  pciide - ok
15:42:33.0501 4288  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
15:42:33.0517 4288  pcmcia - ok
15:42:33.0532 4288  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys
15:42:33.0532 4288  pcw - ok
15:42:33.0579 4288  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
15:42:33.0673 4288  PEAUTH - ok
15:42:33.0766 4288  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
15:42:33.0797 4288  PerfHost - ok
15:42:33.0860 4288  [ 557E9A86F65F0DE18C9B6751DFE9D3F1 ] pla             C:\Windows\system32\pla.dll
15:42:33.0938 4288  pla - ok
15:42:33.0985 4288  [ 98B1721B8718164293B9701B98C52D77 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
15:42:34.0016 4288  PlugPlay - ok
15:42:34.0047 4288  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
15:42:34.0078 4288  PNRPAutoReg - ok
15:42:34.0109 4288  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
15:42:34.0141 4288  PNRPsvc - ok
15:42:34.0219 4288  [ 166EB40D1F5B47E615DE3D0FFFE5F243 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
15:42:34.0297 4288  PolicyAgent - ok
15:42:34.0328 4288  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll
15:42:34.0406 4288  Power - ok
15:42:34.0437 4288  [ 27CC19E81BA5E3403C48302127BDA717 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
15:42:34.0515 4288  PptpMiniport - ok
15:42:34.0546 4288  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys
15:42:34.0593 4288  Processor - ok
15:42:34.0624 4288  [ 97293447431311C06703368AD0F6C4BE ] ProfSvc         C:\Windows\system32\profsvc.dll
15:42:34.0655 4288  ProfSvc - ok
15:42:34.0655 4288  [ 156F6159457D0AA7E59B62681B56EB90 ] ProtectedStorage C:\Windows\system32\lsass.exe
15:42:34.0671 4288  ProtectedStorage - ok
15:42:34.0687 4288  [ EE992183BD8EAEFD9973F352E587A299 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
15:42:34.0780 4288  Psched - ok
15:42:34.0827 4288  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
15:42:34.0858 4288  ql2300 - ok
15:42:34.0874 4288  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
15:42:34.0889 4288  ql40xx - ok
15:42:34.0921 4288  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll
15:42:34.0936 4288  QWAVE - ok
15:42:34.0952 4288  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
15:42:34.0999 4288  QWAVEdrv - ok
15:42:35.0061 4288  [ A55E7D0D873B2C97585B3B5926AC6ADE ] RapiMgr         C:\Windows\WindowsMobile\rapimgr.dll
15:42:35.0092 4288  RapiMgr - ok
15:42:35.0123 4288  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
15:42:35.0155 4288  RasAcd - ok
15:42:35.0186 4288  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
15:42:35.0279 4288  RasAgileVpn - ok
15:42:35.0295 4288  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll
15:42:35.0357 4288  RasAuto - ok
15:42:35.0389 4288  [ 87A6E852A22991580D6D39ADC4790463 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
15:42:35.0420 4288  Rasl2tp - ok
15:42:35.0435 4288  [ 47394ED3D16D053F5906EFE5AB51CC83 ] RasMan          C:\Windows\System32\rasmans.dll
15:42:35.0513 4288  RasMan - ok
15:42:35.0529 4288  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
15:42:35.0607 4288  RasPppoe - ok
15:42:35.0623 4288  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
15:42:35.0701 4288  RasSstp - ok
15:42:35.0732 4288  [ 3BAC8142102C15D59A87757C1D41DCE5 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
15:42:35.0794 4288  rdbss - ok
15:42:35.0794 4288  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
15:42:35.0841 4288  rdpbus - ok
15:42:35.0857 4288  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
15:42:35.0903 4288  RDPCDD - ok
15:42:35.0919 4288  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
15:42:35.0966 4288  RDPENCDD - ok
15:42:36.0013 4288  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
15:42:36.0059 4288  RDPREFMP - ok
15:42:36.0091 4288  [ 074AC702D8B8B660B0E1371555995386 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
15:42:36.0137 4288  RDPWD - ok
15:42:36.0169 4288  [ 634B9A2181D98F15941236886164EC8B ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
15:42:36.0169 4288  rdyboost - ok
15:42:36.0200 4288  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
15:42:36.0293 4288  RemoteAccess - ok
15:42:36.0325 4288  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
15:42:36.0403 4288  RemoteRegistry - ok
15:42:36.0465 4288  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
15:42:36.0512 4288  RFCOMM - ok
15:42:36.0527 4288  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
15:42:36.0605 4288  RpcEptMapper - ok
15:42:36.0637 4288  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
15:42:36.0668 4288  RpcLocator - ok
15:42:36.0715 4288  [ 7266972E86890E2B30C0C322E906B027 ] RpcSs           C:\Windows\system32\rpcss.dll
15:42:36.0793 4288  RpcSs - ok
15:42:36.0808 4288  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
15:42:36.0855 4288  rspndr - ok
15:42:36.0902 4288  [ 30F463768D5143BFD7B2DF822B53CF4D ] RSUSBSTOR       C:\Windows\system32\Drivers\RtsUStor.sys
15:42:36.0933 4288  RSUSBSTOR - ok
15:42:36.0964 4288  [ FD978B2BF8A9B2390DCBEF435E9C1F9F ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
15:42:36.0995 4288  RTL8167 - ok
15:42:37.0011 4288  [ 156F6159457D0AA7E59B62681B56EB90 ] SamSs           C:\Windows\system32\lsass.exe
15:42:37.0027 4288  SamSs - ok
15:42:37.0042 4288  [ E3BBB89983DAF5622C1D50CF49F28227 ] sbp2port        C:\Windows\system32\DRIVERS\sbp2port.sys
15:42:37.0042 4288  sbp2port - ok
15:42:37.0073 4288  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
15:42:37.0136 4288  SCardSvr - ok
15:42:37.0151 4288  [ C94DA20C7E3BA1DCA269BC8460D98387 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
15:42:37.0229 4288  scfilter - ok
15:42:37.0292 4288  [ 624D0F5FF99428BB90A5B8A4123E918E ] Schedule        C:\Windows\system32\schedsvc.dll
15:42:37.0339 4288  Schedule - ok
15:42:37.0354 4288  [ 312E2F82AF11E79906898AC3E3D58A1F ] SCPolicySvc     C:\Windows\System32\certprop.dll
15:42:37.0417 4288  SCPolicySvc - ok
15:42:37.0432 4288  [ 765A27C3279CE11D14CB9E4F5869FCA5 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
15:42:37.0448 4288  SDRSVC - ok
15:42:37.0495 4288  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
15:42:37.0573 4288  secdrv - ok
15:42:37.0604 4288  [ 463B386EBC70F98DA5DFF85F7E654346 ] seclogon        C:\Windows\system32\seclogon.dll
15:42:37.0682 4288  seclogon - ok
15:42:37.0697 4288  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
15:42:37.0775 4288  SENS - ok
15:42:37.0807 4288  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
15:42:37.0838 4288  SensrSvc - ok
15:42:37.0853 4288  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
15:42:37.0869 4288  Serenum - ok
15:42:37.0900 4288  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
15:42:37.0916 4288  Serial - ok
15:42:37.0931 4288  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
15:42:37.0947 4288  sermouse - ok
15:42:37.0963 4288  [ C3BC61CE47FF6F4E88AB8A3B429A36AF ] SessionEnv      C:\Windows\system32\sessenv.dll
15:42:38.0009 4288  SessionEnv - ok
15:42:38.0025 4288  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\DRIVERS\sffdisk.sys
15:42:38.0072 4288  sffdisk - ok
15:42:38.0087 4288  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\DRIVERS\sffp_mmc.sys
15:42:38.0134 4288  sffp_mmc - ok
15:42:38.0165 4288  [ 178298F767FE638C9FEDCBDEF58BB5E4 ] sffp_sd         C:\Windows\system32\DRIVERS\sffp_sd.sys
15:42:38.0181 4288  sffp_sd - ok
15:42:38.0212 4288  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
15:42:38.0243 4288  sfloppy - ok
15:42:38.0306 4288  [ C6CC9297BD53E5229653303E556AA539 ] Sftfs           C:\Windows\system32\DRIVERS\Sftfslh.sys
15:42:38.0337 4288  Sftfs - ok
15:42:38.0446 4288  [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist         C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
15:42:38.0462 4288  sftlist - ok
15:42:38.0477 4288  [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay         C:\Windows\system32\DRIVERS\Sftplaylh.sys
15:42:38.0493 4288  Sftplay - ok
15:42:38.0524 4288  [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir        C:\Windows\system32\DRIVERS\Sftredirlh.sys
15:42:38.0540 4288  Sftredir - ok
15:42:38.0618 4288  [ CF53DCCE55E500F51089774E851E7363 ] SftService      C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
15:42:38.0649 4288  SftService - ok
15:42:38.0680 4288  [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol          C:\Windows\system32\DRIVERS\Sftvollh.sys
15:42:38.0696 4288  Sftvol - ok
15:42:38.0696 4288  [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa          C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
15:42:38.0711 4288  sftvsa - ok
15:42:38.0774 4288  [ 0298AC45D0EFFFB2DB4BAA7DD186E7BF ] ShellHWDetection C:\Windows\System32\shsvcs.dll
15:42:38.0821 4288  ShellHWDetection - ok
15:42:38.0836 4288  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
15:42:38.0852 4288  SiSRaid2 - ok
15:42:38.0867 4288  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
15:42:38.0867 4288  SiSRaid4 - ok
15:42:38.0899 4288  SkypeUpdate - ok
15:42:38.0930 4288  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
15:42:38.0992 4288  Smb - ok
15:42:39.0008 4288  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
15:42:39.0039 4288  SNMPTRAP - ok
15:42:39.0070 4288  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys
15:42:39.0070 4288  spldr - ok
15:42:39.0117 4288  [ 567977DC43CC13C4C35ED7084C0B84D5 ] Spooler         C:\Windows\System32\spoolsv.exe
15:42:39.0133 4288  Spooler - ok
15:42:39.0226 4288  [ 913D843498553A1BC8F8DBAD6358E49F ] sppsvc          C:\Windows\system32\sppsvc.exe
15:42:39.0289 4288  sppsvc - ok
15:42:39.0320 4288  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
15:42:39.0413 4288  sppuinotify - ok
15:42:39.0460 4288  [ D630B6F2E8379B6F10DC16E82A426552 ] sprtsvc_DellSupportCenter C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
15:42:39.0491 4288  sprtsvc_DellSupportCenter - ok
15:42:39.0538 4288  [ 2408C0366D96BCDF63E8F1C78E4A29C5 ] srv             C:\Windows\system32\DRIVERS\srv.sys
15:42:39.0585 4288  srv - ok
15:42:39.0616 4288  [ 76548F7B818881B47D8D1AE1BE9C11F8 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
15:42:39.0663 4288  srv2 - ok
15:42:39.0694 4288  [ 0AF6E19D39C70844C5CAA8FB0183C36E ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
15:42:39.0725 4288  srvnet - ok
15:42:39.0757 4288  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
15:42:39.0803 4288  SSDPSRV - ok
15:42:39.0819 4288  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll
15:42:39.0897 4288  SstpSvc - ok
15:42:39.0944 4288  [ 463E33B1EA7AF1E6EB87B66B831DB41A ] STacSV          C:\Program Files\IDT\WDM\STacSV64.exe
15:42:39.0991 4288  STacSV - ok
15:42:40.0022 4288  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
15:42:40.0037 4288  stexstor - ok
15:42:40.0084 4288  [ 4304B75094E106FB5423A290C95841E5 ] STHDA           C:\Windows\system32\DRIVERS\stwrt64.sys
15:42:40.0131 4288  STHDA - ok
15:42:40.0178 4288  [ 52D0E33B681BD0F33FDC08812FEE4F7D ] stisvc          C:\Windows\System32\wiaservc.dll
15:42:40.0225 4288  stisvc - ok
15:42:40.0240 4288  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
15:42:40.0256 4288  swenum - ok
15:42:40.0287 4288  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll
15:42:40.0381 4288  swprv - ok
15:42:40.0412 4288  [ 8A3FBCB3D6D4710730D27DA4392A4863 ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys
15:42:40.0443 4288  SynTP - ok
15:42:40.0490 4288  [ 3C1284516A62078FB68F768DE4F1A7BE ] SysMain         C:\Windows\system32\sysmain.dll
15:42:40.0583 4288  SysMain - ok
15:42:40.0615 4288  [ 238935C3CF2854886DC7CBB2A0E2CC66 ] TabletInputService C:\Windows\System32\TabSvc.dll
15:42:40.0661 4288  TabletInputService - ok
15:42:40.0708 4288  [ 884264AC597B690C5707C89723BB8E7B ] TapiSrv         C:\Windows\System32\tapisrv.dll
15:42:40.0786 4288  TapiSrv - ok
15:42:40.0817 4288  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll
15:42:40.0880 4288  TBS - ok
15:42:40.0958 4288  [ 624C5B3AA4C99B3184BB922D9ECE3FF0 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
15:42:41.0020 4288  Tcpip - ok
15:42:41.0036 4288  [ 624C5B3AA4C99B3184BB922D9ECE3FF0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
15:42:41.0083 4288  TCPIP6 - ok
15:42:41.0098 4288  [ 76D078AF6F587B162D50210F761EB9ED ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
15:42:41.0176 4288  tcpipreg - ok
15:42:41.0207 4288  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
15:42:41.0239 4288  TDPIPE - ok
15:42:41.0270 4288  [ 7518F7BCFD4B308ABC9192BACAF6C970 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
15:42:41.0301 4288  TDTCP - ok
15:42:41.0348 4288  [ 079125C4B17B01FCAEEBCE0BCB290C0F ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
15:42:41.0426 4288  tdx - ok
15:42:41.0441 4288  [ C448651339196C0E869A355171875522 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
15:42:41.0457 4288  TermDD - ok
15:42:41.0473 4288  [ 0F05EC2887BFE197AD82A13287D2F404 ] TermService     C:\Windows\System32\termsrv.dll
15:42:41.0519 4288  TermService - ok
15:42:41.0535 4288  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
15:42:41.0551 4288  Themes - ok
15:42:41.0566 4288  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll
15:42:41.0613 4288  THREADORDER - ok
15:42:41.0629 4288  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
15:42:41.0722 4288  TrkWks - ok
15:42:41.0769 4288  [ 840F7FB849F5887A49BA18C13B2DA920 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
15:42:41.0816 4288  TrustedInstaller - ok
15:42:41.0831 4288  [ 61B96C26131E37B24E93327A0BD1FB95 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
15:42:41.0909 4288  tssecsrv - ok
15:42:41.0941 4288  [ 3836171A2CDF3AF8EF10856DB9835A70 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
15:42:42.0003 4288  tunnel - ok
15:42:42.0034 4288  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
15:42:42.0034 4288  uagp35 - ok
15:42:42.0065 4288  [ 31BA4A33AFAB6A69EA092B18017F737F ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
15:42:42.0112 4288  udfs - ok
15:42:42.0143 4288  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
15:42:42.0175 4288  UI0Detect - ok
15:42:42.0206 4288  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\DRIVERS\uliagpkx.sys
15:42:42.0206 4288  uliagpkx - ok
15:42:42.0237 4288  [ EAB6C35E62B1B0DB0D1B48B671D3A117 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
15:42:42.0237 4288  umbus - ok
15:42:42.0253 4288  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
15:42:42.0268 4288  UmPass - ok
15:42:42.0377 4288  [ 9E89C2D6945389270DE067CE51FF7425 ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
15:42:42.0440 4288  UNS - ok
15:42:42.0471 4288  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
15:42:42.0533 4288  upnphost - ok
15:42:42.0596 4288  [ 77B01BC848298223A95D4EC23E1785A1 ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
15:42:42.0643 4288  usbaudio - ok
15:42:42.0689 4288  [ 537A4E03D7103C12D42DFD8FFDB5BDC9 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
15:42:42.0736 4288  usbccgp - ok
15:42:42.0767 4288  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\DRIVERS\usbcir.sys
15:42:42.0814 4288  usbcir - ok
15:42:42.0845 4288  [ FBB21EBE49F6D560DB37AC25FBC68E66 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
15:42:42.0877 4288  usbehci - ok
15:42:42.0908 4288  [ 6B7A8A99C4A459E73C286A6763EA24CC ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
15:42:42.0955 4288  usbhub - ok
15:42:43.0001 4288  [ 8C88AA7617B4CBC2E4BED61D26B33A27 ] usbohci         C:\Windows\system32\drivers\usbohci.sys
15:42:43.0017 4288  usbohci - ok
15:42:43.0048 4288  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
15:42:43.0095 4288  usbprint - ok
15:42:43.0111 4288  [ F39983647BC1F3E6100778DDFE9DCE29 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:42:43.0157 4288  USBSTOR - ok
15:42:43.0204 4288  [ 0B5B3B2DF3FD1709618ACFA50B8392B0 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
15:42:43.0220 4288  usbuhci - ok
15:42:43.0251 4288  [ 7CB8C573C6E4A2714402CC0A36EAB4FE ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
15:42:43.0298 4288  usbvideo - ok
15:42:43.0329 4288  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll
15:42:43.0376 4288  UxSms - ok
15:42:43.0391 4288  [ 156F6159457D0AA7E59B62681B56EB90 ] VaultSvc        C:\Windows\system32\lsass.exe
15:42:43.0391 4288  VaultSvc - ok
15:42:43.0407 4288  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\DRIVERS\vdrvroot.sys
15:42:43.0407 4288  vdrvroot - ok
15:42:43.0423 4288  [ 44D73E0BBC1D3C8981304BA15135C2F2 ] vds             C:\Windows\System32\vds.exe
15:42:43.0438 4288  vds - ok
15:42:43.0485 4288  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
15:42:43.0516 4288  vga - ok
15:42:43.0532 4288  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys
15:42:43.0579 4288  VgaSave - ok
15:42:43.0625 4288  [ C82E748660F62A242B2DFAC1442F22A4 ] vhdmp           C:\Windows\system32\DRIVERS\vhdmp.sys
15:42:43.0657 4288  vhdmp - ok
15:42:43.0672 4288  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\DRIVERS\viaide.sys
15:42:43.0703 4288  viaide - ok
15:42:43.0719 4288  [ 2B1A3DAE2B4E70DBBA822B7A03FBD4A3 ] volmgr          C:\Windows\system32\DRIVERS\volmgr.sys
15:42:43.0735 4288  volmgr - ok
15:42:43.0766 4288  [ 99B0CBB569CA79ACAED8C91461D765FB ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
15:42:43.0797 4288  volmgrx - ok
15:42:43.0828 4288  [ 58F82EED8CA24B461441F9C3E4F0BF5C ] volsnap         C:\Windows\system32\DRIVERS\volsnap.sys
15:42:43.0844 4288  volsnap - ok
15:42:43.0859 4288  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
15:42:43.0859 4288  vsmraid - ok
15:42:43.0891 4288  [ 787898BF9FB6D7BD87A36E2D95C899BA ] VSS             C:\Windows\system32\vssvc.exe
15:42:43.0937 4288  VSS - ok
15:42:43.0953 4288  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
15:42:43.0969 4288  vwifibus - ok
15:42:44.0000 4288  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
15:42:44.0047 4288  vwififlt - ok
15:42:44.0078 4288  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
15:42:44.0125 4288  vwifimp - ok
15:42:44.0156 4288  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll
15:42:44.0234 4288  W32Time - ok
15:42:44.0249 4288  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
15:42:44.0281 4288  WacomPen - ok
15:42:44.0312 4288  [ 47CA49400643EFFD3F1C9A27E1D69324 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
15:42:44.0359 4288  WANARP - ok
15:42:44.0359 4288  [ 47CA49400643EFFD3F1C9A27E1D69324 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
15:42:44.0405 4288  Wanarpv6 - ok
15:42:44.0468 4288  [ 5AB1BB85BD8B5089CC5D64200DEDAE68 ] wbengine        C:\Windows\system32\wbengine.exe
15:42:44.0530 4288  wbengine - ok
15:42:44.0561 4288  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
15:42:44.0608 4288  WbioSrvc - ok
15:42:44.0686 4288  [ 8BDA6DB43AA54E8BB5E0794541DDC209 ] WcesComm        C:\Windows\WindowsMobile\wcescomm.dll
15:42:44.0702 4288  WcesComm - ok
15:42:44.0764 4288  [ DD1BAE8EBFC653824D29CCF8C9054D68 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
15:42:44.0795 4288  wcncsvc - ok
15:42:44.0827 4288  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
15:42:44.0858 4288  WcsPlugInService - ok
15:42:44.0889 4288  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
15:42:44.0889 4288  Wd - ok
15:42:44.0936 4288  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
15:42:44.0951 4288  Wdf01000 - ok
15:42:44.0967 4288  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
15:42:45.0014 4288  WdiServiceHost - ok
15:42:45.0014 4288  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll
15:42:45.0029 4288  WdiSystemHost - ok
15:42:45.0061 4288  [ 733006127F235BE7C35354EBEE7B9A7B ] WebClient       C:\Windows\System32\webclnt.dll
15:42:45.0092 4288  WebClient - ok
15:42:45.0107 4288  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
15:42:45.0185 4288  Wecsvc - ok
15:42:45.0217 4288  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
15:42:45.0295 4288  wercplsupport - ok
15:42:45.0295 4288  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
15:42:45.0388 4288  WerSvc - ok
15:42:45.0419 4288  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
15:42:45.0482 4288  WfpLwf - ok
15:42:45.0513 4288  [ B14EF15BD757FA488F9C970EEE9C0D35 ] WimFltr         C:\Windows\system32\DRIVERS\wimfltr.sys
15:42:45.0544 4288  WimFltr - ok
15:42:45.0560 4288  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
15:42:45.0575 4288  WIMMount - ok
15:42:45.0575 4288  WinHttpAutoProxySvc - ok
15:42:45.0653 4288  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
15:42:45.0716 4288  Winmgmt - ok
15:42:45.0794 4288  [ 41FBB751936B387F9179E7F03A74FE29 ] WinRM           C:\Windows\system32\WsmSvc.dll
15:42:45.0872 4288  WinRM - ok
15:42:45.0919 4288  [ 4D52C872018AF7E18D078978DCC3F6F2 ] WINUSB          C:\Windows\system32\DRIVERS\WinUSB.SYS
15:42:45.0965 4288  WINUSB - ok
15:42:46.0012 4288  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll
15:42:46.0043 4288  Wlansvc - ok
15:42:46.0075 4288  [ DE816A0624D54D68E1FB8A9028DCF81A ] wltrysvc        C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
15:42:46.0106 4288  wltrysvc ( UnsignedFile.Multi.Generic ) - warning
15:42:46.0106 4288  wltrysvc - detected UnsignedFile.Multi.Generic (1)
15:42:46.0137 4288  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
15:42:46.0168 4288  WmiAcpi - ok
15:42:46.0184 4288  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
15:42:46.0231 4288  wmiApSrv - ok
15:42:46.0262 4288  WMPNetworkSvc - ok
15:42:46.0262 4288  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
15:42:46.0293 4288  WPCSvc - ok
15:42:46.0293 4288  [ 2E57DDF2880A7E52E76F41C7E96D327B ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
15:42:46.0340 4288  WPDBusEnum - ok
15:42:46.0387 4288  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
15:42:46.0480 4288  ws2ifsl - ok
15:42:46.0480 4288  WSearch - ok
15:42:46.0558 4288  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
15:42:46.0621 4288  wuauserv - ok
15:42:46.0636 4288  [ C63907207B837A5C05CF6D1606AA0008 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
15:42:46.0683 4288  WudfPf - ok
15:42:46.0714 4288  [ D885A873D733020F8B9B9FF4B1666158 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
15:42:46.0745 4288  WUDFRd - ok
15:42:46.0777 4288  [ 27B9BEE5AAC00139E3A3AF5D6227A0DC ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
15:42:46.0792 4288  wudfsvc - ok
15:42:46.0823 4288  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\Windows\System32\wwansvc.dll
15:42:46.0886 4288  WwanSvc - ok
15:42:46.0917 4288  [ B3EEACF62445E24FBB2CD4B0FB4DB026 ] yukonw7         C:\Windows\system32\DRIVERS\yk62x64.sys
15:42:46.0964 4288  yukonw7 - ok
15:42:47.0011 4288  ================ Scan global ===============================
15:42:47.0042 4288  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
15:42:47.0089 4288  [ 0CB6EBF4B461A6043353C570BD72A1E1 ] C:\Windows\system32\winsrv.dll
15:42:47.0104 4288  [ 0CB6EBF4B461A6043353C570BD72A1E1 ] C:\Windows\system32\winsrv.dll
15:42:47.0120 4288  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
15:42:47.0151 4288  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
15:42:47.0151 4288  [Global] - ok
15:42:47.0151 4288  ================ Scan MBR ==================================
15:42:47.0182 4288  [ C3220EB08ADD62E3ED9F72A1F4E4B1BB ] \Device\Harddisk0\DR0
15:42:47.0432 4288  \Device\Harddisk0\DR0 - ok
15:42:47.0447 4288  [ 3A7E2AEE1DC550181AC42147A483A517 ] \Device\Harddisk1\DR2
15:42:47.0572 4288  \Device\Harddisk1\DR2 - ok
15:42:47.0572 4288  ================ Scan VBR ==================================
15:42:47.0572 4288  [ B4A651EA79A9998884DA67ECFFB5E2E7 ] \Device\Harddisk0\DR0\Partition1
15:42:47.0572 4288  \Device\Harddisk0\DR0\Partition1 - ok
15:42:47.0603 4288  [ 723FFEBDE086355CE5F5C8E20D4FDB4A ] \Device\Harddisk0\DR0\Partition2
15:42:47.0603 4288  \Device\Harddisk0\DR0\Partition2 - ok
15:42:47.0619 4288  [ 461AA706512C16E0D3EF07225D588BF2 ] \Device\Harddisk1\DR2\Partition1
15:42:47.0619 4288  \Device\Harddisk1\DR2\Partition1 - ok
15:42:47.0619 4288  ============================================================
15:42:47.0619 4288  Scan finished
15:42:47.0619 4288  ============================================================
15:42:47.0635 4396  Detected object count: 3
15:42:47.0635 4396  Actual detected object count: 3
15:43:42.0890 4396  AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - skipped by user
15:43:42.0890 4396  AVM WLAN Connection Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:43:42.0890 4396  DockLoginService ( UnsignedFile.Multi.Generic ) - skipped by user
15:43:42.0890 4396  DockLoginService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:43:42.0890 4396  wltrysvc ( UnsignedFile.Multi.Generic ) - skipped by user
15:43:42.0890 4396  wltrysvc ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:43:46.0883 1260  Deinitialize success

Was soll ich tun?

markusg · 09.07.2013, 17:08

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Baulller · 09.07.2013, 21:58

So, habs endlich gepackt...

Code:

ATTFilter

Combofix Logfile:

	Code: 

 ATTFilter

  
	ComboFix 13-07-09.01 - Ali 09.07.2013  22:42:16.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3959.2791 [GMT 2:00]
ausgeführt von:: E:\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Recycle.Bin
c:\recycle.bin\90043EE8B34DBE3
c:\users\2Sample\Roy Ayers - Everybody Loves the Sunshine .mp3
c:\users\Ali\AppData\Roaming\AcroIEHelpe.txt
c:\users\Ali\AppData\Roaming\srvblck2.tmp
c:\users\Ali\AppData\Roaming\srvblck5.tmp
c:\users\PIX\92fd9e1632cdd2a47900099cccf5fa20.jpg
c:\users\******\005.JPG
c:\windows\WindowsUpdate.log
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-06-09 bis 2013-07-09  ))))))))))))))))))))))))))))))
.
.
2013-07-08 23:35 . 2013-07-08 23:35	--------	d-----w-	C:\FRST
2013-07-08 22:14 . 2013-07-09 20:48	--------	d-----w-	c:\windows\system32\wbem\repository
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-06-02 98304]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-05-21 165184]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-12-29 1082656]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-12-16 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 BEHRINGER_PT_MIDI;Behringer MIDI driver service (pt);c:\windows\system32\drivers\bhrngr_m.sys;c:\windows\SYSNATIVE\drivers\bhrngr_m.sys [x]
R3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusbn.sys [x]
R3 MADFUAUDIOPHILE;Service for M-Audio Audiophile DFU;c:\windows\system32\DRIVERS\MAudioAudiophile_DFU.sys;c:\windows\SYSNATIVE\DRIVERS\MAudioAudiophile_DFU.sys [x]
R3 MAUSBAUDIOPHILE;Service for M-Audio Audiophile;c:\windows\system32\DRIVERS\MAudioAudiophile.sys;c:\windows\SYSNATIVE\DRIVERS\MAudioAudiophile.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IGDCTRL;AVM IGD CTRL Service;c:\program files\FRITZ!DSL\IGDCTRL.EXE;c:\program files\FRITZ!DSL\IGDCTRL.EXE [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 BcmVWL;Broadcom Virtual Wireless;c:\windows\system32\DRIVERS\bcmvwl64.sys;c:\windows\SYSNATIVE\DRIVERS\bcmvwl64.sys [x]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys;c:\windows\SYSNATIVE\drivers\btusbflt.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-06-18 487424]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2010-02-03 5712896]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-03 798216]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube Download - c:\users\Ali\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Ali\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Ali\AppData\Roaming\Mozilla\Firefox\Profiles\pj48my79.default\
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Ysvumyuvk - c:\users\Ali\AppData\Roaming\Ucvetu\esbe.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\avmwlanstick\WlanNetService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
c:\program files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
c:\program files (x86)\Dell Support Center\bin\sprtsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-07-09  22:53:10 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-07-09 20:53
.
Vor Suchlauf: 26 Verzeichnis(se), 348.365.025.280 Bytes frei
Nach Suchlauf: 31 Verzeichnis(se), 352.847.470.592 Bytes frei
.
- - End Of File - - 274EDC37442A0DEC8CC0474E8A5ACD5D
         
 --- --- ---
D41D8CD98F00B204E9800998ECF8427E

GVU / BKA Trojaner Win7, abgesicherter Modus m E-Aufforderung möglich

Plagegeister aller Art und deren Bekämpfung: GVU / BKA Trojaner Win7, abgesicherter Modus m E-Aufforderung möglich