| |
| |||||||
Log-Analyse und Auswertung: Viren gefunden - Logdatei auswertenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.08.2013, 16:48
| #1 |
| |  Viren gefunden - Logdatei auswerten Hallo, wie sich zeigen wird, bin recht unerfahren in solchen Belangen - drum bitte ich um Hilfe.  Ich soll den Laptop eines Bekannten säubern und daher habe ich Malwarebytes laufen lassen. Dieser hat mir 7 Funde präsentiert, die ich (soweit ich das erkenne) in die Quarantäne verschoben habe. Nun weiß ich nicht, ob sich das damit getan hat und der Laptop "rein" ist. Ich habe im Anhang mal die zugehörige LogDatei, die mir das Programm ausgibt, angefügt. Vielen Dank schonmal und Beste Grüße MisterP |
|
05.08.2013, 16:50
| #2 |
| /// Malware-holic   | Viren gefunden - Logdatei auswerten Hi,
__________________gleich werde ich eine Anleitung zu FRST posten, weiterhin eine Zusatzaufgabe für die Additionst.xt, diese musst du mit dem Besitzer erstellen. Empfehlungen fürs Deinstallieren Bitte kopiere die Liste der installierten Programme aus der additions.txt hier in deinen Thread. Notiere mir bitte hinter jede Zeile, ob folgendes Kategorie zutrifft: Unbekannt, Nötig, Unnötig Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
05.08.2013, 17:28
| #3 |
| | Viren gefunden - Logdatei auswerten Das ging ja wirklich schnell. Hier die angeforderten Dateien.
__________________Die Liste der installieren Programme mitsamt der Priorität: (NÖTIG, UNNÖTIG, UNBEKANNT, BEREITS VORINSTALLIERT VON LENOVO) Code:
ATTFilter Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader X (10.1.2) - Deutsch (x32 Version: 10.1.2) AVG SafeGuard toolbar (x32 Version: 15.0.0.2) Avira Free Antivirus (x32 Version: 12.1.9.2400) D3DX10 (x32 Version: 15.4.2368.0902) DAEMON Tools Lite (x32 Version: 4.47.1.0333) Die Sims™ 2 - Erste Schritte (x32) Die Sims™ 3 (x32 Version: 1.26.89) Die Sims™ 3 Einfach tierisch (x32 Version: 10.0.96) Die Sims™ 3 Luxus-Accessoires (x32 Version: 3.0.38) Die Sims™ 3 Traumkarrieren (x32 Version: 4.0.87)[/COLOR] eaner (Version: 4.04) Energy Management (x32 Version: 6.0.2.1) eXtra4 (x32 Version: 1.3.04.001) High-Definition Video Playback (x32 Version: 11.1.11100.4.196) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Processor Graphics (x32 Version: 8.15.10.2342) Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001) Junk Mail filter update (x32 Version: 15.4.3502.0922) Lenovo Bluetooth with Enhanced Data Rate Software (Version: 6.3.0.8000) Lenovo EasyCamera (x32 Version: 1.11.0209.1) Lenovo EE Boot Optimizer (Version: 0.0.1.5) Lenovo Games Console (x32 Version: 1.2.6.436) Lenovo OneKey Recovery (Version: 7.0.1628) Lenovo OneKey Recovery (x32 Version: 7.0.1628) Lenovo YouCam (x32 Version: 3.1.3603) Lenovo_Wireless_Driver (x32 Version: 1.02.01) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Media Finder 1.0.9.40 (x32 Version: 1.0.9.40) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) Nero 11 (x32 Version: 11.2.01000) Nero 11 Disc Menus Basic (x32 Version: 11.0.11200.12.0) Nero 11 Effects Basic (x32 Version: 11.0.11400.14.0) Nero 11 Image Samples (x32 Version: 11.0.11200.12.0) Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0) Nero 11 PiP Effects Basic (x32 Version: 11.0.11400.14.0) Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0) Nero BackItUp 11 (x32 Version: 6.2.18400.2.100) Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200) Nero Backup Drivers (Version: 1.0.11100.8.0) Nero Burning ROM 11 (x32 Version: 11.2.10300.0.0) Nero Burning ROM 11 Help (CHM) (x32 Version: 11.0.10300) Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27) Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300) Nero Core Components 11 (x32 Version: 11.0.16300.1.23) Nero CoverDesigner 11 (x32 Version: 6.0.11000.13.100) Nero CoverDesigner 11 Help (CHM) (x32 Version: 11.0.10300) Nero Express 11 (x32 Version: 11.2.10300.0.0) Nero Express 11 Help (CHM) (x32 Version: 11.0.10300) Nero Kwik Media (x32 Version: 1.14.11600.19.100) Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200) Nero Recode 11 (x32 Version: 5.2.10900.0.0) Nero Recode 11 Help (CHM) (x32 Version: 11.0.10500) Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100) Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400) Nero SharedVideoCodecs (x32 Version: 1.0.11500.1.5) Nero SoundTrax 11 (x32 Version: 5.0.10700.6.100) Nero SoundTrax 11 Help (CHM) (x32 Version: 11.0.10400) Nero Update (x32 Version: 11.0.11500.28.0) Nero Video 11 (x32 Version: 8.2.15700.3.100) Nero Video 11 Help (CHM) (x32 Version: 11.0.10300) Nero WaveEditor 11 (x32 Version: 6.2.11300.0.100) Nero WaveEditor 11 Help (CHM) (x32 Version: 11.0.10400) nero.prerequisites.msi (x32 Version: 11.0.20010) NVIDIA Grafiktreiber 267.54 (Version: 267.54) NVIDIA Install Application (Version: 2.265.39.0) NVIDIA Optimus 1.0.21 (Version: 1.0.21) NVIDIA Systemsteuerung 267.54 (Version: 267.54) NVIDIA Update Components (Version: 1.0.21) Onekey Theater (x32 Version: 2.0.2.7) Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.21.531.2010) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6505) Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7600.10008) Remote Module (x32 Version: 1.00.0000) Skype™ 6.3 (x32 Version: 6.3.105) SopCast 3.5.0 (x32 Version: 3.5.0) Spybot - Search & Destroy (x32 Version: 1.6.2) Synaptics Pointing Device Driver (Version: 15.2.7.0) TeamViewer 7 (x32 Version: 7.0.12979) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Welcome App (Start-up experience) (x32 Version: 11.0.23500.0.0) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3555.0308) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3555.0308) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (Version: 12/02/2010 6.1.0.1) WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0) Anmerkung: Microsoft Live Mail sollte noch funktionieren, daher sind einige der letzten Einträge nötig, leider weiß ich nicht welche genau. |
|
06.08.2013, 16:54
| #4 |
| /// Malware-holic | Viren gefunden - Logdatei auswerten Hi, ich sehe keine Beschriftung?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
06.08.2013, 17:24
| #5 |
| | Viren gefunden - Logdatei auswerten Falls du die Beschriftung der Programme meinst, zu welcher Kategorie ich sie zuordne, so habe ich das farbig dargestellt. Nötig: Grün Unnötig: Blau Unbekannt: Rot Bereits vorinstalliert: Schwarz Hoffe, dass das verständlich ist. |
|
06.08.2013, 17:45
| #6 |
| /// Malware-holic | Viren gefunden - Logdatei auswerten Hi, nein, ich benötige das bitte beschriftet.
__________________ --> Viren gefunden - Logdatei auswerten |
|
07.08.2013, 15:31
| #7 |
| | Viren gefunden - Logdatei auswerten Das war mir nicht bewusst. Hier ist die Liste. Code:
ATTFilter Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Nötig Adobe Reader X (10.1.2) - Deutsch (x32 Version: 10.1.2) Nötig AVG SafeGuard toolbar (x32 Version: 15.0.0.2) Unbekannt Avira Free Antivirus (x32 Version: 12.1.9.2400) Nötig D3DX10 (x32 Version: 15.4.2368.0902) Unbekannt DAEMON Tools Lite (x32 Version: 4.47.1.0333) Nötig Die Sims™ 2 - Erste Schritte (x32) Unnötig Die Sims™ 3 (x32 Version: 1.26.89) Unnötig Die Sims™ 3 Einfach tierisch (x32 Version: 10.0.96) Unnötig Die Sims™ 3 Luxus-Accessoires (x32 Version: 3.0.38) Unnötig Die Sims™ 3 Traumkarrieren (x32 Version: 4.0.87) Unnötig eaner (Version: 4.04) Unbekannt Energy Management (x32 Version: 6.0.2.1) Unbekannt eXtra4 (x32 Version: 1.3.04.001) Nötig High-Definition Video Playback (x32 Version: 11.1.11100.4.196) Unbekannt Intel(R) Control Center (x32 Version: 1.2.1.1007) Nötig Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Nötig Intel(R) Processor Graphics (x32 Version: 8.15.10.2342) Nötig Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001) Nötig Junk Mail filter update (x32 Version: 15.4.3502.0922) Unbekannt Lenovo Bluetooth with Enhanced Data Rate Software (Version: 6.3.0.8000) Nötig Lenovo EasyCamera (x32 Version: 1.11.0209.1) Nötig Lenovo EE Boot Optimizer (Version: 0.0.1.5) Nötig Lenovo Games Console (x32 Version: 1.2.6.436) Nötig Lenovo OneKey Recovery (Version: 7.0.1628) Nötig Lenovo OneKey Recovery (x32 Version: 7.0.1628) Nötig Lenovo YouCam (x32 Version: 3.1.3603) Nötig Lenovo_Wireless_Driver (x32 Version: 1.02.01) Nötig Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Nötig Media Finder 1.0.9.40 (x32 Version: 1.0.9.40) Unbekannt Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Nötig Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Nötig Microsoft Application Error Reporting (Version: 12.0.6015.5000) Nötig Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Nötig Microsoft Silverlight (Version: 5.1.20513.0) Unbekannt Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Nötig Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Nötig Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Nötig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Nötig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Nötig Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Nötig Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Nötig Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Nötig Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0) Nötig Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Nötig Mozilla Maintenance Service (x32 Version: 22.0) Unbekannt MSVCRT (x32 Version: 15.4.2862.0708) Unbekannt MSVCRT_amd64 (x32 Version: 15.4.2862.0708) Unbekannt Nero 11 (x32 Version: 11.2.01000) Unnötig Nero 11 Disc Menus Basic (x32 Version: 11.0.11200.12.0) Unnötig Nero 11 Effects Basic (x32 Version: 11.0.11400.14.0) Unnötig Nero 11 Image Samples (x32 Version: 11.0.11200.12.0) Unnötig Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0) Unnötig Nero 11 PiP Effects Basic (x32 Version: 11.0.11400.14.0) Unnötig Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0) Unnötig Nero BackItUp 11 (x32 Version: 6.2.18400.2.100) Unnötig Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200) Unnötig Nero Backup Drivers (Version: 1.0.11100.8.0) Unnötig Nero Burning ROM 11 (x32 Version: 11.2.10300.0.0) Unnötig Nero Burning ROM 11 Help (CHM) (x32 Version: 11.0.10300) Unnötig Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27) Unnötig Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300) Unnötig Nero Core Components 11 (x32 Version: 11.0.16300.1.23) Unnötig Nero CoverDesigner 11 (x32 Version: 6.0.11000.13.100) Unnötig Nero CoverDesigner 11 Help (CHM) (x32 Version: 11.0.10300) Unnötig Nero Express 11 (x32 Version: 11.2.10300.0.0) Unnötig Nero Express 11 Help (CHM) (x32 Version: 11.0.10300) Unnötig Nero Kwik Media (x32 Version: 1.14.11600.19.100) Unnötig Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200) Unnötig Nero Recode 11 (x32 Version: 5.2.10900.0.0) Unnötig Nero Recode 11 Help (CHM) (x32 Version: 11.0.10500) Unnötig Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100) Unnötig Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400) Unnötig Nero SharedVideoCodecs (x32 Version: 1.0.11500.1.5) Unnötig Nero SoundTrax 11 (x32 Version: 5.0.10700.6.100) Unnötig Nero SoundTrax 11 Help (CHM) (x32 Version: 11.0.10400) Unnötig Nero Update (x32 Version: 11.0.11500.28.0) Unnötig Nero Video 11 (x32 Version: 8.2.15700.3.100) Unnötig Nero Video 11 Help (CHM) (x32 Version: 11.0.10300) Unnötig Nero WaveEditor 11 (x32 Version: 6.2.11300.0.100) Unnötig Nero WaveEditor 11 Help (CHM) (x32 Version: 11.0.10400) Unnötig nero.prerequisites.msi (x32 Version: 11.0.20010) Unnötig NVIDIA Grafiktreiber 267.54 (Version: 267.54) Nötig NVIDIA Install Application (Version: 2.265.39.0) Nötig NVIDIA Optimus 1.0.21 (Version: 1.0.21) Nötig NVIDIA Systemsteuerung 267.54 (Version: 267.54) Nötig NVIDIA Update Components (Version: 1.0.21) Nötig Onekey Theater (x32 Version: 2.0.2.7) Unbekannt Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.21.531.2010) Nötig Realtek High Definition Audio Driver (x32 Version: 6.0.1.6505) Nötig Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7600.10008) Nötig Remote Module (x32 Version: 1.00.0000) Unbekannt Skype™ 6.3 (x32 Version: 6.3.105) Nötig SopCast 3.5.0 (x32 Version: 3.5.0) Nötig Spybot - Search & Destroy (x32 Version: 1.6.2) Nötig Synaptics Pointing Device Driver (Version: 15.2.7.0) Unbekannt TeamViewer 7 (x32 Version: 7.0.12979) Nötig Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Unbekannt Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Unbekannt Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Unbekannt Welcome App (Start-up experience) (x32 Version: 11.0.23500.0.0) Unbekannt Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Nötig Windows Live Essentials (x32 Version: 15.4.3502.0922) Nötig Windows Live Essentials (x32 Version: 15.4.3555.0308) Nötig Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Nötig Windows Live Installer (x32 Version: 15.4.3502.0922) Nötig Windows Live Language Selector (Version: 15.4.3555.0308) Unnötig Windows Live Mail (x32 Version: 15.4.3502.0922) Nötig Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Unbekannt Windows Live MIME IFilter (Version: 15.4.3502.0922) Unbekannt Windows Live Photo Common (x32 Version: 15.4.3502.0922) Unbekannt Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Unbekannt Windows Live SOXE (x32 Version: 15.4.3502.0922) Unbekannt Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Unbekannt Windows Live UX Platform (x32 Version: 15.4.3502.0922) Unbekannt Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Unbekannt Windows Live Writer (x32 Version: 15.4.3502.0922) Unbekannt Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Unbekannt Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (Version: 12/02/2010 6.1.0.1) Nötig WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0) Nötig |
|
07.08.2013, 15:36
| #8 |
| /// Malware-holic | Viren gefunden - Logdatei auswerten Hi, es sind 2 Logs zu erstellen, poste diese möglichst gleichzeitig. 1. deinstaliere: Adobe Flash Player alle Adobe - Adobe Flash Player installieren neueste version laden, instalieren. adobe reader: Adobe - Adobe Reader herunterladen - Alle Versionen haken bei mcafee security scan raus nehmen bitte auch mal den adobe reader wie folgt konfigurieren: adobe reader öffnen, bearbeiten, voreinstellungen. allgemein: nur zertifizierte zusatz module verwenden, anhaken. Sicherheit (erweitert) Erweiterte Sicherheit anhaken und alle Dateien auswählen. internet: hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc. es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht. bei javascript den haken bei java script verwenden raus nehmen bei updater, automatisch instalieren wählen. übernehmen /ok deinstaliere: AVG SafeGuard Die Sims™ : alle Media Finder nero: alle Spybot : deinstaliere das, behalte lieber Malwarebytes, ist sinnvoller! TeamViewer : Würd ich nur bei Bedarf instalieren, wenn es unbedingt drauf sein muss, bitte auf Teamviewer 8 upgraden. Starte nach den deinstalationen neu. 2. Scan mit Combofix
3. Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.08.2013, 16:21
| #9 |
| | Viren gefunden - Logdatei auswerten Bis auf die Deinstallation von Sims, welches nun doch erhalten bleiben soll, habe ich allen Anweisungen folgen können. Hier die gewünschten Daten. Code:
ATTFilter ComboFix 13-08-07.01 - NAME 07.08.2013 17:03:16.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4010.2310 [GMT 2:00]
ausgeführt von:: c:\users\NAME\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\gt.exe
c:\windows\s.bat
c:\windows\SysWow64\JpgDll.dll
c:\windows\version.txt
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-07 bis 2013-08-07 ))))))))))))))))))))))))))))))
.
.
2013-08-07 14:51 . 2013-08-07 14:51 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2013-08-07 14:46 . 2013-08-07 14:48 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-07 14:46 . 2013-08-07 14:48 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-07 14:46 . 2013-08-07 14:52 -------- d-----w- c:\users\NAME\AppData\Local\Adobe
2013-08-06 10:35 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{75200362-DE6F-48CC-9CAE-3F90C02F7F6D}\mpengine.dll
2013-08-05 18:18 . 2013-08-05 18:18 -------- d-----w- c:\users\NAME\AppData\Local\Programs
2013-08-05 18:10 . 2013-08-05 18:10 -------- d-----w- c:\users\NAME\AppData\Local\Macromedia
2013-08-05 18:09 . 2013-08-05 18:09 -------- d-----w- c:\users\NAME\AppData\Local\Mozilla
2013-08-05 16:05 . 2013-08-05 16:05 -------- d-----w- C:\FRST
2013-08-05 14:39 . 2013-08-05 14:39 -------- d-----w- c:\users\NAME\AppData\Roaming\Malwarebytes
2013-08-05 14:39 . 2013-08-05 14:39 -------- d-----w- c:\programdata\Malwarebytes
2013-08-05 14:39 . 2013-08-05 14:39 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-08-05 14:39 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-10 19:09 . 2013-04-10 05:48 1732608 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-07-10 19:09 . 2013-04-10 05:46 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-07-10 19:09 . 2013-04-10 05:46 1393152 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-07-10 19:09 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 19:09 . 2013-04-10 05:03 936448 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 19:08 . 2013-05-27 05:50 1011712 ----a-w- c:\program files\Windows Defender\MpSvc.dll
2013-07-10 19:08 . 2013-05-27 05:50 571904 ----a-w- c:\program files\Windows Defender\MpClient.dll
2013-07-10 19:08 . 2013-05-27 05:50 314880 ----a-w- c:\program files\Windows Defender\MpCommu.dll
2013-07-10 19:08 . 2013-05-27 04:57 4608 ----a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-10 19:08 . 2013-05-27 04:57 54784 ----a-w- c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-10 19:08 . 2013-05-27 04:57 392704 ----a-w- c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-10 19:08 . 2013-05-27 03:15 9216 ----a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-10 19:08 . 2013-06-04 06:00 624128 ----a-w- c:\windows\system32\qedit.dll
2013-07-10 19:08 . 2013-06-04 04:53 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-07-10 19:08 . 2013-05-06 06:03 1887744 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-10 19:08 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-10 19:06 . 2013-06-05 03:34 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-07-10 19:01 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-07-10 19:01 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-28 17:10 . 2013-06-28 17:09 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2013-05-28 13:05 . 2013-06-18 16:23 163328 ----a-w- c:\windows\SysWow64\FlashPlayerUpdateService.exe
2013-05-13 16:15 . 2011-03-28 16:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-13 05:51 . 2013-06-12 18:44 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 18:44 1464320 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 18:44 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 18:44 52224 ----a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 18:44 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 18:44 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 18:44 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 18:44 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 18:44 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 18:44 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-05-10 05:49 . 2013-06-12 18:44 30720 ----a-w- c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-12 18:44 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\meine programme\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys;c:\windows\SYSNATIVE\drivers\fbfmon.sys [x]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys;c:\windows\SYSNATIVE\drivers\BPntDrv.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\meine programme\Avira\AntiVir Desktop\sched.exe;c:\meine programme\Avira\AntiVir Desktop\sched.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\usbvideo.sys;c:\windows\SYSNATIVE\Drivers\usbvideo.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 13:05]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-29 167960]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-29 418840]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-11-14 13353064]
"Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2012-02-16 114688]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-29 391704]
"OnekeyStudio"="c:\program files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe" [2012-02-16 789920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = about:blank
uCustomizeSearch = hxxp://www.google.com
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\ldtoh93l.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.finanzen.net/rohstoffe/goldpreis/euro
FF - ExtSQL: 2013-08-04 19:56; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\ldtoh93l.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1334398745-1784092212-229574685-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1334398745-1784092212-229574685-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-07 17:11:10
ComboFix-quarantined-files.txt 2013-08-07 15:11
.
Vor Suchlauf: 11 Verzeichnis(se), 386.029.547.520 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 385.796.456.448 Bytes frei
.
- - End Of File - - 66DED4E3FB27A50FE21259F6D5AFD6EE
D41D8CD98F00B204E9800998ECF8427E
Code:
ATTFilter 17:16:39.0558 3208 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
17:16:39.0714 3208 ============================================================
17:16:39.0714 3208 Current date / time: 2013/08/07 17:16:39.0714
17:16:39.0714 3208 SystemInfo:
17:16:39.0714 3208
17:16:39.0714 3208 OS Version: 6.1.7601 ServicePack: 1.0
17:16:39.0714 3208 Product type: Workstation
17:16:39.0714 3208 ComputerName: GOLD-PARADIES
17:16:39.0714 3208 UserName: NAME
17:16:39.0714 3208 Windows directory: C:\windows
17:16:39.0714 3208 System windows directory: C:\windows
17:16:39.0714 3208 Running under WOW64
17:16:39.0714 3208 Processor architecture: Intel x64
17:16:39.0714 3208 Number of processors: 4
17:16:39.0714 3208 Page size: 0x1000
17:16:39.0714 3208 Boot type: Normal boot
17:16:39.0714 3208 ============================================================
17:16:40.0119 3208 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
17:16:40.0135 3208 ============================================================
17:16:40.0135 3208 \Device\Harddisk0\DR0:
17:16:40.0135 3208 MBR partitions:
17:16:40.0135 3208 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x64000
17:16:40.0135 3208 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64800, BlocksNum 0x34BA1000
17:16:40.0150 3208 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x34C06000, BlocksNum 0x39FD800
17:16:40.0150 3208 ============================================================
17:16:40.0197 3208 C: <-> \Device\Harddisk0\DR0\Partition2
17:16:40.0244 3208 D: <-> \Device\Harddisk0\DR0\Partition3
17:16:40.0244 3208 ============================================================
17:16:40.0244 3208 Initialize success
17:16:40.0244 3208 ============================================================
17:17:12.0146 4928 ============================================================
17:17:12.0146 4928 Scan started
17:17:12.0146 4928 Mode: Manual; SigCheck; TDLFS;
17:17:12.0146 4928 ============================================================
17:17:12.0442 4928 ================ Scan system memory ========================
17:17:12.0442 4928 System memory - ok
17:17:12.0458 4928 ================ Scan services =============================
17:17:12.0692 4928 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\windows\system32\drivers\1394ohci.sys
17:17:12.0770 4928 1394ohci - ok
17:17:12.0801 4928 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\windows\system32\drivers\ACPI.sys
17:17:12.0817 4928 ACPI - ok
17:17:12.0832 4928 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys
17:17:12.0879 4928 AcpiPmi - ok
17:17:12.0910 4928 [ 5BBFF8B826EC38D32C26334E079C7EFC ] ACPIVPC C:\windows\system32\DRIVERS\AcpiVpc.sys
17:17:12.0926 4928 ACPIVPC - ok
17:17:13.0051 4928 [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
17:17:13.0066 4928 AdobeARMservice - ok
17:17:13.0207 4928 [ 249A44DCFA2500EB1C020E33A3E9F25B ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
17:17:13.0238 4928 AdobeFlashPlayerUpdateSvc ( UnsignedFile.Multi.Generic ) - warning
17:17:13.0238 4928 AdobeFlashPlayerUpdateSvc - detected UnsignedFile.Multi.Generic (1)
17:17:13.0300 4928 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\windows\system32\drivers\adp94xx.sys
17:17:13.0347 4928 adp94xx - ok
17:17:13.0378 4928 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\windows\system32\drivers\adpahci.sys
17:17:13.0410 4928 adpahci - ok
17:17:13.0425 4928 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\windows\system32\drivers\adpu320.sys
17:17:13.0441 4928 adpu320 - ok
17:17:13.0488 4928 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\windows\System32\aelupsvc.dll
17:17:13.0566 4928 AeLookupSvc - ok
17:17:13.0628 4928 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\windows\system32\drivers\afd.sys
17:17:13.0690 4928 AFD - ok
17:17:13.0722 4928 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\windows\system32\drivers\agp440.sys
17:17:13.0737 4928 agp440 - ok
17:17:13.0753 4928 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\windows\System32\alg.exe
17:17:13.0800 4928 ALG - ok
17:17:13.0846 4928 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\windows\system32\drivers\aliide.sys
17:17:13.0878 4928 aliide - ok
17:17:13.0878 4928 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\windows\system32\drivers\amdide.sys
17:17:13.0893 4928 amdide - ok
17:17:13.0924 4928 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\windows\system32\drivers\amdk8.sys
17:17:13.0924 4928 AmdK8 - ok
17:17:13.0940 4928 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\windows\system32\drivers\amdppm.sys
17:17:13.0971 4928 AmdPPM - ok
17:17:14.0018 4928 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\windows\system32\drivers\amdsata.sys
17:17:14.0034 4928 amdsata - ok
17:17:14.0049 4928 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\windows\system32\drivers\amdsbs.sys
17:17:14.0065 4928 amdsbs - ok
17:17:14.0080 4928 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\windows\system32\drivers\amdxata.sys
17:17:14.0080 4928 amdxata - ok
17:17:14.0174 4928 [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Meine Programme\Avira\AntiVir Desktop\sched.exe
17:17:14.0205 4928 AntiVirSchedulerService - ok
17:17:14.0221 4928 [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService C:\Meine Programme\Avira\AntiVir Desktop\avguard.exe
17:17:14.0252 4928 AntiVirService - ok
17:17:14.0268 4928 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\windows\system32\drivers\appid.sys
17:17:14.0314 4928 AppID - ok
17:17:14.0361 4928 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\windows\System32\appidsvc.dll
17:17:14.0424 4928 AppIDSvc - ok
17:17:14.0439 4928 [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo C:\windows\System32\appinfo.dll
17:17:14.0470 4928 Appinfo - ok
17:17:14.0533 4928 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\windows\system32\drivers\arc.sys
17:17:14.0564 4928 arc - ok
17:17:14.0564 4928 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\windows\system32\drivers\arcsas.sys
17:17:14.0580 4928 arcsas - ok
17:17:14.0611 4928 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys
17:17:14.0642 4928 AsyncMac - ok
17:17:14.0658 4928 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\windows\system32\drivers\atapi.sys
17:17:14.0658 4928 atapi - ok
17:17:14.0704 4928 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
17:17:14.0751 4928 AudioEndpointBuilder - ok
17:17:14.0782 4928 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\windows\System32\Audiosrv.dll
17:17:14.0829 4928 AudioSrv - ok
17:17:14.0860 4928 [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt C:\windows\system32\DRIVERS\avgntflt.sys
17:17:14.0892 4928 avgntflt - ok
17:17:14.0954 4928 [ 4A175D2D30D31F7DF46F09B9A108E089 ] avgtp C:\windows\system32\drivers\avgtpx64.sys
17:17:14.0970 4928 avgtp - ok
17:17:15.0016 4928 [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb C:\windows\system32\DRIVERS\avipbb.sys
17:17:15.0032 4928 avipbb - ok
17:17:15.0063 4928 [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr C:\windows\system32\DRIVERS\avkmgr.sys
17:17:15.0079 4928 avkmgr - ok
17:17:15.0110 4928 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\windows\System32\AxInstSV.dll
17:17:15.0172 4928 AxInstSV - ok
17:17:15.0250 4928 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\windows\system32\drivers\bxvbda.sys
17:17:15.0328 4928 b06bdrv - ok
17:17:15.0344 4928 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys
17:17:15.0391 4928 b57nd60a - ok
17:17:15.0547 4928 [ B5D54119CE0BB77872C33A717CB76386 ] BCM43XX C:\windows\system32\DRIVERS\bcmwl664.sys
17:17:15.0625 4928 BCM43XX - ok
17:17:15.0656 4928 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\windows\System32\bdesvc.dll
17:17:15.0734 4928 BDESVC - ok
17:17:15.0750 4928 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\windows\system32\drivers\Beep.sys
17:17:15.0843 4928 Beep - ok
17:17:15.0890 4928 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\windows\System32\bfe.dll
17:17:15.0952 4928 BFE - ok
17:17:15.0999 4928 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\windows\system32\qmgr.dll
17:17:16.0046 4928 BITS - ok
17:17:16.0062 4928 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\windows\system32\DRIVERS\blbdrive.sys
17:17:16.0093 4928 blbdrive - ok
17:17:16.0124 4928 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\windows\system32\DRIVERS\bowser.sys
17:17:16.0186 4928 bowser - ok
17:17:16.0233 4928 [ AAA4F992F879977A000FE8B8C730CD2C ] BPntDrv C:\windows\system32\drivers\BPntDrv.sys
17:17:16.0264 4928 BPntDrv - ok
17:17:16.0296 4928 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\windows\system32\drivers\BrFiltLo.sys
17:17:16.0311 4928 BrFiltLo - ok
17:17:16.0311 4928 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\windows\system32\drivers\BrFiltUp.sys
17:17:16.0342 4928 BrFiltUp - ok
17:17:16.0374 4928 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\windows\system32\DRIVERS\bridge.sys
17:17:16.0420 4928 BridgeMP - ok
17:17:16.0452 4928 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\windows\System32\browser.dll
17:17:16.0467 4928 Browser - ok
17:17:16.0483 4928 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\windows\System32\Drivers\Brserid.sys
17:17:16.0545 4928 Brserid - ok
17:17:16.0561 4928 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys
17:17:16.0608 4928 BrSerWdm - ok
17:17:16.0639 4928 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys
17:17:16.0670 4928 BrUsbMdm - ok
17:17:16.0670 4928 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys
17:17:16.0686 4928 BrUsbSer - ok
17:17:16.0748 4928 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\windows\system32\drivers\BthEnum.sys
17:17:16.0795 4928 BthEnum - ok
17:17:16.0842 4928 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\windows\system32\drivers\bthmodem.sys
17:17:16.0888 4928 BTHMODEM - ok
17:17:16.0920 4928 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\windows\system32\DRIVERS\bthpan.sys
17:17:16.0966 4928 BthPan - ok
17:17:17.0013 4928 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\windows\System32\Drivers\BTHport.sys
17:17:17.0044 4928 BTHPORT - ok
17:17:17.0091 4928 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\windows\system32\bthserv.dll
17:17:17.0154 4928 bthserv - ok
17:17:17.0169 4928 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\windows\System32\Drivers\BTHUSB.sys
17:17:17.0200 4928 BTHUSB - ok
17:17:17.0263 4928 [ A0DFB69ADE3444C78B17636FCF28E898 ] BTWAMPFL C:\windows\system32\DRIVERS\btwampfl.sys
17:17:17.0294 4928 BTWAMPFL - ok
17:17:17.0310 4928 [ 7CF028CE78696882B327FF13D2DFA534 ] btwaudio C:\windows\system32\drivers\btwaudio.sys
17:17:17.0310 4928 btwaudio - ok
17:17:17.0325 4928 [ 3DEF2370E414B4E299673558BA171A51 ] btwavdt C:\windows\system32\DRIVERS\btwavdt.sys
17:17:17.0341 4928 btwavdt - ok
17:17:17.0419 4928 [ 3D5E7FB2CB69A6186C7954C0859173F4 ] btwdins C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
17:17:17.0450 4928 btwdins - ok
17:17:17.0466 4928 [ 346B4051B3D7FF70E8F027869B8ECA6E ] btwl2cap C:\windows\system32\DRIVERS\btwl2cap.sys
17:17:17.0481 4928 btwl2cap - ok
17:17:17.0481 4928 [ 9937E0E4DFC0030560A6DFE9D3A94B39 ] btwrchid C:\windows\system32\DRIVERS\btwrchid.sys
17:17:17.0497 4928 btwrchid - ok
17:17:17.0544 4928 catchme - ok
17:17:17.0575 4928 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\windows\system32\DRIVERS\cdfs.sys
17:17:17.0668 4928 cdfs - ok
17:17:17.0715 4928 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\windows\system32\DRIVERS\cdrom.sys
17:17:17.0762 4928 cdrom - ok
17:17:17.0824 4928 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\windows\System32\certprop.dll
17:17:17.0902 4928 CertPropSvc - ok
17:17:17.0934 4928 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\windows\system32\drivers\circlass.sys
17:17:17.0980 4928 circlass - ok
17:17:18.0012 4928 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\windows\system32\CLFS.sys
17:17:18.0058 4928 CLFS - ok
17:17:18.0152 4928 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
17:17:18.0168 4928 clr_optimization_v2.0.50727_32 - ok
17:17:18.0214 4928 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
17:17:18.0246 4928 clr_optimization_v2.0.50727_64 - ok
17:17:18.0308 4928 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
17:17:18.0324 4928 clr_optimization_v4.0.30319_32 - ok
17:17:18.0355 4928 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
17:17:18.0370 4928 clr_optimization_v4.0.30319_64 - ok
17:17:18.0417 4928 [ 50F92C943F18B070F166D019DFAB3D9A ] clwvd C:\windows\system32\DRIVERS\clwvd.sys
17:17:18.0448 4928 clwvd - ok
17:17:18.0464 4928 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\windows\system32\DRIVERS\CmBatt.sys
17:17:18.0511 4928 CmBatt - ok
17:17:18.0558 4928 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\windows\system32\drivers\cmdide.sys
17:17:18.0573 4928 cmdide - ok
17:17:18.0620 4928 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\windows\system32\Drivers\cng.sys
17:17:18.0651 4928 CNG - ok
17:17:18.0682 4928 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\windows\system32\drivers\compbatt.sys
17:17:18.0698 4928 Compbatt - ok
17:17:18.0729 4928 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\windows\system32\DRIVERS\CompositeBus.sys
17:17:18.0792 4928 CompositeBus - ok
17:17:18.0807 4928 COMSysApp - ok
17:17:18.0838 4928 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\windows\system32\drivers\crcdisk.sys
17:17:18.0854 4928 crcdisk - ok
17:17:18.0885 4928 [ D8129C49798CBBFB2E4351D4B7B8EF9C ] CryptSvc C:\windows\system32\cryptsvc.dll
17:17:18.0901 4928 CryptSvc - ok
17:17:18.0932 4928 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\windows\system32\rpcss.dll
17:17:18.0963 4928 DcomLaunch - ok
17:17:19.0010 4928 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\windows\System32\defragsvc.dll
17:17:19.0088 4928 defragsvc - ok
17:17:19.0119 4928 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\windows\system32\Drivers\dfsc.sys
17:17:19.0166 4928 DfsC - ok
17:17:19.0213 4928 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\windows\system32\dhcpcore.dll
17:17:19.0275 4928 Dhcp - ok
17:17:19.0291 4928 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\windows\system32\drivers\discache.sys
17:17:19.0353 4928 discache - ok
17:17:19.0416 4928 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\windows\system32\drivers\disk.sys
17:17:19.0431 4928 Disk - ok
17:17:19.0447 4928 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\windows\System32\dnsrslvr.dll
17:17:19.0478 4928 Dnscache - ok
17:17:19.0494 4928 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\windows\System32\dot3svc.dll
17:17:19.0540 4928 dot3svc - ok
17:17:19.0572 4928 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\windows\system32\dps.dll
17:17:19.0618 4928 DPS - ok
17:17:19.0665 4928 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\windows\system32\drivers\drmkaud.sys
17:17:19.0696 4928 drmkaud - ok
17:17:19.0774 4928 [ 46571ED73AE84469DCA53081D33CF3C8 ] dtsoftbus01 C:\windows\system32\DRIVERS\dtsoftbus01.sys
17:17:19.0806 4928 dtsoftbus01 - ok
17:17:19.0852 4928 [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl C:\windows\System32\drivers\dxgkrnl.sys
17:17:19.0884 4928 DXGKrnl - ok
17:17:19.0930 4928 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\windows\System32\eapsvc.dll
17:17:19.0977 4928 EapHost - ok
17:17:20.0086 4928 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\windows\system32\drivers\evbda.sys
17:17:20.0164 4928 ebdrv - ok
17:17:20.0196 4928 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\windows\System32\lsass.exe
17:17:20.0227 4928 EFS - ok
17:17:20.0305 4928 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\windows\ehome\ehRecvr.exe
17:17:20.0398 4928 ehRecvr - ok
17:17:20.0398 4928 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\windows\ehome\ehsched.exe
17:17:20.0430 4928 ehSched - ok
17:17:20.0492 4928 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\windows\system32\drivers\elxstor.sys
17:17:20.0523 4928 elxstor - ok
17:17:20.0539 4928 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\windows\system32\drivers\errdev.sys
17:17:20.0554 4928 ErrDev - ok
17:17:20.0617 4928 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\windows\system32\es.dll
17:17:20.0648 4928 EventSystem - ok
17:17:20.0679 4928 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\windows\system32\drivers\exfat.sys
17:17:20.0710 4928 exfat - ok
17:17:20.0710 4928 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\windows\system32\drivers\fastfat.sys
17:17:20.0773 4928 fastfat - ok
17:17:20.0820 4928 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\windows\system32\fxssvc.exe
17:17:20.0898 4928 Fax - ok
17:17:20.0913 4928 [ 3191ACA33088EE2481044FC0DB736442 ] fbfmon C:\windows\system32\drivers\fbfmon.sys
17:17:20.0929 4928 fbfmon - ok
17:17:20.0976 4928 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\windows\system32\drivers\fdc.sys
17:17:21.0007 4928 fdc - ok
17:17:21.0054 4928 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\windows\system32\fdPHost.dll
17:17:21.0116 4928 fdPHost - ok
17:17:21.0116 4928 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\windows\system32\fdrespub.dll
17:17:21.0163 4928 FDResPub - ok
17:17:21.0163 4928 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\windows\system32\drivers\fileinfo.sys
17:17:21.0178 4928 FileInfo - ok
17:17:21.0194 4928 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\windows\system32\drivers\filetrace.sys
17:17:21.0241 4928 Filetrace - ok
17:17:21.0256 4928 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\windows\system32\drivers\flpydisk.sys
17:17:21.0272 4928 flpydisk - ok
17:17:21.0288 4928 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\windows\system32\drivers\fltmgr.sys
17:17:21.0303 4928 FltMgr - ok
17:17:21.0350 4928 [ C4C183E6551084039EC862DA1C945E3D ] FontCache C:\windows\system32\FntCache.dll
17:17:21.0412 4928 FontCache - ok
17:17:21.0475 4928 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
17:17:21.0490 4928 FontCache3.0.0.0 - ok
17:17:21.0506 4928 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\windows\system32\drivers\FsDepends.sys
17:17:21.0522 4928 FsDepends - ok
17:17:21.0553 4928 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\windows\system32\drivers\Fs_Rec.sys
17:17:21.0568 4928 Fs_Rec - ok
17:17:21.0600 4928 [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol C:\windows\system32\DRIVERS\fvevol.sys
17:17:21.0615 4928 fvevol - ok
17:17:21.0662 4928 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\windows\system32\drivers\gagp30kx.sys
17:17:21.0662 4928 gagp30kx - ok
17:17:21.0709 4928 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\windows\System32\gpsvc.dll
17:17:21.0756 4928 gpsvc - ok
17:17:21.0818 4928 [ B9893A68032A6D9ADDB5B98287C630F7 ] grmnusb C:\windows\system32\drivers\grmnusb.sys
17:17:21.0834 4928 grmnusb - ok
17:17:21.0849 4928 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\windows\system32\drivers\hcw85cir.sys
17:17:21.0927 4928 hcw85cir - ok
17:17:21.0943 4928 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
17:17:21.0990 4928 HdAudAddService - ok
17:17:22.0036 4928 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\windows\system32\DRIVERS\HDAudBus.sys
17:17:22.0099 4928 HDAudBus - ok
17:17:22.0130 4928 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\windows\system32\drivers\HidBatt.sys
17:17:22.0177 4928 HidBatt - ok
17:17:22.0192 4928 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\windows\system32\drivers\hidbth.sys
17:17:22.0239 4928 HidBth - ok
17:17:22.0255 4928 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\windows\system32\drivers\hidir.sys
17:17:22.0270 4928 HidIr - ok
17:17:22.0302 4928 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\windows\System32\hidserv.dll
17:17:22.0380 4928 hidserv - ok
17:17:22.0426 4928 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\windows\system32\DRIVERS\hidusb.sys
17:17:22.0442 4928 HidUsb - ok
17:17:22.0473 4928 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\windows\system32\kmsvc.dll
17:17:22.0536 4928 hkmsvc - ok
17:17:22.0567 4928 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll
17:17:22.0645 4928 HomeGroupListener - ok
17:17:22.0676 4928 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll
17:17:22.0707 4928 HomeGroupProvider - ok
17:17:22.0754 4928 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\windows\system32\drivers\HpSAMD.sys
17:17:22.0785 4928 HpSAMD - ok
17:17:22.0801 4928 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\windows\system32\drivers\HTTP.sys
17:17:22.0863 4928 HTTP - ok
17:17:22.0894 4928 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\windows\system32\drivers\hwpolicy.sys
17:17:22.0910 4928 hwpolicy - ok
17:17:22.0941 4928 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\windows\system32\DRIVERS\i8042prt.sys
17:17:22.0972 4928 i8042prt - ok
17:17:23.0035 4928 [ 53CC5BF8B5A219119953C7ABB19A7705 ] iaStor C:\windows\system32\DRIVERS\iaStor.sys
17:17:23.0066 4928 iaStor - ok
17:17:23.0097 4928 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\windows\system32\drivers\iaStorV.sys
17:17:23.0113 4928 iaStorV - ok
17:17:23.0160 4928 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
17:17:23.0206 4928 idsvc - ok
17:17:23.0456 4928 [ 795C99DC4F574C97C03D0BB39CF099EE ] igfx C:\windows\system32\DRIVERS\igdkmd64.sys
17:17:23.0628 4928 igfx - ok
17:17:23.0674 4928 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\windows\system32\drivers\iirsp.sys
17:17:23.0674 4928 iirsp - ok
17:17:23.0706 4928 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\windows\System32\ikeext.dll
17:17:23.0768 4928 IKEEXT - ok
17:17:23.0908 4928 [ ABA41EE6F5EEFC034F3BBD025506B37E ] IntcAzAudAddService C:\windows\system32\drivers\RTKVHD64.sys
17:17:23.0955 4928 IntcAzAudAddService - ok
17:17:24.0018 4928 [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud C:\windows\system32\DRIVERS\IntcDAud.sys
17:17:24.0018 4928 IntcDAud - ok
17:17:24.0049 4928 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\windows\system32\drivers\intelide.sys
17:17:24.0064 4928 intelide - ok
17:17:24.0096 4928 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\windows\system32\DRIVERS\intelppm.sys
17:17:24.0127 4928 intelppm - ok
17:17:24.0174 4928 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\windows\system32\ipbusenum.dll
17:17:24.0252 4928 IPBusEnum - ok
17:17:24.0252 4928 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\windows\system32\DRIVERS\ipfltdrv.sys
17:17:24.0298 4928 IpFilterDriver - ok
17:17:24.0345 4928 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\windows\System32\iphlpsvc.dll
17:17:24.0376 4928 iphlpsvc - ok
17:17:24.0392 4928 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\windows\system32\drivers\IPMIDrv.sys
17:17:24.0408 4928 IPMIDRV - ok
17:17:24.0408 4928 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\windows\system32\drivers\ipnat.sys
17:17:24.0454 4928 IPNAT - ok
17:17:24.0486 4928 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\windows\system32\drivers\irenum.sys
17:17:24.0548 4928 IRENUM - ok
17:17:24.0564 4928 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\windows\system32\drivers\isapnp.sys
17:17:24.0579 4928 isapnp - ok
17:17:24.0595 4928 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\windows\system32\drivers\msiscsi.sys
17:17:24.0610 4928 iScsiPrt - ok
17:17:24.0642 4928 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\windows\system32\DRIVERS\kbdclass.sys
17:17:24.0642 4928 kbdclass - ok
17:17:24.0673 4928 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\windows\system32\drivers\kbdhid.sys
17:17:24.0704 4928 kbdhid - ok
17:17:24.0735 4928 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\windows\system32\lsass.exe
17:17:24.0751 4928 KeyIso - ok
17:17:24.0782 4928 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\windows\system32\Drivers\ksecdd.sys
17:17:24.0798 4928 KSecDD - ok
17:17:24.0813 4928 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\windows\system32\Drivers\ksecpkg.sys
17:17:24.0829 4928 KSecPkg - ok
17:17:24.0844 4928 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\windows\system32\drivers\ksthunk.sys
17:17:24.0891 4928 ksthunk - ok
17:17:24.0938 4928 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\windows\system32\msdtckrm.dll
17:17:24.0969 4928 KtmRm - ok
17:17:25.0000 4928 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\windows\System32\srvsvc.dll
17:17:25.0047 4928 LanmanServer - ok
17:17:25.0094 4928 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll
17:17:25.0188 4928 LanmanWorkstation - ok
17:17:25.0250 4928 [ BE166935083F9C38EDFDC21B9A7A679B ] LHDmgr C:\windows\system32\DRIVERS\LhdX64.sys
17:17:25.0266 4928 LHDmgr - ok
17:17:25.0312 4928 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\windows\system32\DRIVERS\lltdio.sys
17:17:25.0375 4928 lltdio - ok
17:17:25.0390 4928 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\windows\System32\lltdsvc.dll
17:17:25.0422 4928 lltdsvc - ok
17:17:25.0437 4928 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\windows\System32\lmhsvc.dll
17:17:25.0500 4928 lmhosts - ok
17:17:25.0609 4928 [ 2ED1786B7542CDA261029F6B526EDF44 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
17:17:25.0640 4928 LMS - ok
17:17:25.0687 4928 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\windows\system32\drivers\lsi_fc.sys
17:17:25.0702 4928 LSI_FC - ok
17:17:25.0718 4928 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\windows\system32\drivers\lsi_sas.sys
17:17:25.0749 4928 LSI_SAS - ok
17:17:25.0765 4928 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\windows\system32\drivers\lsi_sas2.sys
17:17:25.0780 4928 LSI_SAS2 - ok
17:17:25.0796 4928 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\windows\system32\drivers\lsi_scsi.sys
17:17:25.0812 4928 LSI_SCSI - ok
17:17:25.0827 4928 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\windows\system32\drivers\luafv.sys
17:17:25.0890 4928 luafv - ok
17:17:25.0936 4928 [ 0BB97D43299910CBFBA59C461B99B910 ] MBAMProtector C:\windows\system32\drivers\mbam.sys
17:17:25.0968 4928 MBAMProtector - ok
17:17:26.0014 4928 [ 65085456FD9A74D7F1A999520C299ECB ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
17:17:26.0030 4928 MBAMScheduler - ok
17:17:26.0061 4928 [ E0D7732F2D2E24B2DB3F67B6750295B8 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
17:17:26.0092 4928 MBAMService - ok
17:17:26.0139 4928 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\windows\system32\Mcx2Svc.dll
17:17:26.0202 4928 Mcx2Svc - ok
17:17:26.0233 4928 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\windows\system32\drivers\megasas.sys
17:17:26.0233 4928 megasas - ok
17:17:26.0264 4928 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\windows\system32\drivers\MegaSR.sys
17:17:26.0280 4928 MegaSR - ok
17:17:26.0326 4928 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\windows\system32\DRIVERS\HECIx64.sys
17:17:26.0342 4928 MEIx64 - ok
17:17:26.0373 4928 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\windows\system32\mmcss.dll
17:17:26.0436 4928 MMCSS - ok
17:17:26.0467 4928 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\windows\system32\drivers\modem.sys
17:17:26.0529 4928 Modem - ok
17:17:26.0560 4928 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\windows\system32\DRIVERS\monitor.sys
17:17:26.0592 4928 monitor - ok
17:17:26.0623 4928 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\windows\system32\DRIVERS\mouclass.sys
17:17:26.0623 4928 mouclass - ok
17:17:26.0654 4928 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\windows\system32\DRIVERS\mouhid.sys
17:17:26.0685 4928 mouhid - ok
17:17:26.0701 4928 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\windows\system32\drivers\mountmgr.sys
17:17:26.0701 4928 mountmgr - ok
17:17:26.0763 4928 [ 528A5C2570F468155A1B3CF0A2FF5EBD ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
17:17:26.0779 4928 MozillaMaintenance - ok
17:17:26.0779 4928 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\windows\system32\drivers\mpio.sys
17:17:26.0794 4928 mpio - ok
17:17:26.0794 4928 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\windows\system32\drivers\mpsdrv.sys
17:17:26.0826 4928 mpsdrv - ok
17:17:26.0872 4928 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\windows\system32\mpssvc.dll
17:17:26.0935 4928 MpsSvc - ok
17:17:26.0950 4928 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\windows\system32\drivers\mrxdav.sys
17:17:26.0982 4928 MRxDAV - ok
17:17:27.0013 4928 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\windows\system32\DRIVERS\mrxsmb.sys
17:17:27.0044 4928 mrxsmb - ok
17:17:27.0091 4928 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\windows\system32\DRIVERS\mrxsmb10.sys
17:17:27.0122 4928 mrxsmb10 - ok
17:17:27.0138 4928 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\windows\system32\DRIVERS\mrxsmb20.sys
17:17:27.0153 4928 mrxsmb20 - ok
17:17:27.0169 4928 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\windows\system32\drivers\msahci.sys
17:17:27.0184 4928 msahci - ok
17:17:27.0200 4928 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\windows\system32\drivers\msdsm.sys
17:17:27.0216 4928 msdsm - ok
17:17:27.0247 4928 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\windows\System32\msdtc.exe
17:17:27.0278 4928 MSDTC - ok
17:17:27.0309 4928 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\windows\system32\drivers\Msfs.sys
17:17:27.0340 4928 Msfs - ok
17:17:27.0356 4928 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\windows\System32\drivers\mshidkmdf.sys
17:17:27.0434 4928 mshidkmdf - ok
17:17:27.0450 4928 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\windows\system32\drivers\msisadrv.sys
17:17:27.0465 4928 msisadrv - ok
17:17:27.0496 4928 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\windows\system32\iscsiexe.dll
17:17:27.0559 4928 MSiSCSI - ok
17:17:27.0559 4928 msiserver - ok
17:17:27.0606 4928 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\windows\system32\drivers\MSKSSRV.sys
17:17:27.0668 4928 MSKSSRV - ok
17:17:27.0699 4928 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\windows\system32\drivers\MSPCLOCK.sys
17:17:27.0762 4928 MSPCLOCK - ok
17:17:27.0793 4928 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\windows\system32\drivers\MSPQM.sys
17:17:27.0871 4928 MSPQM - ok
17:17:27.0902 4928 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\windows\system32\drivers\MsRPC.sys
17:17:27.0918 4928 MsRPC - ok
17:17:27.0933 4928 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\windows\system32\DRIVERS\mssmbios.sys
17:17:27.0933 4928 mssmbios - ok
17:17:27.0949 4928 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\windows\system32\drivers\MSTEE.sys
17:17:27.0980 4928 MSTEE - ok
17:17:27.0996 4928 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\windows\system32\drivers\MTConfig.sys
17:17:28.0027 4928 MTConfig - ok
17:17:28.0042 4928 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\windows\system32\Drivers\mup.sys
17:17:28.0058 4928 Mup - ok
17:17:28.0089 4928 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\windows\system32\qagentRT.dll
17:17:28.0152 4928 napagent - ok
17:17:28.0198 4928 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\windows\system32\DRIVERS\nwifi.sys
17:17:28.0276 4928 NativeWifiP - ok
17:17:28.0323 4928 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\windows\system32\drivers\ndis.sys
17:17:28.0370 4928 NDIS - ok
17:17:28.0386 4928 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\windows\system32\DRIVERS\ndiscap.sys
17:17:28.0432 4928 NdisCap - ok
17:17:28.0448 4928 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\windows\system32\DRIVERS\ndistapi.sys
17:17:28.0479 4928 NdisTapi - ok
17:17:28.0495 4928 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\windows\system32\DRIVERS\ndisuio.sys
17:17:28.0542 4928 Ndisuio - ok
17:17:28.0557 4928 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\windows\system32\DRIVERS\ndiswan.sys
17:17:28.0620 4928 NdisWan - ok
17:17:28.0635 4928 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\windows\system32\drivers\NDProxy.sys
17:17:28.0713 4928 NDProxy - ok
17:17:28.0744 4928 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\windows\system32\DRIVERS\netbios.sys
17:17:28.0822 4928 NetBIOS - ok
17:17:28.0854 4928 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\windows\system32\DRIVERS\netbt.sys
17:17:28.0900 4928 NetBT - ok
17:17:28.0916 4928 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\windows\system32\lsass.exe
17:17:28.0916 4928 Netlogon - ok
17:17:28.0947 4928 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\windows\System32\netman.dll
17:17:28.0994 4928 Netman - ok
17:17:28.0994 4928 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\windows\System32\netprofm.dll
17:17:29.0056 4928 netprofm - ok
17:17:29.0088 4928 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
17:17:29.0103 4928 NetTcpPortSharing - ok
17:17:29.0119 4928 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\windows\system32\drivers\nfrd960.sys
17:17:29.0134 4928 nfrd960 - ok
17:17:29.0166 4928 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\windows\System32\nlasvc.dll
17:17:29.0197 4928 NlaSvc - ok
17:17:29.0228 4928 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\windows\system32\drivers\Npfs.sys
17:17:29.0259 4928 Npfs - ok
17:17:29.0290 4928 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\windows\system32\nsisvc.dll
17:17:29.0368 4928 nsi - ok
17:17:29.0400 4928 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\windows\system32\drivers\nsiproxy.sys
17:17:29.0462 4928 nsiproxy - ok
17:17:29.0540 4928 [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs C:\windows\system32\drivers\Ntfs.sys
17:17:29.0587 4928 Ntfs - ok
17:17:29.0602 4928 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\windows\system32\drivers\Null.sys
17:17:29.0634 4928 Null - ok
17:17:29.0977 4928 [ 7328528DAF9B8A486E16595A35043DB0 ] nvlddmkm C:\windows\system32\DRIVERS\nvlddmkm.sys
17:17:30.0195 4928 nvlddmkm - ok
17:17:30.0226 4928 [ 8AE5A124F3B65C3EC531D251A3E9C87F ] nvpciflt C:\windows\system32\DRIVERS\nvpciflt.sys
17:17:30.0242 4928 nvpciflt - ok
17:17:30.0273 4928 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\windows\system32\drivers\nvraid.sys
17:17:30.0273 4928 nvraid - ok
17:17:30.0289 4928 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\windows\system32\drivers\nvstor.sys
17:17:30.0304 4928 nvstor - ok
17:17:30.0351 4928 [ CEA3416907C17BB6623D9CB1E015B3C4 ] NVSvc C:\windows\system32\nvvsvc.exe
17:17:30.0382 4928 NVSvc - ok
17:17:30.0476 4928 [ 741688E5A65CC43567BCC329AE130075 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
17:17:30.0523 4928 nvUpdatusService - ok
17:17:30.0554 4928 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\windows\system32\drivers\nv_agp.sys
17:17:30.0585 4928 nv_agp - ok
17:17:30.0601 4928 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\windows\system32\drivers\ohci1394.sys
17:17:30.0648 4928 ohci1394 - ok
17:17:30.0679 4928 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\windows\system32\pnrpsvc.dll
17:17:30.0710 4928 p2pimsvc - ok
17:17:30.0741 4928 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\windows\system32\p2psvc.dll
17:17:30.0772 4928 p2psvc - ok
17:17:30.0788 4928 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\windows\system32\drivers\parport.sys
17:17:30.0819 4928 Parport - ok
17:17:30.0835 4928 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\windows\system32\drivers\partmgr.sys
17:17:30.0866 4928 partmgr - ok
17:17:30.0866 4928 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\windows\System32\pcasvc.dll
17:17:30.0913 4928 PcaSvc - ok
17:17:30.0928 4928 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\windows\system32\drivers\pci.sys
17:17:30.0928 4928 pci - ok
17:17:30.0960 4928 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\windows\system32\drivers\pciide.sys
17:17:30.0960 4928 pciide - ok
17:17:30.0975 4928 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\windows\system32\drivers\pcmcia.sys
17:17:30.0991 4928 pcmcia - ok
17:17:31.0006 4928 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\windows\system32\drivers\pcw.sys
17:17:31.0006 4928 pcw - ok
17:17:31.0038 4928 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\windows\system32\drivers\peauth.sys
17:17:31.0084 4928 PEAUTH - ok
17:17:31.0194 4928 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\windows\SysWow64\perfhost.exe
17:17:31.0240 4928 PerfHost - ok
17:17:31.0318 4928 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\windows\system32\pla.dll
17:17:31.0396 4928 pla - ok
17:17:31.0443 4928 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\windows\system32\umpnpmgr.dll
17:17:31.0506 4928 PlugPlay - ok
17:17:31.0521 4928 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\windows\system32\pnrpauto.dll
17:17:31.0552 4928 PNRPAutoReg - ok
17:17:31.0584 4928 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\windows\system32\pnrpsvc.dll
17:17:31.0615 4928 PNRPsvc - ok
17:17:31.0646 4928 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\windows\System32\ipsecsvc.dll
17:17:31.0708 4928 PolicyAgent - ok
17:17:31.0740 4928 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\windows\system32\umpo.dll
17:17:31.0786 4928 Power - ok
17:17:31.0833 4928 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\windows\system32\DRIVERS\raspptp.sys
17:17:31.0911 4928 PptpMiniport - ok
17:17:31.0927 4928 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\windows\system32\drivers\processr.sys
17:17:31.0958 4928 Processor - ok
17:17:32.0005 4928 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\windows\system32\profsvc.dll
17:17:32.0036 4928 ProfSvc - ok
17:17:32.0052 4928 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe
17:17:32.0067 4928 ProtectedStorage - ok
17:17:32.0098 4928 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\windows\system32\DRIVERS\pacer.sys
17:17:32.0145 4928 Psched - ok
17:17:32.0223 4928 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\windows\system32\drivers\ql2300.sys
17:17:32.0254 4928 ql2300 - ok
17:17:32.0286 4928 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\windows\system32\drivers\ql40xx.sys
17:17:32.0301 4928 ql40xx - ok
17:17:32.0317 4928 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\windows\system32\qwave.dll
17:17:32.0348 4928 QWAVE - ok
17:17:32.0364 4928 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\windows\system32\drivers\qwavedrv.sys
17:17:32.0395 4928 QWAVEdrv - ok
17:17:32.0410 4928 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\windows\system32\DRIVERS\rasacd.sys
17:17:32.0442 4928 RasAcd - ok
17:17:32.0473 4928 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\windows\system32\DRIVERS\AgileVpn.sys
17:17:32.0535 4928 RasAgileVpn - ok
17:17:32.0535 4928 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\windows\System32\rasauto.dll
17:17:32.0598 4928 RasAuto - ok
17:17:32.0629 4928 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\windows\system32\DRIVERS\rasl2tp.sys
17:17:32.0722 4928 Rasl2tp - ok
17:17:32.0738 4928 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\windows\System32\rasmans.dll
17:17:32.0785 4928 RasMan - ok
17:17:32.0785 4928 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\windows\system32\DRIVERS\raspppoe.sys
17:17:32.0847 4928 RasPppoe - ok
17:17:32.0878 4928 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\windows\system32\DRIVERS\rassstp.sys
17:17:32.0941 4928 RasSstp - ok
17:17:32.0972 4928 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\windows\system32\DRIVERS\rdbss.sys
17:17:33.0019 4928 rdbss - ok
17:17:33.0050 4928 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\windows\system32\drivers\rdpbus.sys
17:17:33.0066 4928 rdpbus - ok
17:17:33.0081 4928 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\windows\system32\DRIVERS\RDPCDD.sys
17:17:33.0159 4928 RDPCDD - ok
17:17:33.0190 4928 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\windows\system32\drivers\rdpencdd.sys
17:17:33.0222 4928 RDPENCDD - ok
17:17:33.0222 4928 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\windows\system32\drivers\rdprefmp.sys
17:17:33.0268 4928 RDPREFMP - ok
17:17:33.0284 4928 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\windows\system32\drivers\RDPWD.sys
17:17:33.0331 4928 RDPWD - ok
17:17:33.0346 4928 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\windows\system32\drivers\rdyboost.sys
17:17:33.0362 4928 rdyboost - ok
17:17:33.0409 4928 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\windows\System32\mprdim.dll
17:17:33.0502 4928 RemoteAccess - ok
17:17:33.0549 4928 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\windows\system32\regsvc.dll
17:17:33.0580 4928 RemoteRegistry - ok
17:17:33.0612 4928 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\windows\system32\DRIVERS\rfcomm.sys
17:17:33.0643 4928 RFCOMM - ok
17:17:33.0658 4928 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\windows\System32\RpcEpMap.dll
17:17:33.0705 4928 RpcEptMapper - ok
17:17:33.0736 4928 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\windows\system32\locator.exe
17:17:33.0752 4928 RpcLocator - ok
17:17:33.0768 4928 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\windows\system32\rpcss.dll
17:17:33.0814 4928 RpcSs - ok
17:17:33.0830 4928 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\windows\system32\DRIVERS\rspndr.sys
17:17:33.0877 4928 rspndr - ok
17:17:33.0908 4928 [ E54A5586A28D0630A79A68BBAB84BFCF ] RSUSBVSTOR C:\windows\system32\Drivers\RtsUVStor.sys
17:17:33.0908 4928 RSUSBVSTOR - ok
17:17:33.0924 4928 [ 20A466B9EA2BD828C0EC723F99B8CFE7 ] RTL8167 C:\windows\system32\DRIVERS\Rt64win7.sys
17:17:33.0939 4928 RTL8167 - ok
17:17:33.0955 4928 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\windows\system32\lsass.exe
17:17:33.0970 4928 SamSs - ok
17:17:33.0986 4928 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\windows\system32\drivers\sbp2port.sys
17:17:34.0002 4928 sbp2port - ok
17:17:34.0033 4928 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\windows\System32\SCardSvr.dll
17:17:34.0080 4928 SCardSvr - ok
17:17:34.0095 4928 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\windows\system32\DRIVERS\scfilter.sys
17:17:34.0142 4928 scfilter - ok
17:17:34.0189 4928 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\windows\system32\schedsvc.dll
17:17:34.0251 4928 Schedule - ok
17:17:34.0282 4928 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\windows\System32\certprop.dll
17:17:34.0314 4928 SCPolicySvc - ok
17:17:34.0329 4928 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\windows\System32\SDRSVC.dll
17:17:34.0360 4928 SDRSVC - ok
17:17:34.0407 4928 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\windows\system32\drivers\secdrv.sys
17:17:34.0470 4928 secdrv - ok
17:17:34.0485 4928 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\windows\system32\seclogon.dll
17:17:34.0579 4928 seclogon - ok
17:17:34.0594 4928 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\windows\system32\sens.dll
17:17:34.0672 4928 SENS - ok
17:17:34.0704 4928 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\windows\system32\sensrsvc.dll
17:17:34.0766 4928 SensrSvc - ok
17:17:34.0782 4928 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\windows\system32\drivers\serenum.sys
17:17:34.0813 4928 Serenum - ok
17:17:34.0875 4928 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\windows\system32\drivers\serial.sys
17:17:34.0922 4928 Serial - ok
17:17:34.0984 4928 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\windows\system32\drivers\sermouse.sys
17:17:35.0031 4928 sermouse - ok
17:17:35.0078 4928 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\windows\system32\sessenv.dll
17:17:35.0140 4928 SessionEnv - ok
17:17:35.0156 4928 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\windows\system32\drivers\sffdisk.sys
17:17:35.0156 4928 sffdisk - ok
17:17:35.0172 4928 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\windows\system32\drivers\sffp_mmc.sys
17:17:35.0187 4928 sffp_mmc - ok
17:17:35.0187 4928 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\windows\system32\drivers\sffp_sd.sys
17:17:35.0203 4928 sffp_sd - ok
17:17:35.0218 4928 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\windows\system32\drivers\sfloppy.sys
17:17:35.0234 4928 sfloppy - ok
17:17:35.0281 4928 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\windows\System32\ipnathlp.dll
17:17:35.0328 4928 SharedAccess - ok
17:17:35.0374 4928 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll
17:17:35.0406 4928 ShellHWDetection - ok
17:17:35.0437 4928 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\windows\system32\drivers\SiSRaid2.sys
17:17:35.0452 4928 SiSRaid2 - ok
17:17:35.0468 4928 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\windows\system32\drivers\sisraid4.sys
17:17:35.0484 4928 SiSRaid4 - ok
17:17:35.0546 4928 [ 7C15061CD0372487903B07B9BB03AFAD ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
17:17:35.0577 4928 SkypeUpdate - ok
17:17:35.0608 4928 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\windows\system32\DRIVERS\smb.sys
17:17:35.0686 4928 Smb - ok
17:17:35.0733 4928 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\windows\System32\snmptrap.exe
17:17:35.0764 4928 SNMPTRAP - ok
17:17:35.0811 4928 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\windows\system32\drivers\spldr.sys
17:17:35.0842 4928 spldr - ok
17:17:35.0874 4928 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\windows\System32\spoolsv.exe
17:17:35.0889 4928 Spooler - ok
17:17:35.0998 4928 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\windows\system32\sppsvc.exe
17:17:36.0092 4928 sppsvc - ok
17:17:36.0123 4928 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\windows\system32\sppuinotify.dll
17:17:36.0170 4928 sppuinotify - ok
17:17:36.0201 4928 [ 454800C2BC7F3927CE030141EE4F4C50 ] SPUVCbv C:\windows\system32\Drivers\usbvideo.sys
17:17:36.0217 4928 SPUVCbv - ok
17:17:36.0232 4928 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\windows\system32\DRIVERS\srv.sys
17:17:36.0264 4928 srv - ok
17:17:36.0295 4928 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\windows\system32\DRIVERS\srv2.sys
17:17:36.0342 4928 srv2 - ok
17:17:36.0373 4928 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\windows\system32\DRIVERS\srvnet.sys
17:17:36.0373 4928 srvnet - ok
17:17:36.0404 4928 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\windows\System32\ssdpsrv.dll
17:17:36.0435 4928 SSDPSRV - ok
17:17:36.0451 4928 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\windows\system32\sstpsvc.dll
17:17:36.0498 4928 SstpSvc - ok
17:17:36.0529 4928 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\windows\system32\drivers\stexstor.sys
17:17:36.0544 4928 stexstor - ok
17:17:36.0560 4928 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\windows\System32\wiaservc.dll
17:17:36.0607 4928 stisvc - ok
17:17:36.0622 4928 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\windows\system32\DRIVERS\swenum.sys
17:17:36.0638 4928 swenum - ok
17:17:36.0654 4928 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\windows\System32\swprv.dll
17:17:36.0716 4928 swprv - ok
17:17:36.0763 4928 [ 08425CD92972C6430F350A9697F4A553 ] SynTP C:\windows\system32\DRIVERS\SynTP.sys
17:17:36.0794 4928 SynTP - ok
17:17:36.0841 4928 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\windows\system32\sysmain.dll
17:17:36.0903 4928 SysMain - ok
17:17:36.0919 4928 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll
17:17:36.0981 4928 TabletInputService - ok
17:17:36.0997 4928 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\windows\System32\tapisrv.dll
17:17:37.0044 4928 TapiSrv - ok
17:17:37.0044 4928 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\windows\System32\tbssvc.dll
17:17:37.0106 4928 TBS - ok
17:17:37.0200 4928 [ 9849EA3843A2ADBDD1497E97A85D8CAE ] Tcpip C:\windows\system32\drivers\tcpip.sys
17:17:37.0246 4928 Tcpip - ok
17:17:37.0324 4928 [ 9849EA3843A2ADBDD1497E97A85D8CAE ] TCPIP6 C:\windows\system32\DRIVERS\tcpip.sys
17:17:37.0371 4928 TCPIP6 - ok
17:17:37.0402 4928 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\windows\system32\drivers\tcpipreg.sys
17:17:37.0418 4928 tcpipreg - ok
17:17:37.0434 4928 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\windows\system32\drivers\tdpipe.sys
17:17:37.0496 4928 TDPIPE - ok
17:17:37.0527 4928 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\windows\system32\drivers\tdtcp.sys
17:17:37.0543 4928 TDTCP - ok
17:17:37.0558 4928 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\windows\system32\DRIVERS\tdx.sys
17:17:37.0590 4928 tdx - ok
17:17:37.0605 4928 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\windows\system32\DRIVERS\termdd.sys
17:17:37.0621 4928 TermDD - ok
17:17:37.0652 4928 [ 2E648163254233755035B46DD7B89123 ] TermService C:\windows\System32\termsrv.dll
17:17:37.0683 4928 TermService - ok
17:17:37.0699 4928 [ F0344071948D1A1FA732231785A0664C ] Themes C:\windows\system32\themeservice.dll
17:17:37.0714 4928 Themes - ok
17:17:37.0730 4928 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\windows\system32\mmcss.dll
17:17:37.0761 4928 THREADORDER - ok
17:17:37.0777 4928 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\windows\System32\trkwks.dll
17:17:37.0824 4928 TrkWks - ok
17:17:37.0886 4928 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
17:17:37.0948 4928 TrustedInstaller - ok
17:17:37.0964 4928 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\windows\system32\DRIVERS\tssecsrv.sys
17:17:38.0011 4928 tssecsrv - ok
17:17:38.0026 4928 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\windows\system32\drivers\tsusbflt.sys
17:17:38.0089 4928 TsUsbFlt - ok
17:17:38.0120 4928 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\windows\system32\drivers\TsUsbGD.sys
17:17:38.0136 4928 TsUsbGD - ok
17:17:38.0167 4928 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\windows\system32\DRIVERS\tunnel.sys
17:17:38.0214 4928 tunnel - ok
17:17:38.0245 4928 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\windows\system32\drivers\uagp35.sys
17:17:38.0260 4928 uagp35 - ok
17:17:38.0276 4928 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\windows\system32\DRIVERS\udfs.sys
17:17:38.0338 4928 udfs - ok
17:17:38.0370 4928 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\windows\system32\UI0Detect.exe
17:17:38.0401 4928 UI0Detect - ok
17:17:38.0448 4928 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\windows\system32\drivers\uliagpkx.sys
17:17:38.0463 4928 uliagpkx - ok
17:17:38.0479 4928 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\windows\system32\DRIVERS\umbus.sys
17:17:38.0526 4928 umbus - ok
17:17:38.0526 4928 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\windows\system32\drivers\umpass.sys
17:17:38.0541 4928 UmPass - ok
17:17:38.0635 4928 [ 7E5E1603D0FF2D240AE70295C5C3FEFC ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
17:17:38.0682 4928 UNS - ok
17:17:38.0713 4928 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\windows\System32\upnphost.dll
17:17:38.0775 4928 upnphost - ok
17:17:38.0806 4928 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\windows\system32\DRIVERS\usbccgp.sys
17:17:38.0869 4928 usbccgp - ok
17:17:38.0884 4928 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\windows\system32\drivers\usbcir.sys
17:17:38.0900 4928 usbcir - ok
17:17:38.0916 4928 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\windows\system32\DRIVERS\usbehci.sys
17:17:38.0916 4928 usbehci - ok
17:17:38.0947 4928 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\windows\system32\DRIVERS\usbhub.sys
17:17:38.0962 4928 usbhub - ok
17:17:38.0978 4928 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\windows\system32\drivers\usbohci.sys
17:17:38.0994 4928 usbohci - ok
17:17:39.0025 4928 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\windows\system32\DRIVERS\usbprint.sys
17:17:39.0072 4928 usbprint - ok
17:17:39.0118 4928 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\windows\system32\DRIVERS\usbscan.sys
17:17:39.0150 4928 usbscan - ok
17:17:39.0165 4928 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\windows\system32\DRIVERS\USBSTOR.SYS
17:17:39.0228 4928 USBSTOR - ok
17:17:39.0259 4928 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\windows\system32\drivers\usbuhci.sys
17:17:39.0306 4928 usbuhci - ok
17:17:39.0352 4928 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\windows\system32\Drivers\usbvideo.sys
17:17:39.0384 4928 usbvideo - ok
17:17:39.0415 4928 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\windows\System32\uxsms.dll
17:17:39.0493 4928 UxSms - ok
17:17:39.0493 4928 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\windows\system32\lsass.exe
17:17:39.0508 4928 VaultSvc - ok
17:17:39.0555 4928 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\windows\system32\drivers\vdrvroot.sys
17:17:39.0586 4928 vdrvroot - ok
17:17:39.0602 4928 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\windows\System32\vds.exe
17:17:39.0680 4928 vds - ok
17:17:39.0680 4928 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\windows\system32\DRIVERS\vgapnp.sys
17:17:39.0696 4928 vga - ok
17:17:39.0711 4928 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\windows\System32\drivers\vga.sys
17:17:39.0789 4928 VgaSave - ok
17:17:39.0820 4928 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\windows\system32\drivers\vhdmp.sys
17:17:39.0820 4928 vhdmp - ok
17:17:39.0852 4928 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\windows\system32\drivers\viaide.sys
17:17:39.0867 4928 viaide - ok
17:17:39.0883 4928 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\windows\system32\drivers\volmgr.sys
17:17:39.0898 4928 volmgr - ok
17:17:39.0914 4928 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\windows\system32\drivers\volmgrx.sys
17:17:39.0930 4928 volmgrx - ok
17:17:39.0945 4928 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\windows\system32\drivers\volsnap.sys
17:17:39.0961 4928 volsnap - ok
17:17:39.0976 4928 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\windows\system32\drivers\vsmraid.sys
17:17:39.0992 4928 vsmraid - ok
17:17:40.0055 4928 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\windows\system32\vssvc.exe
17:17:40.0133 4928 VSS - ok
17:17:40.0164 4928 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\windows\system32\DRIVERS\vwifibus.sys
17:17:40.0195 4928 vwifibus - ok
17:17:40.0211 4928 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\windows\system32\DRIVERS\vwififlt.sys
17:17:40.0257 4928 vwififlt - ok
17:17:40.0289 4928 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\windows\system32\w32time.dll
17:17:40.0320 4928 W32Time - ok
17:17:40.0335 4928 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\windows\system32\drivers\wacompen.sys
17:17:40.0382 4928 WacomPen - ok
17:17:40.0413 4928 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\windows\system32\DRIVERS\wanarp.sys
17:17:40.0491 4928 WANARP - ok
17:17:40.0491 4928 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\windows\system32\DRIVERS\wanarp.sys
17:17:40.0523 4928 Wanarpv6 - ok
17:17:40.0569 4928 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\windows\system32\wbengine.exe
17:17:40.0663 4928 wbengine - ok
17:17:40.0679 4928 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\windows\System32\wbiosrvc.dll
17:17:40.0694 4928 WbioSrvc - ok
17:17:40.0710 4928 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\windows\System32\wcncsvc.dll
17:17:40.0757 4928 wcncsvc - ok
17:17:40.0788 4928 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
17:17:40.0835 4928 WcsPlugInService - ok
17:17:40.0866 4928 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\windows\system32\drivers\wd.sys
17:17:40.0866 4928 Wd - ok
17:17:40.0897 4928 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\windows\system32\drivers\Wdf01000.sys
17:17:40.0928 4928 Wdf01000 - ok
17:17:40.0928 4928 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\windows\system32\wdi.dll
17:17:41.0006 4928 WdiServiceHost - ok
17:17:41.0006 4928 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\windows\system32\wdi.dll
17:17:41.0037 4928 WdiSystemHost - ok
17:17:41.0053 4928 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\windows\System32\webclnt.dll
17:17:41.0115 4928 WebClient - ok
17:17:41.0131 4928 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\windows\system32\wecsvc.dll
17:17:41.0193 4928 Wecsvc - ok
17:17:41.0225 4928 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\windows\System32\wercplsupport.dll
17:17:41.0303 4928 wercplsupport - ok
17:17:41.0334 4928 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\windows\System32\WerSvc.dll
17:17:41.0365 4928 WerSvc - ok
17:17:41.0381 4928 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\windows\system32\DRIVERS\wfplwf.sys
17:17:41.0427 4928 WfpLwf - ok
17:17:41.0427 4928 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\windows\system32\drivers\wimmount.sys
17:17:41.0443 4928 WIMMount - ok
17:17:41.0459 4928 WinDefend - ok
17:17:41.0474 4928 WinHttpAutoProxySvc - ok
17:17:41.0537 4928 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\windows\system32\wbem\WMIsvc.dll
17:17:41.0615 4928 Winmgmt - ok
17:17:41.0677 4928 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\windows\system32\WsmSvc.dll
17:17:41.0739 4928 WinRM - ok
17:17:41.0786 4928 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\windows\system32\DRIVERS\WinUsb.sys
17:17:41.0802 4928 WinUsb - ok
17:17:41.0833 4928 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\windows\System32\wlansvc.dll
17:17:41.0895 4928 Wlansvc - ok
17:17:42.0036 4928 [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
17:17:42.0083 4928 wlidsvc - ok
17:17:42.0114 4928 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\windows\system32\DRIVERS\wmiacpi.sys
17:17:42.0161 4928 WmiAcpi - ok
17:17:42.0207 4928 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\windows\system32\wbem\WmiApSrv.exe
17:17:42.0239 4928 wmiApSrv - ok
17:17:42.0285 4928 WMPNetworkSvc - ok
17:17:42.0317 4928 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\windows\System32\wpcsvc.dll
17:17:42.0363 4928 WPCSvc - ok
17:17:42.0395 4928 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\windows\system32\wpdbusenum.dll
17:17:42.0410 4928 WPDBusEnum - ok
17:17:42.0441 4928 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\windows\system32\drivers\ws2ifsl.sys
17:17:42.0488 4928 ws2ifsl - ok
17:17:42.0551 4928 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\windows\system32\wscsvc.dll
17:17:42.0597 4928 wscsvc - ok
17:17:42.0613 4928 WSearch - ok
17:17:42.0660 4928 [ 83575C43B2BFE9AB0661A7F957E843C0 ] wsvd C:\windows\system32\DRIVERS\wsvd.sys
17:17:42.0691 4928 wsvd - ok
17:17:42.0769 4928 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\windows\system32\wuaueng.dll
17:17:42.0831 4928 wuauserv - ok
17:17:42.0863 4928 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\windows\system32\drivers\WudfPf.sys
17:17:42.0925 4928 WudfPf - ok
17:17:42.0956 4928 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\windows\system32\DRIVERS\WUDFRd.sys
17:17:43.0019 4928 WUDFRd - ok
17:17:43.0034 4928 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\windows\System32\WUDFSvc.dll
17:17:43.0081 4928 wudfsvc - ok
17:17:43.0128 4928 [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc C:\windows\System32\wwansvc.dll
17:17:43.0159 4928 WwanSvc - ok
17:17:43.0190 4928 ================ Scan global ===============================
17:17:43.0221 4928 [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll
17:17:43.0253 4928 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
17:17:43.0284 4928 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
17:17:43.0299 4928 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll
17:17:43.0331 4928 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe
17:17:43.0331 4928 [Global] - ok
17:17:43.0331 4928 ================ Scan MBR ==================================
17:17:43.0346 4928 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
17:17:43.0705 4928 \Device\Harddisk0\DR0 - ok
17:17:43.0705 4928 ================ Scan VBR ==================================
17:17:43.0705 4928 [ D34C5D2DCB71607AE92653B2E5B9BA8F ] \Device\Harddisk0\DR0\Partition1
17:17:43.0705 4928 \Device\Harddisk0\DR0\Partition1 - ok
17:17:43.0752 4928 [ 8B8508621AFBFDF05462CAA4D2DCD238 ] \Device\Harddisk0\DR0\Partition2
17:17:43.0752 4928 \Device\Harddisk0\DR0\Partition2 - ok
17:17:43.0783 4928 [ 740A8B5506E2227B4588C8F929F8D2FF ] \Device\Harddisk0\DR0\Partition3
17:17:43.0783 4928 \Device\Harddisk0\DR0\Partition3 - ok
17:17:43.0783 4928 ============================================================
17:17:43.0783 4928 Scan finished
17:17:43.0783 4928 ============================================================
17:17:43.0799 4600 Detected object count: 1
17:17:43.0799 4600 Actual detected object count: 1
17:18:05.0093 4600 AdobeFlashPlayerUpdateSvc ( UnsignedFile.Multi.Generic ) - skipped by user
17:18:05.0093 4600 AdobeFlashPlayerUpdateSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
17:18:29.0148 3004 Deinitialize success
|
|
07.08.2013, 16:34
| #10 |
| /// Malware-holic | Viren gefunden - Logdatei auswerten Kannst du gerne behalten, war nur als unnötig gekennzeichnet :-) Es sind 3 Logs zu erstellen, poste sie wieder möglichst gleichzeitig. 1. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
neustarten. 2. Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
neustarten. 3. HitmanPro - Download - Filepony Hitmanpro laden, doppelklicken, Scan klicken. Log speichern und posten, bzw als XML exportieren, packen und anhängen, Hitmanpro schließen.b
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.08.2013, 17:02
| #11 |
| | Viren gefunden - Logdatei auswertenCode:
ATTFilter # AdwCleaner v2.306 - Datei am 07/08/2013 um 17:37:59 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : NAME - NAME2
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\NAME\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v22.0 (de)
Datei : C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\ldtoh93l.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [12450 octets] - [05/08/2013 20:33:33]
AdwCleaner[S1].txt - [11171 octets] - [05/08/2013 20:33:58]
AdwCleaner[S2].txt - [872 octets] - [07/08/2013 17:37:59]
########## EOF - C:\AdwCleaner[S2].txt - [931 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.3.4 (08.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by NAME on 07.08.2013 at 17:42:49,39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricsmonkey
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\NAME\AppData\Roaming\goforfiles"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.08.2013 at 17:48:19,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter HitmanPro 3.7.7.203
www.hitmanpro.com
Computer name . . . . : NAME2
Windows . . . . . . . : 6.1.1.7601.X64/4
User name . . . . . . : NAME2\NAME
UAC . . . . . . . . . : Disabled
License . . . . . . . : Trial (30 days left)
Scan date . . . . . . : 2013-08-07 17:53:37
Scan mode . . . . . . : Normal
Scan duration . . . . : 3m 23s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : Yes
Threats . . . . . . . : 21
Traces . . . . . . . : 91
Objects scanned . . . : 1.272.302
Files scanned . . . . : 9.802
Remnants scanned . . : 189.799 files / 1.072.701 keys
Malware _____________________________________________________________________
C:\windows\SysWOW64\FlashPlayerUpdateService.exe -> Quarantined
Size . . . . . . . : 163.328 bytes
Age . . . . . . . : 50.0 days (2013-06-18 18:23:00)
Entropy . . . . . : 6.4
SHA-256 . . . . . : B2CAD8322DB85F67DB6EA074D00C2ED56CE1FA92952D07B70BAAC249FA18236D
Product . . . . . : Adobe® Flash® Player Update Service
Publisher . . . . : Adobe Systems Incorporated
Description . . . : Adobe® Flash® Player Update Service 11.6 r602
Version . . . . . : 11,6,602,180
Copyright . . . . : Copyright © 1996 Adobe Systems Incorporated
> Kaspersky . . . . : Trojan-Downloader.Win32.MultiDL.c
Fuzzy . . . . . . : 102.0
C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -> Quarantined
Size . . . . . . . : 163.328 bytes
Age . . . . . . . : 486.8 days (2012-04-07 23:26:27)
Entropy . . . . . : 6.4
SHA-256 . . . . . : B2CAD8322DB85F67DB6EA074D00C2ED56CE1FA92952D07B70BAAC249FA18236D
Product . . . . . : Adobe® Flash® Player Update Service
Publisher . . . . : Adobe Systems Incorporated
Description . . . : Adobe® Flash® Player Update Service 11.6 r602
Version . . . . . : 11,6,602,180
Copyright . . . . : Copyright © 1996 Adobe Systems Incorporated
Service . . . . . : AdobeFlashPlayerUpdateSvc
Parent Name . . . : C:\windows\system32\services.exe
Running processes : 2640
> Kaspersky . . . . : Trojan-Downloader.Win32.MultiDL.c
Fuzzy . . . . . . : 107.0
Startup
C:\windows\Tasks\Adobe Flash Player Updater.job
HKLM\SYSTEM\CurrentControlSet\Services\AdobeFlashPlayerUpdateSvc\
Potential Unwanted Programs _________________________________________________
HKU\S-1-5-21-1334398745-1784092212-229574685-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)
Cookies _____________________________________________________________________
C:\Users\NAME\AppData\Roaming\Microsoft\Windows\Cookies\H49NQBUS.txt
C:\Users\NAME\AppData\Roaming\Microsoft\Windows\Cookies\PQPWTZDL.txt
|
|
07.08.2013, 17:18
| #12 |
| /// Malware-holic | Viren gefunden - Logdatei auswerten Hi löschen solltest du eig noch nicht. lass es noch mal laufen, lösche die unter Potential Unwanted Programs und Kookies, während des Durchlaufs alle Browser schließen. bitte poste ein abschließenes FRST Log.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.08.2013, 17:39
| #13 |
| | Viren gefunden - Logdatei auswerten Oh sorry, bin nach der verlinkten Anleitung vom Programm Hitman verfahren. FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-08-2013
Ran by NAME (administrator) on 07-08-2013 18:32:59
Running from C:\Users\NAME\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Meine Programme\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Meine Programme\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Meine Programme\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Meine Programme\Avira\AntiVir Desktop\avshadow.exe
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13353064 2011-11-14] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2538280 2010-12-22] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo EE Boot Optimizer] - C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2012-02-16] (Lenovo)
HKLM\...\Run: [OnekeyStudio] - C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2012-02-16] (Lenovo)
HKLM-x32\...\Run: [avgnt] - C:\Meine Programme\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [226920 2011-03-06] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\ldtoh93l.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.finanzen.net/rohstoffe/goldpreis/euro
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\NAME\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\NAME\AppData\Roaming\Mozilla\Firefox\Profiles\ldtoh93l.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF StartMenuInternet: FIREFOX.EXE - C:\Meine Programme\Mozilla Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Meine Programme\Avira\AntiVir Desktop\sched.exe [86224 2012-05-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Meine Programme\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-08] (Avira Operations GmbH & Co. KG)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [956192 2011-02-15] (Broadcom Corporation.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-08] (Avira GmbH)
R1 avgtp; C:\windows\system32\drivers\avgtpx64.sys [39768 2013-04-04] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-08] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-16] (Avira GmbH)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-28] (DT Soft Ltd)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SPUVCbv; C:\Windows\System32\Drivers\usbvideo.sys [184960 2010-11-21] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U2 CLKMSVC10_3A60B698;
U2 CLKMSVC10_C3B3B687;
U2 DriverService;
U2 IAStorDataMgrSvc;
U2 idealife Update Service;
U3 IGRS;
U2 IviRegMgr;
U2 Oasis2Service;
U2 PCCarerServic;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
U2 RtLedService;
U2 SoftwareService;
U2 Stereo Service;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-07 18:30 - 2013-08-07 18:30 - 00001936 _____ C:\Users\NAME\Desktop\HitmanPro_20130807_1830.log
2013-08-07 17:58 - 2013-08-07 18:00 - 00005958 _____ C:\Users\NAME\Desktop\HitmanPro_20130807_1758.log
2013-08-07 17:57 - 2013-08-07 17:57 - 00000806 _____ C:\windows\system32\.crusader
2013-08-07 17:53 - 2013-08-07 17:58 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-07 17:52 - 2013-08-07 17:53 - 09853928 _____ (SurfRight B.V.) C:\Users\NAME\Desktop\HitmanPro_x64(1).exe
2013-08-07 17:52 - 2013-08-07 17:52 - 09853928 _____ (SurfRight B.V.) C:\Users\NAME\Desktop\HitmanPro_x64.exe
2013-08-07 17:49 - 2013-08-07 17:41 - 00000967 _____ C:\Users\NAME\Desktop\AdwCleaner[S2].txt
2013-08-07 17:48 - 2013-08-07 17:49 - 00000801 _____ C:\Users\NAME\Desktop\JRT.txt
2013-08-07 17:42 - 2013-08-07 17:42 - 00563461 _____ (Oleg N. Scherbakov) C:\Users\NAME\Desktop\JRT.exe
2013-08-07 17:42 - 2013-08-07 17:42 - 00000000 ____D C:\windows\ERUNT
2013-08-07 17:39 - 2013-08-07 17:39 - 00000999 _____ C:\Users\NAME\Desktop\1.txt
2013-08-07 17:37 - 2013-08-07 17:41 - 00000967 _____ C:\AdwCleaner[S2].txt
2013-08-07 17:37 - 2013-08-07 17:37 - 00666633 _____ C:\Users\NAME\Desktop\adwcleaner.exe
2013-08-07 17:16 - 2013-08-07 17:16 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\NAME\Desktop\tdsskiller.exe
2013-08-07 17:15 - 2013-08-07 17:15 - 00012780 _____ C:\Users\NAME\Desktop\a.txt
2013-08-07 17:11 - 2013-08-07 17:15 - 00012780 _____ C:\ComboFix.txt
2013-08-07 17:01 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-08-07 17:01 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-08-07 17:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-08-07 17:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-08-07 17:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-08-07 17:01 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-08-07 17:01 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-08-07 17:01 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-08-07 17:00 - 2013-08-07 17:11 - 00000000 ____D C:\Qoobox
2013-08-07 17:00 - 2013-08-07 17:09 - 00000000 ____D C:\windows\erdnt
2013-08-07 16:58 - 2013-08-07 16:59 - 05100713 ____R (Swearware) C:\Users\NAME\Desktop\ComboFix.exe
2013-08-07 16:56 - 2013-08-07 17:38 - 00001312 _____ C:\windows\PFRO.log
2013-08-07 16:51 - 2013-08-07 16:51 - 00002019 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-07 16:51 - 2013-08-07 16:51 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-07 16:46 - 2013-08-07 16:52 - 00000000 ____D C:\Users\NAME~1\AppData\Local\Adobe
2013-08-07 16:46 - 2013-08-07 16:48 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-07 16:46 - 2013-08-07 16:48 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-05 20:33 - 2013-08-05 20:34 - 00011171 _____ C:\AdwCleaner[S1].txt
2013-08-05 20:33 - 2013-08-05 20:33 - 00012450 _____ C:\AdwCleaner[R1].txt
2013-08-05 20:29 - 2013-08-07 17:59 - 00000504 _____ C:\windows\setupact.log
2013-08-05 20:29 - 2013-08-05 20:29 - 00000000 _____ C:\windows\setuperr.log
2013-08-05 20:10 - 2013-08-05 20:10 - 00000000 ____D C:\Users\NAME~1\AppData\Local\Macromedia
2013-08-05 20:09 - 2013-08-05 20:09 - 00000000 ____D C:\Users\NAME~1\AppData\Local\Mozilla
2013-08-05 18:05 - 2013-08-05 18:05 - 00000000 ____D C:\FRST
2013-08-05 16:39 - 2013-08-05 16:39 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-05 16:39 - 2013-08-05 16:39 - 00000000 ____D C:\Users\NAME\AppData\Roaming\Malwarebytes
2013-08-05 16:39 - 2013-08-05 16:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-05 16:39 - 2013-08-05 16:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-05 16:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-08-05 14:13 - 2013-08-05 18:44 - 00000000 ____D C:\Users\NAME\Desktop\Abstellordner
2013-07-15 22:26 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-07-15 22:26 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-07-15 22:26 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-07-15 22:26 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-07-15 22:26 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-07-15 22:26 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-07-15 22:26 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-07-15 22:26 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-07-15 22:26 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-07-15 22:26 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-07-15 22:26 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-07-15 22:26 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-07-15 22:26 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-07-15 22:26 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-07-15 22:26 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-07-15 22:26 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-07-15 22:26 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-07-15 22:26 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-15 22:26 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-07-15 22:26 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-07-15 22:26 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-07-15 22:25 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-07-10 21:08 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-07-10 21:08 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-07-10 21:08 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-07-10 21:08 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-07-10 21:06 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-07-10 21:01 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-07-10 21:01 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
106
==================== One Month Modified Files and Folders =======
2013-08-07 18:32 - 2013-08-07 18:32 - 01788943 _____ (Farbar) C:\Users\NAME\Desktop\FRST64.exe
2013-08-07 18:30 - 2013-08-07 18:30 - 00001936 _____ C:\Users\NAME\Desktop\HitmanPro_20130807_1830.log
2013-08-07 18:26 - 2009-07-14 06:45 - 00021072 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-07 18:26 - 2009-07-14 06:45 - 00021072 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-07 18:24 - 2012-02-17 01:45 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-08-07 18:24 - 2012-02-17 01:45 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-08-07 18:24 - 2009-07-14 07:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-08-07 18:02 - 2012-02-16 17:54 - 01514870 _____ C:\windows\WindowsUpdate.log
2013-08-07 18:00 - 2013-08-07 17:58 - 00005958 _____ C:\Users\NAME\Desktop\HitmanPro_20130807_1758.log
2013-08-07 17:59 - 2013-08-05 20:29 - 00000504 _____ C:\windows\setupact.log
2013-08-07 17:59 - 2012-02-16 18:40 - 00130643 _____ C:\windows\system32\fastboot.set
2013-08-07 17:59 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-08-07 17:58 - 2013-08-07 17:53 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-07 17:57 - 2013-08-07 17:57 - 00000806 _____ C:\windows\system32\.crusader
2013-08-07 17:53 - 2013-08-07 17:52 - 09853928 _____ (SurfRight B.V.) C:\Users\NAME\Desktop\HitmanPro_x64(1).exe
2013-08-07 17:52 - 2013-08-07 17:52 - 09853928 _____ (SurfRight B.V.) C:\Users\NAME\Desktop\HitmanPro_x64.exe
2013-08-07 17:49 - 2013-08-07 17:48 - 00000801 _____ C:\Users\NAME\Desktop\JRT.txt
2013-08-07 17:42 - 2013-08-07 17:42 - 00563461 _____ (Oleg N. Scherbakov) C:\Users\NAME\Desktop\JRT.exe
2013-08-07 17:42 - 2013-08-07 17:42 - 00000000 ____D C:\windows\ERUNT
2013-08-07 17:41 - 2013-08-07 17:49 - 00000967 _____ C:\Users\NAME\Desktop\AdwCleaner[S2].txt
2013-08-07 17:41 - 2013-08-07 17:37 - 00000967 _____ C:\AdwCleaner[S2].txt
2013-08-07 17:39 - 2013-08-07 17:39 - 00000999 _____ C:\Users\NAME\Desktop\1.txt
2013-08-07 17:38 - 2013-08-07 16:56 - 00001312 _____ C:\windows\PFRO.log
2013-08-07 17:37 - 2013-08-07 17:37 - 00666633 _____ C:\Users\NAME\Desktop\adwcleaner.exe
2013-08-07 17:16 - 2013-08-07 17:16 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\NAME\Desktop\tdsskiller.exe
2013-08-07 17:15 - 2013-08-07 17:15 - 00012780 _____ C:\Users\NAME\Desktop\a.txt
2013-08-07 17:15 - 2013-08-07 17:11 - 00012780 _____ C:\ComboFix.txt
2013-08-07 17:11 - 2013-08-07 17:00 - 00000000 ____D C:\Qoobox
2013-08-07 17:09 - 2013-08-07 17:00 - 00000000 ____D C:\windows\erdnt
2013-08-07 17:08 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-08-07 16:59 - 2013-08-07 16:58 - 05100713 ____R (Swearware) C:\Users\NAME\Desktop\ComboFix.exe
2013-08-07 16:55 - 2012-04-07 22:16 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-07 16:52 - 2013-08-07 16:46 - 00000000 ____D C:\Users\NAME~1\AppData\Local\Adobe
2013-08-07 16:51 - 2013-08-07 16:51 - 00002019 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-08-07 16:51 - 2013-08-07 16:51 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-07 16:51 - 2012-04-09 17:41 - 00000000 ____D C:\ProgramData\Adobe
2013-08-07 16:48 - 2013-08-07 16:46 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-07 16:48 - 2013-08-07 16:46 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-05 20:34 - 2013-08-05 20:33 - 00011171 _____ C:\AdwCleaner[S1].txt
2013-08-05 20:34 - 2013-04-02 15:01 - 00000828 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-05 20:34 - 2013-04-02 14:19 - 00000862 _____ C:\Users\NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2013-08-05 20:34 - 2012-04-07 21:07 - 00001009 _____ C:\Users\NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-05 20:33 - 2013-08-05 20:33 - 00012450 _____ C:\AdwCleaner[R1].txt
2013-08-05 20:29 - 2013-08-05 20:29 - 00000000 _____ C:\windows\setuperr.log
2013-08-05 20:22 - 2012-02-16 18:46 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-08-05 20:14 - 2012-04-07 22:49 - 00000000 ____D C:\Users\NAME\Desktop\Fotos
2013-08-05 20:10 - 2013-08-05 20:10 - 00000000 ____D C:\Users\NAME~1\AppData\Local\Macromedia
2013-08-05 20:09 - 2013-08-05 20:09 - 00000000 ____D C:\Users\NAME~1\AppData\Local\Mozilla
2013-08-05 20:06 - 2012-05-26 14:36 - 00001312 _____ C:\Users\NAME\Desktop\eXtra4.lnk
2013-08-05 18:44 - 2013-08-05 14:13 - 00000000 ____D C:\Users\NAME\Desktop\Abstellordner
2013-08-05 18:05 - 2013-08-05 18:05 - 00000000 ____D C:\FRST
2013-08-05 16:39 - 2013-08-05 16:39 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-05 16:39 - 2013-08-05 16:39 - 00000000 ____D C:\Users\NAME\AppData\Roaming\Malwarebytes
2013-08-05 16:39 - 2013-08-05 16:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-05 16:39 - 2013-08-05 16:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-05 14:17 - 2013-06-28 19:09 - 00000000 ____D C:\Users\NAME\AppData\Roaming\DAEMON Tools Lite
2013-08-05 14:17 - 2011-02-22 13:19 - 00000000 ____D C:\windows\Panther
2013-08-05 14:15 - 2013-04-25 17:06 - 00002790 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-08-05 14:15 - 2012-04-07 22:14 - 00000796 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-08-05 14:07 - 2012-04-07 21:03 - 00000000 ____D C:\Users\NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2013-08-05 14:07 - 2012-02-16 18:22 - 00000000 ____D C:\Program Files (x86)\Lenovo
2013-08-05 14:07 - 2012-02-16 18:04 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-16 11:00 - 2009-07-14 06:45 - 00283160 _____ C:\windows\system32\FNTCACHE.DAT
2013-07-16 10:59 - 2013-03-17 17:19 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-16 10:59 - 2013-03-17 17:19 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-15 23:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-15 23:48 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-15 23:47 - 2011-09-29 05:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-15 09:45 - 2012-04-26 13:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-04 20:38
==================== End Of Log ============================
|
|
07.08.2013, 17:43
| #14 |
| /// Malware-holic | Viren gefunden - Logdatei auswerten Hi, 1. bitte teste, ob es im Firefox, internet explorer, und sonstigen evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt. Teste wie pc und programme allgemein laufen. (evtl. mit Besitzer) 2. Wenn alles gut läuft: Die Reihenfolge ist hier entscheidend.
3. PC absichern: als antimalware programm würde ich emsisoft empfehlen. diese haben für mich den besten schutz kostet aber etwas. Computeractive Software Store - Emsisoft Anti-Malware 8 [1-PC] - 63% off RRP testversion: Meine Antivirus-Empfehlung: Emsisoft Anti-Malware insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren. vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen. kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen. http://www.trojaner-board.de/110895-...antivirus.html sag mir welches du nutzt, dann gebe ich konfigurationshinweise. bitte dein bisheriges av deinstalieren die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch! http://www.trojaner-board.de/96344-a...-rechners.html Starte bitte mit der Passage, Windows Vista und Windows 7 Bitte beginne damit, Windows Updates zu instalieren. Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst. Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist: - Updates automatisch Instalieren, - Täglich - Uhrzeit wählen - Bitte den gesammten rest anhaken, außer: - detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist. Klicke jetzt die Schaltfläche "OK" Klicke jetzt "nach Updates suchen". Bitte instaliere zunächst wichtige Updates. Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren. Mache das selbe bitte mit den optionalen Updates. Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist. aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen. als browser rate ich dir zu chrome: http://support.google.com/chrome/bin...&answer=118663 anleitung lesen bitte falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen. Sandboxie Die devinition einer Sandbox ist hier nachzulesen: Sandbox Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen. Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen. Download Link: Sandboxie - Download - Filepony anleitung: http://www.trojaner-board.de/71542-a...sandboxie.html ausführliche anleitung als pdf, auch abarbeiten: Sandbox Einstellungen | bitte folgende zusatz konfiguration machen: sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen. dort klicke auf sandbox einstellungen. beschrenkungen, bei programm start und internet zugriff schreibe: chrome.exe dann gehe auf anwendungen, webbrowser, chrome. dort aktiviere alles außer gesammten profil ordner freigeben. Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen. Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate. Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten. Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten. Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar. Weiter mit: Maßnahmen für ALLE Windows-Versionen alles komplett durcharbeiten anmerkung zu file hippo. in den settings zusätzlich auswählen: hide beta updates. Run updateChecker when Windows starts Backup Programm: in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an: http://www.trojaner-board.de/82962-w...en-backup.html Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar. Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist. Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern bitte auch lesen, wie mache ich programme für alle sichtbar: Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox. wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird Sandboxie immer gestartet wenn du nen browser aufrufst. wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser passwort sicherheit: jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort bei der passwort verwaltung und erstellung hilft roboform Password Manager, Form Filler, Password Management | RoboForm Password Manager anleitung: RoboForm Manual
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
07.08.2013, 17:57
| #15 |
| | Viren gefunden - Logdatei auswerten Leider hänge ich grad fest beim Deinstallieren von ComboFix. Wenn ich es über WindowsTaste+R mache, so findet er die Datei nicht (sie befindet sich auf dem Desktop). Mache ich es über die Alternative (umbenennen in uninstall.exe), so führt ComboFix einfach einen weiteren Scan durch statt sich zu deinstallieren. Ratschläge? |
|
| Themen zu Viren gefunden - Logdatei auswerten |
| anhang, auswerten, bekannte, erkenne, funde, gefunde, laptop, logdatei, malwarebytes, programm, pup.babylon.a, pup.optional.amonetize, pup.optional.dealply.a, pup.optional.delta.a, quarantäne, recht, schonmal, säubern, trojan.pup.optional.filescout.a, unerfahren, zugehörige |
WARNUNG an die MITLESER: 
Linear-Darstellung
