| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: web.de suche ungewollt in firefox nach updateWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.08.2013, 17:09
| #1 | |
 |  web.de suche ungewollt in firefox nach update hallo, ich habe soeben das firefox update duchgeführt. kurz danach werde ich immer auf die web.de suche geleitet, wenn ich etwas in der adressleiste eingebe. habe da aber immr nur google gehabt. desweiteren habe ich vorhin dann Malwarebytes scannen lassen und es wurde ein trojaner gefunden. Zitat:
besten gruss |
|
08.08.2013, 17:29
| #2 |
| /// Malware-holic   | web.de suche ungewollt in firefox nach update Hi, gleich folgt eine Anleitung für das Programm FRST, zusätzlich poste ich etwas, dass in der Additions.txt getan werden muss.
__________________Empfehlungen fürs Deinstallieren Bitte kopiere die Liste der installierten Programme aus der additions.txt hier in deinen Thread. Notiere mir bitte hinter jede Zeile, ob folgendes Kategorie zutrifft: Unbekannt, Nötig, Unnötig Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
08.08.2013, 18:02
| #3 | |
| | web.de suche ungewollt in firefox nach update hi,
__________________danke für die schnelle antwort. also, hier die programme: Zitat:
dann hier die FRST: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2013
Ran by ** (administrator) on 08-08-2013 18:33:40
Running from C:\Users\**\Downloads
Windows 7 Professional N Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(X10) C:\PROGRA~2\COMMON~1\X10\Common\x10nets.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Windows\SysWOW64\HsMgr.exe
() C:\Windows\system\HsMgr64.exe
() C:\Program Files (x86)\LG Soft India\forteManager\bin\Monitor.exe
(CMedia) C:\Program Files\ASUS Xonar DX Audio\Customapp\ASUSAUDIOCENTER.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
() C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razerhid.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razertra.exe
(Razer Inc.) C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razerofa.exe
() C:\Program Files (x86)\Razer\DeathAdderBlackEdition\vdDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Cmaudio8788] - C:\Windows\Syswow64\cmicnfgp.dll [8769536 2011-05-12] (C-Media Corporation)
HKLM\...\Run: [Cmaudio8788GX] - C:\Windows\syswow64\HsMgr.exe [200704 2008-07-11] ()
HKLM\...\Run: [Cmaudio8788GX64] - C:\Windows\system\HsMgr64.exe [282112 2008-07-11] ()
HKCU\...\Run: [ISUSPM Startup] - C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [DeathAdderBlackEdition] - C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razerhid.exe [246272 2011-03-21] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\forteManager.lnk
ShortcutTarget: forteManager.lnk -> C:\Program Files (x86)\LG Soft India\forteManager\bin\Monitor.exe ()
Startup: C:\Users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default
FF SelectedSearchEngine: WEB.DE Suche
FF Homepage: google.de
FF NetworkProxy: "http", "www-proxy.t-online.de"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF SearchPlugin: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\webde-suche.xml
FF Extension: Youtube Video Replay - C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\Extensions\{e1aaa9f8-4500-47f1-9a0a-b02bd60e4076}
FF Extension: info - C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\Extensions\info@maltegoetz.de.xpi
FF Extension: No Name - C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==================== Services (Whitelisted) =================
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-05-01] (Nitro PDF Software)
R2 x10nets; C:\PROGRA~2\COMMON~1\X10\Common\x10nets.exe [20480 2001-11-12] (X10)
==================== Drivers (Whitelisted) ====================
R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc)
R3 DABlackFltr; C:\Windows\System32\drivers\DABlack.sys [23040 2010-11-29] (Razer (Asia-Pacific) Pte Ltd)
S3 LGDDCDevice; C:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys [14336 2009-04-24] ()
S3 LGII2CDevice; C:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys [18432 2009-04-24] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [15768 2006-11-15] (X10 Wireless Technology, Inc.)
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP3a\WNt500x64\Sandra.sys [x]
U3 pxldipog; \??\C:\Users\**\AppData\Local\Temp\pxldipog.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-08 18:33 - 2013-08-08 18:33 - 01790059 _____ (Farbar) C:\Users\**\Downloads\FRST64.exe
2013-08-08 18:33 - 2013-08-08 18:33 - 00000000 ____D C:\FRST
2013-08-08 17:53 - 2013-08-08 17:53 - 00377856 _____ C:\Users\**\Downloads\gmer_2.1.19163.exe
2013-08-08 17:42 - 2013-08-08 17:42 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\Users\**\AppData\Roaming\Malwarebytes
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-08 17:42 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-08 17:41 - 2013-08-08 17:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\**\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 16:55 - 2013-08-08 16:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-01 23:26 - 2013-08-01 23:26 - 00286542 _____ C:\Users\**\Desktop\adressse.odt
2013-08-01 14:50 - 2013-08-01 14:50 - 00000000 ____D C:\Users\**\Desktop\tococd2
2013-08-01 14:48 - 2013-08-01 14:49 - 00000000 ____D C:\Users\**\Desktop\tococd1
2013-08-01 14:44 - 2013-08-01 14:45 - 00000000 ____D C:\Users\**\Desktop\bloc
2013-08-01 14:42 - 2013-08-01 14:42 - 00000000 ____D C:\Users\**\Desktop\everyday
2013-07-30 19:34 - 2013-08-03 17:41 - 00000000 ____D C:\Users\T**\Desktop\ebaybilder
2013-07-27 18:35 - 2013-08-08 16:43 - 00000000 ____D C:\Users\**\Desktop\lossless
2013-07-25 20:31 - 2013-07-25 20:31 - 00001148 _____ C:\Users\T**\Desktop\GTA2.lnk
2013-07-23 13:15 - 2013-07-23 13:15 - 00003210 _____ C:\Windows\System32\Tasks\{F5C1062C-480A-4635-A4A1-805DE9A5D4D8}
2013-07-22 12:14 - 2013-07-22 12:18 - 00000050 _____ C:\Users\**\Desktop\AIDAkey.txt
2013-07-22 12:12 - 2013-07-22 12:12 - 00001231 _____ C:\Users\**\Desktop\AIDA64 Extreme Edition.lnk
2013-07-22 12:12 - 2013-07-22 12:12 - 00000000 ____D C:\Program Files (x86)\FinalWire
2013-07-22 12:11 - 2013-07-22 12:12 - 15199352 _____ (FinalWire Ltd. ) C:\Users\**\Downloads\aida64extreme300b2500.exe
2013-07-20 22:11 - 2013-08-08 18:33 - 00000000 ____D C:\Users\**\AppData\Roaming\NetSpeedMonitor
2013-07-20 22:11 - 2013-07-20 22:11 - 00000000 ____D C:\Program Files\NetSpeedMonitor
2013-07-20 20:58 - 2013-07-25 20:31 - 00002184 _____ C:\Windows\Directx.log
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\directx
2013-07-19 21:10 - 2013-07-19 21:10 - 00019981 _____ C:\Users\**\Desktop\formular.odt
2013-07-19 19:51 - 2013-07-19 19:51 - 00010111 _____ C:\Users\**\Desktop\Unbenannt 1.odt
2013-07-19 14:19 - 2013-07-19 14:45 - 460601995 _____ C:\Users\**\Desktop\House Music _ New Dance Club Mix [PeeTee] #30.mp4
2013-07-17 01:11 - 2013-07-17 01:11 - 00000000 ____D C:\Users\**\Desktop\Jules & Moss - Panda High [TURNBEUTEL11]
2013-07-15 11:41 - 2013-07-15 11:42 - 00000000 ____D C:\Users\**\AppData\Local\Adobe
2013-07-13 11:51 - 2013-07-13 11:51 - 00000792 _____ C:\Users\**\.recently-used.xbel
2013-07-12 21:36 - 2013-07-19 22:32 - 00000000 ____D C:\Users\**\Documents\OpenTTD
2013-07-12 21:36 - 2013-07-12 21:36 - 00000796 _____ C:\Users\Public\Desktop\OpenTTD.lnk
2013-07-12 21:36 - 2013-07-12 21:36 - 00000000 ____D C:\Program Files\OpenTTD
2013-07-12 14:02 - 2013-07-12 14:50 - 416972409 _____ C:\Users\**\Desktop\High Contrast Essential mix 5.4.2003.flv
==================== One Month Modified Files and Folders =======
2013-08-08 18:33 - 2013-08-08 18:33 - 00000000 ____D C:\FRST
2013-08-08 18:33 - 2013-07-20 22:11 - 00000000 ____D C:\Users\**\AppData\Roaming\NetSpeedMonitor
2013-08-08 17:58 - 2009-07-14 06:50 - 00020112 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 17:58 - 2009-07-14 06:50 - 00020112 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 17:56 - 2011-04-12 10:14 - 00671326 _____ C:\Windows\system32\perfh007.dat
2013-08-08 17:56 - 2011-04-12 10:14 - 00137622 _____ C:\Windows\system32\perfc007.dat
2013-08-08 17:56 - 2009-07-14 07:12 - 01546758 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 17:53 - 2013-08-08 17:53 - 00377856 _____ C:\Users\**\Downloads\gmer_2.1.19163.exe
2013-08-08 17:53 - 2013-05-18 23:43 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-08 17:51 - 2013-06-02 01:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-08 17:51 - 2013-06-02 01:04 - 00001264 _____ C:\Windows\PFRO.log
2013-08-08 17:51 - 2013-05-20 00:52 - 00012481 _____ C:\Windows\se**t.log
2013-08-08 17:51 - 2013-05-17 18:18 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-08-08 17:51 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 17:50 - 2013-05-17 17:26 - 00666794 _____ C:\Windows\WindowsUpdate.log
2013-08-08 17:49 - 2013-05-20 22:35 - 00000000 ____D C:\Users\**\AppData\Roaming\vlc
2013-08-08 17:42 - 2013-08-08 17:42 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\Users\**\AppData\Roaming\Malwarebytes
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-08 17:41 - 2013-08-08 17:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\**\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 16:55 - 2013-08-08 16:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-08 16:43 - 2013-07-27 18:35 - 00000000 ____D C:\Users\**\Desktop\lossless
2013-08-08 10:30 - 2013-05-17 18:18 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-08-04 15:32 - 2013-07-07 22:45 - 00011232 _____ C:\Users\**\Desktop\adressen.odt
2013-08-03 17:41 - 2013-07-30 19:34 - 00000000 ____D C:\Users\**\Desktop\ebaybilder
2013-08-01 23:26 - 2013-08-01 23:26 - 00286542 _____ C:\Users\**\Desktop\adressse.odt
2013-08-01 23:26 - 2013-05-18 01:13 - 00000000 ____D C:\Users\**\Desktop\desk
2013-08-01 14:50 - 2013-08-01 14:50 - 00000000 ____D C:\Users\**\Desktop\tococd2
2013-08-01 14:49 - 2013-08-01 14:48 - 00000000 ____D C:\Users\**\Desktop\tococd1
2013-08-01 14:45 - 2013-08-01 14:44 - 00000000 ____D C:\Users\**\Desktop\bloc
2013-08-01 14:42 - 2013-08-01 14:42 - 00000000 ____D C:\Users\**\Desktop\everyday
2013-07-30 19:48 - 2013-05-17 18:19 - 00000000 ____D C:\Users\**\AppData\Local\Paint.NET
2013-07-25 20:31 - 2013-07-25 20:31 - 00001148 _____ C:\Users\**\Desktop\GTA2.lnk
2013-07-25 20:31 - 2013-07-20 20:58 - 00002184 _____ C:\Windows\Directx.log
2013-07-23 13:15 - 2013-07-23 13:15 - 00003210 _____ C:\Windows\System32\Tasks\{F5C1062C-480A-4635-A4A1-805DE9A5D4D8}
2013-07-23 13:05 - 2013-05-17 18:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 12:18 - 2013-07-22 12:14 - 00000050 _____ C:\Users\**\Desktop\AIDAkey.txt
2013-07-22 12:12 - 2013-07-22 12:12 - 00001231 _____ C:\Users\**\Desktop\AIDA64 Extreme Edition.lnk
2013-07-22 12:12 - 2013-07-22 12:12 - 00000000 ____D C:\Program Files (x86)\FinalWire
2013-07-22 12:12 - 2013-07-22 12:11 - 15199352 _____ (FinalWire Ltd. ) C:\Users\**\Downloads\aida64extreme300b2500.exe
2013-07-20 22:11 - 2013-07-20 22:11 - 00000000 ____D C:\Program Files\NetSpeedMonitor
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\directx
2013-07-19 22:32 - 2013-07-12 21:36 - 00000000 ____D C:\Users\**\Documents\OpenTTD
2013-07-19 21:10 - 2013-07-19 21:10 - 00019981 _____ C:\Users\**\Desktop\formular.odt
2013-07-19 19:51 - 2013-07-19 19:51 - 00010111 _____ C:\Users\**\Desktop\Unbenannt 1.odt
2013-07-19 14:45 - 2013-07-19 14:19 - 460601995 _____ C:\Users\**\Desktop\House Music _ New Dance Club Mix [PeeTee] #30.mp4
2013-07-17 01:11 - 2013-07-17 01:11 - 00000000 ____D C:\Users\**\Desktop\Jules & Moss - Panda High [TURNBEUTEL11]
2013-07-15 11:42 - 2013-07-15 11:41 - 00000000 ____D C:\Users\**\AppData\Local\Adobe
2013-07-15 11:42 - 2013-05-18 23:43 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-15 11:42 - 2013-05-18 23:43 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-15 11:42 - 2013-05-18 23:43 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-13 11:51 - 2013-07-13 11:51 - 00000792 _____ C:\Users\**\.recently-used.xbel
2013-07-13 11:51 - 2013-05-17 17:25 - 00000000 ____D C:\Users\**
2013-07-12 21:36 - 2013-07-12 21:36 - 00000796 _____ C:\Users\Public\Desktop\OpenTTD.lnk
2013-07-12 21:36 - 2013-07-12 21:36 - 00000000 ____D C:\Program Files\OpenTTD
2013-07-12 14:50 - 2013-07-12 14:02 - 416972409 _____ C:\Users\**\Desktop\High Contrast Essential mix 5.4.2003.flv
2013-07-09 14:33 - 2013-06-21 14:44 - 00000000 ____D C:\Users\**\Downloads\dwn
2013-07-09 14:31 - 2013-05-17 18:19 - 00090608 _____ C:\Users\**\AppData\Local\GDIPFONTCACHEV1.DAT
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-02 12:06
==================== End Of Log ============================
--- --- --- --- --- --- danke und besten gruss |
|
08.08.2013, 18:43
| #4 |
| /// Malware-holic | web.de suche ungewollt in firefox nach update Hi, hast du denn den FF von der offiziellen Homepage? es sind 2 Logs zu erstellen, möglichst gleichzeitig posten. 1. Deinstaliere: Free Video Malwarebytes : würd ich als "zweite Meinung" behalten, aber ist dir überlassen. Microsoft Office : alle evtl. kannst du ja bei MS anrufen und die können die Lizenz wieder freischalten. deinstaliere: OpenTTD YTD 2. Scan mit Combofix
3. Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 19:41
| #5 |
| | web.de suche ungewollt in firefox nach update hallo, also ich hab FF ganz normal über den auto updater aktualisiert. logs: combo Code:
ATTFilter ComboFix 13-08-07.01 - ** 08.08.2013 20:27:22.1.2 - x64
Microsoft Windows 7 Professional N 6.1.7601.1.1252.49.1031.18.7874.6532 [GMT 2:00]
ausgeführt von:: c:\users\**\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-08 bis 2013-08-08 ))))))))))))))))))))))))))))))
.
.
2013-08-08 18:29 . 2013-08-08 18:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-08 16:33 . 2013-08-08 16:33 -------- d-----w- C:\FRST
2013-08-08 15:42 . 2013-08-08 15:42 -------- d-----w- c:\users\**\AppData\Roaming\Malwarebytes
2013-08-08 15:42 . 2013-08-08 15:42 -------- d-----w- c:\programdata\Malwarebytes
2013-07-23 11:05 . 2002-12-05 12:12 692224 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2013-07-23 11:05 . 2002-12-05 12:10 155648 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2013-07-23 11:05 . 2002-12-02 13:22 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2013-07-23 11:05 . 2002-12-02 11:33 57344 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2013-07-23 11:05 . 2002-12-02 11:33 237568 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2013-07-23 11:05 . 2013-07-23 11:05 282756 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2013-07-23 11:05 . 2013-07-23 11:05 163972 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2013-07-22 10:12 . 2013-07-22 10:12 -------- d-----w- c:\program files (x86)\FinalWire
2013-07-20 20:11 . 2013-08-08 18:29 -------- d-----w- c:\users\**\AppData\Roaming\NetSpeedMonitor
2013-07-20 20:11 . 2013-07-20 20:11 -------- d-----w- c:\program files\NetSpeedMonitor
2013-07-20 18:58 . 2013-07-20 18:58 -------- d-----w- c:\program files (x86)\directx
2013-07-20 18:58 . 2013-07-20 18:58 -------- d-----w- c:\program files (x86)\Rockstar Games
2013-07-15 09:41 . 2013-07-15 09:42 -------- d-----w- c:\users\**\AppData\Local\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-15 09:42 . 2013-05-18 21:43 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-15 09:42 . 2013-05-18 21:43 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-19 22:36 . 2003-03-19 10:05 106496 ----a-w- c:\windows\SysWow64\ATL71.DLL
2013-05-17 16:24 . 2013-05-17 16:24 419840 ----a-w- c:\windows\system32\wrap_oal.dll
2013-05-17 16:24 . 2013-05-17 16:24 413696 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2013-05-17 16:24 . 2013-05-17 16:24 111616 ----a-w- c:\windows\system32\OpenAL32.dll
2013-05-17 16:24 . 2013-05-17 16:24 102400 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2013-05-17 07:09 . 2013-05-17 07:09 644400 ----a-w- c:\windows\SysWow64\mscomct2.ocx
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-04-17 196608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-05-20 291648]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"DeathAdderBlackEdition"="c:\program files (x86)\Razer\DeathAdderBlackEdition\razerhid.exe" [2011-03-21 246272]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"ISUSScheduler"="c:\program files (x86)\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
.
c:\users\**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
forteManager.lnk - c:\program files (x86)\LG Soft India\forteManager\bin\Monitor.exe -startup [2013-5-20 1683456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 LGDDCDevice;LGDDCDevice;c:\program files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys;c:\program files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys [x]
R3 LGII2CDevice;LGII2CDevice;c:\program files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys;c:\program files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys [x]
R3 nuviocir;Nuvoton SIO CIR Device Driver;c:\windows\system32\DRIVERS\nuviocir_win7_x64.sys;c:\windows\SYSNATIVE\DRIVERS\nuviocir_win7_x64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NitroReaderDriverReadSpool3;NitroPDFReaderDriverCreatorReadSpool3;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 cmudaxp;ASUS Xonar DX Audio Interface;c:\windows\system32\drivers\cmudaxp.sys;c:\windows\SYSNATIVE\drivers\cmudaxp.sys [x]
S3 DABlackFltr;DeathAdder Black Edition Mouse;c:\windows\system32\drivers\DABlack.sys;c:\windows\SYSNATIVE\drivers\DABlack.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VKbms;Virtual HID Minidriver;c:\windows\system32\DRIVERS\VKbms.sys;c:\windows\SYSNATIVE\DRIVERS\VKbms.sys [x]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys;c:\windows\SYSNATIVE\Drivers\x10hid.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - PXLDIPOG
*Deregistered* - pxldipog
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-18 09:42]
.
2013-08-08 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16 09:54]
.
2013-08-08 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16 09:54]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-09-21 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-09-21 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-09-21 441152]
"Cmaudio8788"="c:\windows\Syswow64\cmicnfgp.dll" [2011-05-12 8769536]
"Cmaudio8788GX"="c:\windows\syswow64\HsMgr.exe" [2008-07-11 200704]
"Cmaudio8788GX64"="c:\windows\system\HsMgr64.exe" [2008-07-11 282112]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\
FF - prefs.js: browser.search.selectedEngine - WEB.DE Suche
FF - prefs.js: browser.startup.homepage - google.de
FF - prefs.js: network.proxy.http - www-proxy.t-online.de
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-06-30 19:08; info@maltegoetz.de; c:\users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\extensions\info@maltegoetz.de.xpi
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-08 20:31:16
ComboFix-quarantined-files.txt 2013-08-08 18:31
.
Vor Suchlauf: 10 Verzeichnis(se), 105.437.978.624 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 105.499.652.096 Bytes frei
.
- - End Of File - - 06516822D8E3A68C969340149DE9CB96
A36C5E4F47E84449FF07ED3517B43A31
TDSS Code:
ATTFilter 20:35:54.0074 2380 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
20:35:54.0256 2380 ============================================================
20:35:54.0256 2380 Current date / time: 2013/08/08 20:35:54.0256
20:35:54.0256 2380 SystemInfo:
20:35:54.0256 2380
20:35:54.0256 2380 OS Version: 6.1.7601 ServicePack: 1.0
20:35:54.0256 2380 Product type: Workstation
20:35:54.0256 2380 ComputerName: **
20:35:54.0256 2380 UserName: **
20:35:54.0256 2380 Windows directory: C:\Windows
20:35:54.0256 2380 System windows directory: C:\Windows
20:35:54.0256 2380 Running under WOW64
20:35:54.0256 2380 Processor architecture: Intel x64
20:35:54.0256 2380 Number of processors: 2
20:35:54.0256 2380 Page size: 0x1000
20:35:54.0256 2380 Boot type: Normal boot
20:35:54.0256 2380 ============================================================
20:35:54.0542 2380 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:35:54.0544 2380 ============================================================
20:35:54.0544 2380 \Device\Harddisk0\DR0:
20:35:54.0544 2380 MBR partitions:
20:35:54.0544 2380 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
20:35:54.0544 2380 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D192800
20:35:54.0544 2380 ============================================================
20:35:54.0545 2380 C: <-> \Device\Harddisk0\DR0\Partition2
20:35:54.0545 2380 ============================================================
20:35:54.0545 2380 Initialize success
20:35:54.0545 2380 ============================================================
20:36:24.0979 3984 ============================================================
20:36:24.0980 3984 Scan started
20:36:24.0980 3984 Mode: Manual; SigCheck; TDLFS;
20:36:24.0980 3984 ============================================================
20:36:25.0091 3984 ================ Scan system memory ========================
20:36:25.0091 3984 System memory - ok
20:36:25.0091 3984 ================ Scan services =============================
20:36:25.0118 3984 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
20:36:25.0143 3984 1394ohci - ok
20:36:25.0149 3984 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
20:36:25.0158 3984 ACPI - ok
20:36:25.0160 3984 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
20:36:25.0168 3984 AcpiPmi - ok
20:36:25.0181 3984 [ 476BB014F3F68C0C15EDDD5B444DA8FF ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:36:25.0189 3984 AdobeFlashPlayerUpdateSvc - ok
20:36:25.0195 3984 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
20:36:25.0205 3984 adp94xx - ok
20:36:25.0210 3984 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys
20:36:25.0219 3984 adpahci - ok
20:36:25.0223 3984 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
20:36:25.0230 3984 adpu320 - ok
20:36:25.0234 3984 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:36:25.0259 3984 AeLookupSvc - ok
20:36:25.0265 3984 [ D31DC7A16DEA4A9BAF179F3D6FBDB38C ] AFD C:\Windows\system32\drivers\afd.sys
20:36:25.0291 3984 AFD - ok
20:36:25.0295 3984 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
20:36:25.0300 3984 agp440 - ok
20:36:25.0303 3984 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
20:36:25.0310 3984 ALG - ok
20:36:25.0314 3984 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
20:36:25.0318 3984 aliide - ok
20:36:25.0321 3984 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
20:36:25.0325 3984 amdide - ok
20:36:25.0329 3984 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
20:36:25.0335 3984 AmdK8 - ok
20:36:25.0339 3984 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
20:36:25.0345 3984 AmdPPM - ok
20:36:25.0349 3984 [ 6EC6D772EAE38DC17C14AED9B178D24B ] amdsata C:\Windows\system32\drivers\amdsata.sys
20:36:25.0354 3984 amdsata - ok
20:36:25.0359 3984 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
20:36:25.0365 3984 amdsbs - ok
20:36:25.0368 3984 [ 1142A21DB581A84EA5597B03A26EBAA0 ] amdxata C:\Windows\system32\drivers\amdxata.sys
20:36:25.0373 3984 amdxata - ok
20:36:25.0375 3984 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
20:36:25.0398 3984 AppID - ok
20:36:25.0401 3984 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
20:36:25.0425 3984 AppIDSvc - ok
20:36:25.0428 3984 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
20:36:25.0450 3984 Appinfo - ok
20:36:25.0456 3984 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:36:25.0461 3984 Apple Mobile Device - ok
20:36:25.0466 3984 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:\Windows\System32\appmgmts.dll
20:36:25.0474 3984 AppMgmt - ok
20:36:25.0478 3984 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys
20:36:25.0483 3984 arc - ok
20:36:25.0485 3984 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys
20:36:25.0491 3984 arcsas - ok
20:36:25.0503 3984 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
20:36:25.0508 3984 aspnet_state - ok
20:36:25.0510 3984 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:36:25.0534 3984 AsyncMac - ok
20:36:25.0538 3984 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
20:36:25.0541 3984 atapi - ok
20:36:25.0550 3984 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:36:25.0578 3984 AudioEndpointBuilder - ok
20:36:25.0585 3984 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
20:36:25.0614 3984 AudioSrv - ok
20:36:25.0618 3984 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
20:36:25.0629 3984 AxInstSV - ok
20:36:25.0635 3984 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
20:36:25.0644 3984 b06bdrv - ok
20:36:25.0649 3984 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
20:36:25.0659 3984 b57nd60a - ok
20:36:25.0663 3984 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
20:36:25.0670 3984 BDESVC - ok
20:36:25.0674 3984 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
20:36:25.0698 3984 Beep - ok
20:36:25.0705 3984 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
20:36:25.0734 3984 BFE - ok
20:36:25.0743 3984 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\system32\qmgr.dll
20:36:25.0774 3984 BITS - ok
20:36:25.0776 3984 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
20:36:25.0784 3984 blbdrive - ok
20:36:25.0790 3984 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:36:25.0799 3984 Bonjour Service - ok
20:36:25.0803 3984 [ 91CE0D3DC57DD377E690A2D324022B08 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:36:25.0828 3984 bowser - ok
20:36:25.0830 3984 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
20:36:25.0839 3984 BrFiltLo - ok
20:36:25.0841 3984 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
20:36:25.0850 3984 BrFiltUp - ok
20:36:25.0854 3984 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
20:36:25.0879 3984 BridgeMP - ok
20:36:25.0883 3984 [ 8EF0D5C41EC907751B8429162B1239ED ] Browser C:\Windows\System32\browser.dll
20:36:25.0906 3984 Browser - ok
20:36:25.0911 3984 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
20:36:25.0920 3984 Brserid - ok
20:36:25.0923 3984 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
20:36:25.0931 3984 BrSerWdm - ok
20:36:25.0934 3984 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
20:36:25.0943 3984 BrUsbMdm - ok
20:36:25.0945 3984 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
20:36:25.0953 3984 BrUsbSer - ok
20:36:25.0956 3984 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
20:36:25.0965 3984 BTHMODEM - ok
20:36:25.0970 3984 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
20:36:25.0995 3984 bthserv - ok
20:36:25.0999 3984 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:36:26.0024 3984 cdfs - ok
20:36:26.0026 3984 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
20:36:26.0035 3984 cdrom - ok
20:36:26.0039 3984 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
20:36:26.0063 3984 CertPropSvc - ok
20:36:26.0065 3984 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
20:36:26.0075 3984 circlass - ok
20:36:26.0080 3984 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
20:36:26.0089 3984 CLFS - ok
20:36:26.0094 3984 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:36:26.0099 3984 clr_optimization_v2.0.50727_32 - ok
20:36:26.0104 3984 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:36:26.0109 3984 clr_optimization_v2.0.50727_64 - ok
20:36:26.0118 3984 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:36:26.0123 3984 clr_optimization_v4.0.30319_32 - ok
20:36:26.0126 3984 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:36:26.0131 3984 clr_optimization_v4.0.30319_64 - ok
20:36:26.0134 3984 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
20:36:26.0141 3984 CmBatt - ok
20:36:26.0144 3984 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
20:36:26.0149 3984 cmdide - ok
20:36:26.0170 3984 [ 0367F029425CBD5506E8DB2757FF3A8F ] cmudaxp C:\Windows\system32\drivers\cmudaxp.sys
20:36:26.0203 3984 cmudaxp - ok
20:36:26.0210 3984 [ D5FEA92400F12412B3922087C09DA6A5 ] CNG C:\Windows\system32\Drivers\cng.sys
20:36:26.0223 3984 CNG - ok
20:36:26.0226 3984 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
20:36:26.0230 3984 Compbatt - ok
20:36:26.0234 3984 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
20:36:26.0243 3984 CompositeBus - ok
20:36:26.0245 3984 COMSysApp - ok
20:36:26.0251 3984 [ B2467BF4BDE51DD54E50C92332916C58 ] cphs C:\Windows\SysWow64\IntelCpHeciSvc.exe
20:36:26.0258 3984 cphs - ok
20:36:26.0261 3984 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
20:36:26.0266 3984 crcdisk - ok
20:36:26.0289 3984 [ 15597883FBE9B056F276ADA3AD87D9AF ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:36:26.0313 3984 CryptSvc - ok
20:36:26.0319 3984 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:\Windows\system32\drivers\csc.sys
20:36:26.0329 3984 CSC - ok
20:36:26.0336 3984 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:\Windows\System32\cscsvc.dll
20:36:26.0348 3984 CscService - ok
20:36:26.0350 3984 [ 3072678FF2F99083DF0C034DD7E69C6B ] DABlackFltr C:\Windows\system32\drivers\DABlack.sys
20:36:26.0356 3984 DABlackFltr - ok
20:36:26.0363 3984 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
20:36:26.0391 3984 DcomLaunch - ok
20:36:26.0396 3984 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
20:36:26.0423 3984 defragsvc - ok
20:36:26.0425 3984 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:36:26.0449 3984 DfsC - ok
20:36:26.0454 3984 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
20:36:26.0479 3984 Dhcp - ok
20:36:26.0481 3984 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
20:36:26.0506 3984 discache - ok
20:36:26.0509 3984 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys
20:36:26.0514 3984 Disk - ok
20:36:26.0518 3984 [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc C:\Windows\system32\drivers\dmvsc.sys
20:36:26.0525 3984 dmvsc - ok
20:36:26.0529 3984 [ CD55F5355D8F55D44C9F4ED875705BD6 ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:36:26.0553 3984 Dnscache - ok
20:36:26.0556 3984 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
20:36:26.0581 3984 dot3svc - ok
20:36:26.0585 3984 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
20:36:26.0609 3984 DPS - ok
20:36:26.0611 3984 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:36:26.0619 3984 drmkaud - ok
20:36:26.0629 3984 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:36:26.0644 3984 DXGKrnl - ok
20:36:26.0646 3984 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
20:36:26.0671 3984 EapHost - ok
20:36:26.0698 3984 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys
20:36:26.0729 3984 ebdrv - ok
20:36:26.0733 3984 [ 0793F40B9B8A1BDD266296409DBD91EA ] EFS C:\Windows\System32\lsass.exe
20:36:26.0740 3984 EFS - ok
20:36:26.0749 3984 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:36:26.0760 3984 ehRecvr - ok
20:36:26.0764 3984 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
20:36:26.0771 3984 ehSched - ok
20:36:26.0774 3984 [ A05FC7ECA0966EBB70E4D17B855A853B ] ElbyCDIO C:\Windows\system32\Drivers\ElbyCDIO.sys
20:36:26.0779 3984 ElbyCDIO - ok
20:36:26.0785 3984 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys
20:36:26.0795 3984 elxstor - ok
20:36:26.0799 3984 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
20:36:26.0805 3984 ErrDev - ok
20:36:26.0814 3984 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
20:36:26.0840 3984 EventSystem - ok
20:36:26.0845 3984 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
20:36:26.0870 3984 exfat - ok
20:36:26.0874 3984 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:36:26.0900 3984 fastfat - ok
20:36:26.0908 3984 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
20:36:26.0920 3984 Fax - ok
20:36:26.0923 3984 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys
20:36:26.0930 3984 fdc - ok
20:36:26.0933 3984 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
20:36:26.0956 3984 fdPHost - ok
20:36:26.0960 3984 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
20:36:26.0984 3984 FDResPub - ok
20:36:26.0988 3984 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:36:26.0993 3984 FileInfo - ok
20:36:26.0995 3984 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:36:27.0020 3984 Filetrace - ok
20:36:27.0023 3984 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
20:36:27.0030 3984 flpydisk - ok
20:36:27.0035 3984 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:36:27.0043 3984 FltMgr - ok
20:36:27.0053 3984 [ B4447F606BB19FD8AD0BAFB59B90F5D9 ] FontCache C:\Windows\system32\FntCache.dll
20:36:27.0085 3984 FontCache - ok
20:36:27.0089 3984 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:36:27.0093 3984 FontCache3.0.0.0 - ok
20:36:27.0095 3984 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
20:36:27.0100 3984 FsDepends - ok
20:36:27.0104 3984 [ E95EF8547DE20CF0603557C0CF7A9462 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:36:27.0108 3984 Fs_Rec - ok
20:36:27.0113 3984 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
20:36:27.0120 3984 fvevol - ok
20:36:27.0124 3984 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
20:36:27.0129 3984 gagp30kx - ok
20:36:27.0131 3984 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:36:27.0135 3984 GEARAspiWDM - ok
20:36:27.0144 3984 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
20:36:27.0173 3984 gpsvc - ok
20:36:27.0176 3984 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
20:36:27.0183 3984 hcw85cir - ok
20:36:27.0186 3984 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
20:36:27.0195 3984 HDAudBus - ok
20:36:27.0199 3984 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
20:36:27.0206 3984 HidBatt - ok
20:36:27.0209 3984 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys
20:36:27.0219 3984 HidBth - ok
20:36:27.0221 3984 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
20:36:27.0230 3984 HidIr - ok
20:36:27.0235 3984 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll
20:36:27.0259 3984 hidserv - ok
20:36:27.0263 3984 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
20:36:27.0269 3984 HidUsb - ok
20:36:27.0273 3984 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:36:27.0296 3984 hkmsvc - ok
20:36:27.0301 3984 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:36:27.0310 3984 HomeGroupListener - ok
20:36:27.0314 3984 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:36:27.0323 3984 HomeGroupProvider - ok
20:36:27.0325 3984 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
20:36:27.0330 3984 HpSAMD - ok
20:36:27.0339 3984 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:36:27.0368 3984 HTTP - ok
20:36:27.0371 3984 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
20:36:27.0375 3984 hwpolicy - ok
20:36:27.0379 3984 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
20:36:27.0386 3984 i8042prt - ok
20:36:27.0394 3984 [ 3DF4395A7CF8B7A72A5F4606366B8C2D ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
20:36:27.0403 3984 iaStorV - ok
20:36:27.0406 3984 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
20:36:27.0409 3984 IDriverT ( UnsignedFile.Multi.Generic ) - warning
20:36:27.0409 3984 IDriverT - detected UnsignedFile.Multi.Generic (1)
20:36:27.0418 3984 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:36:27.0431 3984 idsvc - ok
20:36:27.0470 3984 [ 24B5EE5A17AD83427D9BDFCBF7C2C1B4 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
20:36:27.0520 3984 igfx - ok
20:36:27.0524 3984 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys
20:36:27.0529 3984 iirsp - ok
20:36:27.0538 3984 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
20:36:27.0568 3984 IKEEXT - ok
20:36:27.0576 3984 [ B353F1834FCD36D77BE3F74992C147D4 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
20:36:27.0588 3984 Intel(R) Capability Licensing Service Interface - ok
20:36:27.0591 3984 [ 125BED41A1AFDA9CAB2B6177553D5758 ] Intel(R) ME Service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
20:36:27.0596 3984 Intel(R) ME Service - ok
20:36:27.0599 3984 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
20:36:27.0604 3984 intelide - ok
20:36:27.0606 3984 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:36:27.0614 3984 intelppm - ok
20:36:27.0618 3984 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:36:27.0643 3984 IPBusEnum - ok
20:36:27.0645 3984 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:36:27.0669 3984 IpFilterDriver - ok
20:36:27.0676 3984 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:36:27.0704 3984 iphlpsvc - ok
20:36:27.0706 3984 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
20:36:27.0714 3984 IPMIDRV - ok
20:36:27.0718 3984 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
20:36:27.0743 3984 IPNAT - ok
20:36:27.0750 3984 [ 4EFFC8FF6D349E971E94B1C670C0C66A ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
20:36:27.0760 3984 iPod Service - ok
20:36:27.0763 3984 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:36:27.0774 3984 IRENUM - ok
20:36:27.0777 3984 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
20:36:27.0782 3984 isapnp - ok
20:36:27.0787 3984 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
20:36:27.0794 3984 iScsiPrt - ok
20:36:27.0798 3984 [ D596D915CF091DA1F8CE4BD38BB5D509 ] iusb3hcs C:\Windows\system32\DRIVERS\iusb3hcs.sys
20:36:27.0802 3984 iusb3hcs - ok
20:36:27.0807 3984 [ 023896E23B61543A15A230EED996D911 ] iusb3hub C:\Windows\system32\DRIVERS\iusb3hub.sys
20:36:27.0814 3984 iusb3hub - ok
20:36:27.0823 3984 [ 7FAEC13F1ADD619F4B5B2D2CBF841E8E ] iusb3xhc C:\Windows\system32\DRIVERS\iusb3xhc.sys
20:36:27.0835 3984 iusb3xhc - ok
20:36:27.0839 3984 [ 5B14FDE79871F83A5E0DCDC01F78BECF ] jhi_service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
20:36:27.0844 3984 jhi_service - ok
20:36:27.0847 3984 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
20:36:27.0853 3984 kbdclass - ok
20:36:27.0855 3984 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
20:36:27.0862 3984 kbdhid - ok
20:36:27.0865 3984 [ 0793F40B9B8A1BDD266296409DBD91EA ] KeyIso C:\Windows\system32\lsass.exe
20:36:27.0873 3984 KeyIso - ok
20:36:27.0877 3984 [ CCD53B5BD33CE0C889E830D839C8B66E ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:36:27.0882 3984 KSecDD - ok
20:36:27.0885 3984 [ 9FF918A261752C12639E8AD4208D2C2F ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
20:36:27.0892 3984 KSecPkg - ok
20:36:27.0894 3984 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
20:36:27.0919 3984 ksthunk - ok
20:36:27.0924 3984 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
20:36:27.0950 3984 KtmRm - ok
20:36:27.0955 3984 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll
20:36:27.0980 3984 LanmanServer - ok
20:36:27.0984 3984 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:36:28.0008 3984 LanmanWorkstation - ok
20:36:28.0012 3984 [ 87D6731F70D017590E12735ECC746CDE ] LGDDCDevice C:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys
20:36:28.0014 3984 LGDDCDevice ( UnsignedFile.Multi.Generic ) - warning
20:36:28.0015 3984 LGDDCDevice - detected UnsignedFile.Multi.Generic (1)
20:36:28.0018 3984 [ 089010666D9EA3BD17AFEDE301950B09 ] LGII2CDevice C:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys
20:36:28.0020 3984 LGII2CDevice ( UnsignedFile.Multi.Generic ) - warning
20:36:28.0020 3984 LGII2CDevice - detected UnsignedFile.Multi.Generic (1)
20:36:28.0023 3984 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:36:28.0048 3984 lltdio - ok
20:36:28.0053 3984 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:36:28.0079 3984 lltdsvc - ok
20:36:28.0082 3984 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
20:36:28.0107 3984 lmhosts - ok
20:36:28.0110 3984 [ 6B5938A0B2C0855E2BFE77793A982EB5 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
20:36:28.0118 3984 LMS - ok
20:36:28.0123 3984 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
20:36:28.0128 3984 LSI_FC - ok
20:36:28.0133 3984 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
20:36:28.0138 3984 LSI_SAS - ok
20:36:28.0142 3984 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
20:36:28.0147 3984 LSI_SAS2 - ok
20:36:28.0150 3984 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
20:36:28.0157 3984 LSI_SCSI - ok
20:36:28.0159 3984 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
20:36:28.0184 3984 luafv - ok
20:36:28.0188 3984 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:36:28.0195 3984 Mcx2Svc - ok
20:36:28.0199 3984 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys
20:36:28.0204 3984 megasas - ok
20:36:28.0209 3984 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
20:36:28.0217 3984 MegaSR - ok
20:36:28.0220 3984 [ 772A1DEEDFDBC244183B5C805D1B7D85 ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
20:36:28.0224 3984 MEIx64 - ok
20:36:28.0227 3984 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
20:36:28.0252 3984 MMCSS - ok
20:36:28.0255 3984 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
20:36:28.0279 3984 Modem - ok
20:36:28.0282 3984 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:36:28.0290 3984 monitor - ok
20:36:28.0294 3984 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
20:36:28.0299 3984 mouclass - ok
20:36:28.0302 3984 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:36:28.0308 3984 mouhid - ok
20:36:28.0310 3984 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
20:36:28.0317 3984 mountmgr - ok
20:36:28.0319 3984 [ E6DB6C61739E18906DC2C4191F6EDEA2 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:36:28.0325 3984 MozillaMaintenance - ok
20:36:28.0329 3984 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
20:36:28.0335 3984 mpio - ok
20:36:28.0338 3984 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:36:28.0362 3984 mpsdrv - ok
20:36:28.0370 3984 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
20:36:28.0402 3984 MpsSvc - ok
20:36:28.0405 3984 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:36:28.0415 3984 MRxDAV - ok
20:36:28.0419 3984 [ FAF015B07E3A2874A790A39B7D2C579F ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:36:28.0443 3984 mrxsmb - ok
20:36:28.0448 3984 [ 08E2345DF129082BCDFFDC1440F9C00D ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:36:28.0473 3984 mrxsmb10 - ok
20:36:28.0477 3984 [ 108D87409C5812EF47D81E22843E8C9D ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:36:28.0500 3984 mrxsmb20 - ok
20:36:28.0504 3984 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
20:36:28.0509 3984 msahci - ok
20:36:28.0513 3984 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
20:36:28.0519 3984 msdsm - ok
20:36:28.0523 3984 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
20:36:28.0532 3984 MSDTC - ok
20:36:28.0537 3984 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:36:28.0560 3984 Msfs - ok
20:36:28.0564 3984 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
20:36:28.0588 3984 mshidkmdf - ok
20:36:28.0590 3984 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
20:36:28.0595 3984 msisadrv - ok
20:36:28.0600 3984 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:36:28.0625 3984 MSiSCSI - ok
20:36:28.0628 3984 msiserver - ok
20:36:28.0632 3984 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:36:28.0655 3984 MSKSSRV - ok
20:36:28.0658 3984 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:36:28.0682 3984 MSPCLOCK - ok
20:36:28.0684 3984 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:36:28.0708 3984 MSPQM - ok
20:36:28.0713 3984 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:36:28.0722 3984 MsRPC - ok
20:36:28.0725 3984 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
20:36:28.0730 3984 mssmbios - ok
20:36:28.0733 3984 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:36:28.0757 3984 MSTEE - ok
20:36:28.0759 3984 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
20:36:28.0767 3984 MTConfig - ok
20:36:28.0769 3984 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
20:36:28.0775 3984 Mup - ok
20:36:28.0782 3984 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
20:36:28.0809 3984 napagent - ok
20:36:28.0814 3984 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:36:28.0834 3984 NativeWifiP - ok
20:36:28.0844 3984 [ 79B47FD40D9A817E932F9D26FAC0A81C ] NDIS C:\Windows\system32\drivers\ndis.sys
20:36:28.0859 3984 NDIS - ok
20:36:28.0862 3984 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
20:36:28.0887 3984 NdisCap - ok
20:36:28.0889 3984 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:36:28.0914 3984 NdisTapi - ok
20:36:28.0917 3984 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:36:28.0940 3984 Ndisuio - ok
20:36:28.0944 3984 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:36:28.0968 3984 NdisWan - ok
20:36:28.0972 3984 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:36:28.0994 3984 NDProxy - ok
20:36:28.0998 3984 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:36:29.0022 3984 NetBIOS - ok
20:36:29.0027 3984 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
20:36:29.0052 3984 NetBT - ok
20:36:29.0054 3984 [ 0793F40B9B8A1BDD266296409DBD91EA ] Netlogon C:\Windows\system32\lsass.exe
20:36:29.0063 3984 Netlogon - ok
20:36:29.0068 3984 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
20:36:29.0095 3984 Netman - ok
20:36:29.0099 3984 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:36:29.0104 3984 NetMsmqActivator - ok
20:36:29.0107 3984 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:36:29.0113 3984 NetPipeActivator - ok
20:36:29.0119 3984 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
20:36:29.0148 3984 netprofm - ok
20:36:29.0150 3984 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:36:29.0155 3984 NetTcpActivator - ok
20:36:29.0158 3984 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:36:29.0163 3984 NetTcpPortSharing - ok
20:36:29.0167 3984 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
20:36:29.0172 3984 nfrd960 - ok
20:36:29.0175 3984 [ 060928815D300B13BC6445949E21387A ] NitroReaderDriverReadSpool3 C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
20:36:29.0183 3984 NitroReaderDriverReadSpool3 - ok
20:36:29.0188 3984 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll
20:36:29.0214 3984 NlaSvc - ok
20:36:29.0217 3984 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:36:29.0240 3984 Npfs - ok
20:36:29.0244 3984 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
20:36:29.0268 3984 nsi - ok
20:36:29.0272 3984 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:36:29.0295 3984 nsiproxy - ok
20:36:29.0312 3984 [ 05D78AA5CB5F3F5C31160BDB955D0B7C ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:36:29.0334 3984 Ntfs - ok
20:36:29.0338 3984 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
20:36:29.0362 3984 Null - ok
20:36:29.0364 3984 [ 36D89E0FF4F327F7EC8ECF92027686E7 ] nuviocir C:\Windows\system32\DRIVERS\nuviocir_win7_x64.sys
20:36:29.0368 3984 nuviocir ( UnsignedFile.Multi.Generic ) - warning
20:36:29.0368 3984 nuviocir - detected UnsignedFile.Multi.Generic (1)
20:36:29.0372 3984 [ 5D9FD91F3D38DC9DA01E3CB5FA89CD48 ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:36:29.0378 3984 nvraid - ok
20:36:29.0382 3984 [ F7CD50FE7139F07E77DA8AC8033D1832 ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:36:29.0388 3984 nvstor - ok
20:36:29.0392 3984 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
20:36:29.0398 3984 nv_agp - ok
20:36:29.0404 3984 [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:36:29.0413 3984 odserv - ok
20:36:29.0417 3984 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
20:36:29.0423 3984 ohci1394 - ok
20:36:29.0427 3984 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:36:29.0432 3984 ose - ok
20:36:29.0437 3984 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
20:36:29.0447 3984 p2pimsvc - ok
20:36:29.0453 3984 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
20:36:29.0463 3984 p2psvc - ok
20:36:29.0467 3984 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\drivers\parport.sys
20:36:29.0474 3984 Parport - ok
20:36:29.0477 3984 [ 871EADAC56B0A4C6512BBE32753CCF79 ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:36:29.0483 3984 partmgr - ok
20:36:29.0487 3984 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
20:36:29.0499 3984 PcaSvc - ok
20:36:29.0503 3984 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
20:36:29.0509 3984 pci - ok
20:36:29.0513 3984 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
20:36:29.0518 3984 pciide - ok
20:36:29.0522 3984 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
20:36:29.0529 3984 pcmcia - ok
20:36:29.0532 3984 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
20:36:29.0537 3984 pcw - ok
20:36:29.0544 3984 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:36:29.0573 3984 PEAUTH - ok
20:36:29.0585 3984 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
20:36:29.0603 3984 PeerDistSvc - ok
20:36:29.0617 3984 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
20:36:29.0624 3984 PerfHost - ok
20:36:29.0642 3984 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
20:36:29.0675 3984 pla - ok
20:36:29.0683 3984 [ B806E50427511BCF4AD8E8239C3E25FA ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:36:29.0709 3984 PlugPlay - ok
20:36:29.0713 3984 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
20:36:29.0719 3984 PNRPAutoReg - ok
20:36:29.0724 3984 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
20:36:29.0734 3984 PNRPsvc - ok
20:36:29.0740 3984 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:36:29.0768 3984 PolicyAgent - ok
20:36:29.0773 3984 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
20:36:29.0799 3984 Power - ok
20:36:29.0803 3984 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:36:29.0827 3984 PptpMiniport - ok
20:36:29.0829 3984 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys
20:36:29.0837 3984 Processor - ok
20:36:29.0840 3984 [ 5C78838B4D166D1A27DB3A8A820C799A ] ProfSvc C:\Windows\system32\profsvc.dll
20:36:29.0865 3984 ProfSvc - ok
20:36:29.0868 3984 [ 0793F40B9B8A1BDD266296409DBD91EA ] ProtectedStorage C:\Windows\system32\lsass.exe
20:36:29.0875 3984 ProtectedStorage - ok
20:36:29.0880 3984 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
20:36:29.0904 3984 Psched - ok
20:36:29.0918 3984 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
20:36:29.0939 3984 ql2300 - ok
20:36:29.0943 3984 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
20:36:29.0949 3984 ql40xx - ok
20:36:29.0953 3984 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
20:36:29.0967 3984 QWAVE - ok
20:36:29.0969 3984 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:36:29.0979 3984 QWAVEdrv - ok
20:36:29.0982 3984 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:36:30.0007 3984 RasAcd - ok
20:36:30.0009 3984 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
20:36:30.0034 3984 RasAgileVpn - ok
20:36:30.0037 3984 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
20:36:30.0062 3984 RasAuto - ok
20:36:30.0065 3984 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:36:30.0089 3984 Rasl2tp - ok
20:36:30.0094 3984 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
20:36:30.0120 3984 RasMan - ok
20:36:30.0124 3984 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:36:30.0149 3984 RasPppoe - ok
20:36:30.0152 3984 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:36:30.0175 3984 RasSstp - ok
20:36:30.0182 3984 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:36:30.0207 3984 rdbss - ok
20:36:30.0209 3984 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
20:36:30.0218 3984 rdpbus - ok
20:36:30.0220 3984 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:36:30.0245 3984 RDPCDD - ok
20:36:30.0250 3984 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
20:36:30.0257 3984 RDPDR - ok
20:36:30.0260 3984 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:36:30.0284 3984 RDPENCDD - ok
20:36:30.0289 3984 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
20:36:30.0313 3984 RDPREFMP - ok
20:36:30.0317 3984 [ 15B66C206B5CB095BAB980553F38ED23 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:36:30.0340 3984 RDPWD - ok
20:36:30.0345 3984 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
20:36:30.0352 3984 rdyboost - ok
20:36:30.0355 3984 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
20:36:30.0380 3984 RemoteAccess - ok
20:36:30.0385 3984 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:36:30.0410 3984 RemoteRegistry - ok
20:36:30.0413 3984 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
20:36:30.0438 3984 RpcEptMapper - ok
20:36:30.0440 3984 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
20:36:30.0449 3984 RpcLocator - ok
20:36:30.0454 3984 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
20:36:30.0482 3984 RpcSs - ok
20:36:30.0485 3984 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:36:30.0510 3984 rspndr - ok
20:36:30.0523 3984 [ 9140DB0911DE035FED0A9A77A2D156EA ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
20:36:30.0533 3984 RTL8167 - ok
20:36:30.0537 3984 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
20:36:30.0542 3984 s3cap - ok
20:36:30.0545 3984 [ 0793F40B9B8A1BDD266296409DBD91EA ] SamSs C:\Windows\system32\lsass.exe
20:36:30.0553 3984 SamSs - ok
20:36:30.0554 3984 SANDRA - ok
20:36:30.0560 3984 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
20:36:30.0565 3984 sbp2port - ok
20:36:30.0569 3984 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:36:30.0595 3984 SCardSvr - ok
20:36:30.0599 3984 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
20:36:30.0622 3984 scfilter - ok
20:36:30.0632 3984 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
20:36:30.0664 3984 Schedule - ok
20:36:30.0668 3984 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
20:36:30.0690 3984 SCPolicySvc - ok
20:36:30.0695 3984 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:36:30.0703 3984 SDRSVC - ok
20:36:30.0705 3984 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:36:30.0730 3984 secdrv - ok
20:36:30.0733 3984 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
20:36:30.0757 3984 seclogon - ok
20:36:30.0760 3984 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll
20:36:30.0785 3984 SENS - ok
20:36:30.0789 3984 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
20:36:30.0797 3984 SensrSvc - ok
20:36:30.0799 3984 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\drivers\serenum.sys
20:36:30.0805 3984 Serenum - ok
20:36:30.0809 3984 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\drivers\serial.sys
20:36:30.0817 3984 Serial - ok
20:36:30.0819 3984 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys
20:36:30.0827 3984 sermouse - ok
20:36:30.0834 3984 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
20:36:30.0858 3984 SessionEnv - ok
20:36:30.0862 3984 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
20:36:30.0869 3984 sffdisk - ok
20:36:30.0872 3984 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
20:36:30.0880 3984 sffp_mmc - ok
20:36:30.0884 3984 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
20:36:30.0892 3984 sffp_sd - ok
20:36:30.0895 3984 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
20:36:30.0902 3984 sfloppy - ok
20:36:30.0907 3984 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:36:30.0934 3984 SharedAccess - ok
20:36:30.0939 3984 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:36:30.0965 3984 ShellHWDetection - ok
20:36:30.0968 3984 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
20:36:30.0973 3984 SiSRaid2 - ok
20:36:30.0977 3984 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
20:36:30.0982 3984 SiSRaid4 - ok
20:36:30.0984 3984 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:36:31.0009 3984 Smb - ok
20:36:31.0015 3984 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:36:31.0023 3984 SNMPTRAP - ok
20:36:31.0027 3984 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
20:36:31.0032 3984 spldr - ok
20:36:31.0038 3984 [ B96C17B5DC1424D56EEA3A99E97428CD ] Spooler C:\Windows\System32\spoolsv.exe
20:36:31.0067 3984 Spooler - ok
20:36:31.0094 3984 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
20:36:31.0144 3984 sppsvc - ok
20:36:31.0148 3984 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
20:36:31.0173 3984 sppuinotify - ok
20:36:31.0180 3984 [ 2098B8556D1CEC2ACA9A29CD479E3692 ] srv C:\Windows\system32\DRIVERS\srv.sys
20:36:31.0207 3984 srv - ok
20:36:31.0213 3984 [ D0F73A42040F21F92FD314B42AC5C9E7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:36:31.0239 3984 srv2 - ok
20:36:31.0243 3984 [ 2BA8F3250828CCDB4204ECF2C6F40B6A ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:36:31.0267 3984 srvnet - ok
20:36:31.0272 3984 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:36:31.0298 3984 SSDPSRV - ok
20:36:31.0303 3984 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:36:31.0328 3984 SstpSvc - ok
20:36:31.0330 3984 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys
20:36:31.0335 3984 stexstor - ok
20:36:31.0343 3984 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
20:36:31.0358 3984 stisvc - ok
20:36:31.0362 3984 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
20:36:31.0367 3984 storflt - ok
20:36:31.0369 3984 [ C40841817EF57D491F22EB103DA587CC ] StorSvc C:\Windows\system32\storsvc.dll
20:36:31.0377 3984 StorSvc - ok
20:36:31.0379 3984 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:\Windows\system32\drivers\storvsc.sys
20:36:31.0384 3984 storvsc - ok
20:36:31.0387 3984 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
20:36:31.0392 3984 swenum - ok
20:36:31.0398 3984 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
20:36:31.0427 3984 swprv - ok
20:36:31.0443 3984 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
20:36:31.0468 3984 SysMain - ok
20:36:31.0472 3984 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:36:31.0483 3984 TabletInputService - ok
20:36:31.0488 3984 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
20:36:31.0514 3984 TapiSrv - ok
20:36:31.0517 3984 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
20:36:31.0542 3984 TBS - ok
20:36:31.0557 3984 [ 509383E505C973ED7534A06B3D19688D ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:36:31.0583 3984 Tcpip - ok
20:36:31.0600 3984 [ 509383E505C973ED7534A06B3D19688D ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
20:36:31.0625 3984 TCPIP6 - ok
20:36:31.0630 3984 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:36:31.0654 3984 tcpipreg - ok
20:36:31.0658 3984 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:36:31.0683 3984 TDPIPE - ok
20:36:31.0685 3984 [ E4245BDA3190A582D55ED09E137401A9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:36:31.0709 3984 TDTCP - ok
20:36:31.0713 3984 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:36:31.0737 3984 tdx - ok
20:36:31.0740 3984 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
20:36:31.0745 3984 TermDD - ok
20:36:31.0753 3984 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
20:36:31.0782 3984 TermService - ok
20:36:31.0785 3984 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
20:36:31.0797 3984 Themes - ok
20:36:31.0799 3984 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
20:36:31.0824 3984 THREADORDER - ok
20:36:31.0828 3984 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
20:36:31.0853 3984 TrkWks - ok
20:36:31.0858 3984 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:36:31.0882 3984 TrustedInstaller - ok
20:36:31.0885 3984 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:36:31.0909 3984 tssecsrv - ok
20:36:31.0913 3984 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
20:36:31.0918 3984 TsUsbFlt - ok
20:36:31.0922 3984 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
20:36:31.0928 3984 TsUsbGD - ok
20:36:31.0930 3984 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:36:31.0954 3984 tunnel - ok
20:36:31.0958 3984 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
20:36:31.0963 3984 uagp35 - ok
20:36:31.0968 3984 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:36:31.0993 3984 udfs - ok
20:36:31.0999 3984 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:36:32.0008 3984 UI0Detect - ok
20:36:32.0010 3984 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
20:36:32.0015 3984 uliagpkx - ok
20:36:32.0019 3984 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
20:36:32.0025 3984 umbus - ok
20:36:32.0028 3984 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys
20:36:32.0035 3984 UmPass - ok
20:36:32.0040 3984 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:\Windows\System32\umrdp.dll
20:36:32.0048 3984 UmRdpService - ok
20:36:32.0054 3984 [ D03FE25B3B9EFF45582AA0AA37960D68 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
20:36:32.0062 3984 UNS - ok
20:36:32.0067 3984 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
20:36:32.0094 3984 upnphost - ok
20:36:32.0097 3984 [ C9E9D59C0099A9FF51697E9306A44240 ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
20:36:32.0103 3984 USBAAPL64 - ok
20:36:32.0107 3984 [ 481DFF26B4DCA8F4CBAC1F7DCE1D6829 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:36:32.0114 3984 usbccgp - ok
20:36:32.0118 3984 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
20:36:32.0127 3984 usbcir - ok
20:36:32.0129 3984 [ 74EE782B1D9C241EFE425565854C661C ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
20:36:32.0137 3984 usbehci - ok
20:36:32.0142 3984 [ DC96BD9CCB8403251BCF25047573558E ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:36:32.0152 3984 usbhub - ok
20:36:32.0154 3984 [ 58E546BBAF87664FC57E0F6081E4F609 ] usbohci C:\Windows\system32\drivers\usbohci.sys
20:36:32.0160 3984 usbohci - ok
20:36:32.0163 3984 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
20:36:32.0172 3984 usbprint - ok
20:36:32.0175 3984 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
20:36:32.0183 3984 usbscan - ok
20:36:32.0187 3984 [ D76510CFA0FC09023077F22C2F979D86 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:36:32.0193 3984 USBSTOR - ok
20:36:32.0197 3984 [ 81FB2216D3A60D1284455D511797DB3D ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
20:36:32.0203 3984 usbuhci - ok
20:36:32.0205 3984 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
20:36:32.0230 3984 UxSms - ok
20:36:32.0233 3984 [ 0793F40B9B8A1BDD266296409DBD91EA ] VaultSvc C:\Windows\system32\lsass.exe
20:36:32.0242 3984 VaultSvc - ok
20:36:32.0244 3984 [ FD911873C0BB6945FA38C16E9A2B58F9 ] VClone C:\Windows\system32\DRIVERS\VClone.sys
20:36:32.0249 3984 VClone - ok
20:36:32.0252 3984 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
20:36:32.0257 3984 vdrvroot - ok
20:36:32.0263 3984 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
20:36:32.0290 3984 vds - ok
20:36:32.0293 3984 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:36:32.0302 3984 vga - ok
20:36:32.0304 3984 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
20:36:32.0328 3984 VgaSave - ok
20:36:32.0332 3984 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
20:36:32.0339 3984 vhdmp - ok
20:36:32.0342 3984 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
20:36:32.0347 3984 viaide - ok
20:36:32.0349 3984 [ 3B59BB6D10CF969DBE4DB93D9EAD7FB4 ] VKbms C:\Windows\system32\DRIVERS\VKbms.sys
20:36:32.0354 3984 VKbms - ok
20:36:32.0359 3984 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:\Windows\system32\drivers\vmbus.sys
20:36:32.0365 3984 vmbus - ok
20:36:32.0368 3984 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
20:36:32.0374 3984 VMBusHID - ok
20:36:32.0378 3984 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
20:36:32.0383 3984 volmgr - ok
20:36:32.0388 3984 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:36:32.0397 3984 volmgrx - ok
20:36:32.0402 3984 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
20:36:32.0409 3984 volsnap - ok
20:36:32.0413 3984 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
20:36:32.0419 3984 vsmraid - ok
20:36:32.0434 3984 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
20:36:32.0470 3984 VSS - ok
20:36:32.0473 3984 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
20:36:32.0482 3984 vwifibus - ok
20:36:32.0487 3984 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
20:36:32.0515 3984 W32Time - ok
20:36:32.0519 3984 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys
20:36:32.0527 3984 WacomPen - ok
20:36:32.0529 3984 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
20:36:32.0553 3984 WANARP - ok
20:36:32.0555 3984 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:36:32.0579 3984 Wanarpv6 - ok
20:36:32.0593 3984 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
20:36:32.0610 3984 wbengine - ok
20:36:32.0615 3984 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
20:36:32.0628 3984 WbioSrvc - ok
20:36:32.0634 3984 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:36:32.0648 3984 wcncsvc - ok
20:36:32.0650 3984 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:36:32.0658 3984 WcsPlugInService - ok
20:36:32.0660 3984 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys
20:36:32.0665 3984 Wd - ok
20:36:32.0673 3984 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:36:32.0684 3984 Wdf01000 - ok
20:36:32.0688 3984 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:36:32.0700 3984 WdiServiceHost - ok
20:36:32.0702 3984 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:36:32.0714 3984 WdiSystemHost - ok
20:36:32.0719 3984 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
20:36:32.0732 3984 WebClient - ok
20:36:32.0737 3984 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:36:32.0763 3984 Wecsvc - ok
20:36:32.0765 3984 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:36:32.0792 3984 wercplsupport - ok
20:36:32.0794 3984 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
20:36:32.0819 3984 WerSvc - ok
20:36:32.0823 3984 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
20:36:32.0847 3984 WfpLwf - ok
20:36:32.0849 3984 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
20:36:32.0854 3984 WIMMount - ok
20:36:32.0857 3984 WinDefend - ok
20:36:32.0862 3984 WinHttpAutoProxySvc - ok
20:36:32.0868 3984 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:36:32.0894 3984 Winmgmt - ok
20:36:32.0912 3984 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
20:36:32.0952 3984 WinRM - ok
20:36:32.0958 3984 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
20:36:32.0967 3984 WinUsb - ok
20:36:32.0977 3984 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
20:36:32.0994 3984 Wlansvc - ok
20:36:32.0997 3984 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
20:36:33.0004 3984 WmiAcpi - ok
20:36:33.0009 3984 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:36:33.0019 3984 wmiApSrv - ok
20:36:33.0023 3984 WMPNetworkSvc - ok
20:36:33.0025 3984 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:36:33.0033 3984 WPCSvc - ok
20:36:33.0038 3984 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:36:33.0047 3984 WPDBusEnum - ok
20:36:33.0049 3984 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:36:33.0074 3984 ws2ifsl - ok
20:36:33.0077 3984 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll
20:36:33.0089 3984 wscsvc - ok
20:36:33.0108 3984 [ 9DF12EDBC698B0BC353B3EF84861E430 ] wuauserv C:\Windows\system32\wuaueng.dll
20:36:33.0150 3984 wuauserv - ok
20:36:33.0154 3984 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:36:33.0178 3984 WudfPf - ok
20:36:33.0182 3984 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
20:36:33.0207 3984 WUDFRd - ok
20:36:33.0209 3984 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:36:33.0234 3984 wudfsvc - ok
20:36:33.0239 3984 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
20:36:33.0252 3984 WwanSvc - ok
20:36:33.0255 3984 [ EC760BEE30B167A04A246C29F1A8E120 ] X10Hid C:\Windows\system32\Drivers\x10hid.sys
20:36:33.0259 3984 X10Hid - ok
20:36:33.0262 3984 [ 5A0C788C5BC5F2C993CB60940ADCF95E ] x10nets C:\PROGRA~2\COMMON~1\X10\Common\x10nets.exe
20:36:33.0264 3984 x10nets ( UnsignedFile.Multi.Generic ) - warning
20:36:33.0264 3984 x10nets - detected UnsignedFile.Multi.Generic (1)
20:36:33.0268 3984 ================ Scan global ===============================
20:36:33.0270 3984 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
20:36:33.0274 3984 [ E0406AEF04B088D1C49FC78D0546F689 ] C:\Windows\system32\winsrv.dll
20:36:33.0280 3984 [ E0406AEF04B088D1C49FC78D0546F689 ] C:\Windows\system32\winsrv.dll
20:36:33.0284 3984 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
20:36:33.0289 3984 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
20:36:33.0292 3984 [Global] - ok
20:36:33.0292 3984 ================ Scan MBR ==================================
20:36:33.0294 3984 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:36:33.0354 3984 \Device\Harddisk0\DR0 - ok
20:36:33.0354 3984 ================ Scan VBR ==================================
20:36:33.0357 3984 [ E801596F5D6694B119EC0011D89AE7C4 ] \Device\Harddisk0\DR0\Partition1
20:36:33.0358 3984 \Device\Harddisk0\DR0\Partition1 - ok
20:36:33.0359 3984 [ 901A49532DB9FAE7AE6B1DFCF7F65D7A ] \Device\Harddisk0\DR0\Partition2
20:36:33.0360 3984 \Device\Harddisk0\DR0\Partition2 - ok
20:36:33.0360 3984 ============================================================
20:36:33.0360 3984 Scan finished
20:36:33.0360 3984 ============================================================
20:36:33.0369 2164 Detected object count: 5
20:36:33.0369 2164 Actual detected object count: 5
20:37:07.0085 2164 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:07.0085 2164 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:07.0085 2164 LGDDCDevice ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:07.0085 2164 LGDDCDevice ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:07.0088 2164 LGII2CDevice ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:07.0088 2164 LGII2CDevice ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:07.0088 2164 nuviocir ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:07.0088 2164 nuviocir ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:07.0089 2164 x10nets ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:07.0089 2164 x10nets ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:13.0970 1436 Deinitialize success
danke für die mühe und besten gruss |
|
08.08.2013, 19:51
| #6 |
| /// Malware-holic | web.de suche ungewollt in firefox nach update Hi, wir scannen noch nach Adware, und dann entfernen wir die Web.de Geschichte mit einem Script. Ist alles nicht tragisch. Es sind 3 Logs zu erstellen, bitte gleichzeitig posten. 1. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Neustarten. 2. Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
neustarten. 3. HitmanPro - Download - Filepony Hitmanpro laden, doppelklicken, Scan klicken. Log speichern und posten, bzw als XML exportieren, packen und anhängen. Hitmanpro erst mal schließen.b
__________________ --> web.de suche ungewollt in firefox nach update |
|
08.08.2013, 20:06
| #7 |
| | web.de suche ungewollt in firefox nach update hi, adw Code:
ATTFilter # AdwCleaner v2.306 - Datei am 08/08/2013 um 20:53:28 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional N Service Pack 1 (64 bits)
# Benutzer : **
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\**\Downloads\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\11-suche.xml
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\PIP
***** [Internet Browser] *****
-\\ Internet Explorer v8.0.7601.17514
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v23.0 (de)
Datei : C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [965 octets] - [08/08/2013 20:53:28]
########## EOF - C:\AdwCleaner[S1].txt - [1024 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.3.8 (08.07.2013:4)
OS: Windows 7 Professional N x64
Ran by *** on 08.08.2013 at 20:56:07,83
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\**\AppData\Roaming\mozilla\firefox\profiles\7lradw1d.default\minidumps [61 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.08.2013 at 20:58:59,81
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
hitman Code:
ATTFilter
liebe grüsse |
|
08.08.2013, 20:07
| #8 |
| /// Malware-holic | web.de suche ungewollt in firefox nach update Danke, Hitmanpro Funde, nach schließen des Browsers, löschen lassen, neustart, neues FRST Log
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 20:16
| #9 |
| | web.de suche ungewollt in firefox nach update hi, bist schnell  log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2013
Ran by ***** (administrator) on 08-08-2013 21:14:11
Running from C:\Users\*****\Downloads
Windows 7 Professional N Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(X10) C:\PROGRA~2\COMMON~1\X10\Common\x10nets.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Windows\SysWOW64\HsMgr.exe
() C:\Windows\system\HsMgr64.exe
() C:\Program Files (x86)\LG Soft India\forteManager\bin\Monitor.exe
(CMedia) C:\Program Files\ASUS Xonar DX Audio\Customapp\ASUSAUDIOCENTER.EXE
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
() C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razerhid.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razertra.exe
(Razer Inc.) C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razerofa.exe
() C:\Program Files (x86)\Razer\DeathAdderBlackEdition\vdDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Cmaudio8788] - C:\Windows\Syswow64\cmicnfgp.dll [8769536 2011-05-12] (C-Media Corporation)
HKLM\...\Run: [Cmaudio8788GX] - C:\Windows\syswow64\HsMgr.exe [200704 2008-07-11] ()
HKLM\...\Run: [Cmaudio8788GX64] - C:\Windows\system\HsMgr64.exe [282112 2008-07-11] ()
HKCU\...\Run: [ISUSPM Startup] - C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [DeathAdderBlackEdition] - C:\Program Files (x86)\Razer\DeathAdderBlackEdition\razerhid.exe [246272 2011-03-21] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\forteManager.lnk
ShortcutTarget: forteManager.lnk -> C:\Program Files (x86)\LG Soft India\forteManager\bin\Monitor.exe ()
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default
FF SelectedSearchEngine: WEB.DE Suche
FF Homepage: google.de
FF NetworkProxy: "http", "www-proxy.t-online.de"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\webde-suche.xml
FF Extension: Youtube Video Replay - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\Extensions\{e1aaa9f8-4500-47f1-9a0a-b02bd60e4076}
FF Extension: info - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\Extensions\info@maltegoetz.de.xpi
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
==================== Services (Whitelisted) =================
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-05-01] (Nitro PDF Software)
R2 x10nets; C:\PROGRA~2\COMMON~1\X10\Common\x10nets.exe [20480 2001-11-12] (X10)
==================== Drivers (Whitelisted) ====================
R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc)
R3 DABlackFltr; C:\Windows\System32\drivers\DABlack.sys [23040 2010-11-29] (Razer (Asia-Pacific) Pte Ltd)
S3 LGDDCDevice; C:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys [14336 2009-04-24] ()
S3 LGII2CDevice; C:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys [18432 2009-04-24] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [15768 2006-11-15] (X10 Wireless Technology, Inc.)
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP3a\WNt500x64\Sandra.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-08 21:01 - 2013-08-08 21:05 - 00007278 _____ C:\Users\*****\Desktop\HitmanPro_20130808_2101.log
2013-08-08 21:01 - 2013-08-08 21:01 - 00000000 ____D C:\Program Files\HitmanPro
2013-08-08 21:00 - 2013-08-08 21:01 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-08 21:00 - 2013-08-08 21:00 - 09853928 _____ (SurfRight B.V.) C:\Users\*****\Downloads\HitmanPro_x64.exe
2013-08-08 20:58 - 2013-08-08 21:09 - 00000757 _____ C:\Users\*****\Desktop\JRT.txt
2013-08-08 20:56 - 2013-08-08 20:56 - 00000000 ____D C:\Windows\ERUNT
2013-08-08 20:55 - 2013-08-08 20:55 - 00957230 _____ (Oleg N. Scherbakov) C:\Users\*****\Downloads\JRT.exe
2013-08-08 20:55 - 2013-08-08 20:55 - 00001081 _____ C:\Users\*****\Desktop\AdwCleaner[S1].txt
2013-08-08 20:53 - 2013-08-08 20:53 - 00001093 _____ C:\AdwCleaner[S1].txt
2013-08-08 20:52 - 2013-08-08 20:52 - 00666633 _____ C:\Users\*****\Downloads\adwcleaner.exe
2013-08-08 20:35 - 2013-08-08 20:35 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\*****\Downloads\tdsskiller.exe
2013-08-08 20:31 - 2013-08-08 20:31 - 00010854 _____ C:\ComboFix.txt
2013-08-08 20:26 - 2013-08-08 20:31 - 00000000 ____D C:\Qoobox
2013-08-08 20:26 - 2013-08-08 20:30 - 00000000 ____D C:\Windows\erdnt
2013-08-08 20:26 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-08 20:26 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-08 20:26 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-08 20:26 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-08 20:26 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-08 20:26 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-08 20:26 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-08 20:26 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-08 20:25 - 2013-08-08 20:25 - 05100713 ____R (Swearware) C:\Users\*****\Downloads\ComboFix.exe
2013-08-08 20:24 - 2013-08-08 20:24 - 00007942 _____ C:\Users\*****\Desktop\Mappe1.xlsx
2013-08-08 18:33 - 2013-08-08 18:34 - 00012277 _____ C:\Users\*****\Downloads\Addition.txt
2013-08-08 18:33 - 2013-08-08 18:33 - 01790059 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe
2013-08-08 18:33 - 2013-08-08 18:33 - 00000000 ____D C:\FRST
2013-08-08 17:53 - 2013-08-08 17:53 - 00377856 _____ C:\Users\*****\Downloads\gmer_2.1.19163.exe
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\Users\*****\AppData\Roaming\Malwarebytes
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 17:41 - 2013-08-08 17:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 16:55 - 2013-08-08 16:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-01 23:26 - 2013-08-01 23:26 - 00286542 _____ C:\Users\*****\Desktop\adressse.odt
2013-08-01 14:50 - 2013-08-01 14:50 - 00000000 ____D C:\Users\*****\Desktop\tococd2
2013-08-01 14:48 - 2013-08-01 14:49 - 00000000 ____D C:\Users\*****\Desktop\tococd1
2013-08-01 14:44 - 2013-08-01 14:45 - 00000000 ____D C:\Users\*****\Desktop\bloc
2013-08-01 14:42 - 2013-08-01 14:42 - 00000000 ____D C:\Users\*****\Desktop\everyday
2013-07-30 19:34 - 2013-08-03 17:41 - 00000000 ____D C:\Users\*****\Desktop\ebaybilder
2013-07-27 18:35 - 2013-08-08 16:43 - 00000000 ____D C:\Users\*****\Desktop\lossless
2013-07-25 20:31 - 2013-07-25 20:31 - 00001148 _____ C:\Users\*****\Desktop\GTA2.lnk
2013-07-23 13:15 - 2013-07-23 13:15 - 00003210 _____ C:\Windows\System32\Tasks\{F5C1062C-480A-4635-A4A1-805DE9A5D4D8}
2013-07-22 12:14 - 2013-07-22 12:18 - 00000050 _____ C:\Users\*****\Desktop\AIDAkey.txt
2013-07-22 12:12 - 2013-07-22 12:12 - 00001231 _____ C:\Users\*****\Desktop\AIDA64 Extreme Edition.lnk
2013-07-22 12:12 - 2013-07-22 12:12 - 00000000 ____D C:\Program Files (x86)\FinalWire
2013-07-22 12:11 - 2013-07-22 12:12 - 15199352 _____ (FinalWire Ltd. ) C:\Users\*****\Downloads\aida64extreme300b2500.exe
2013-07-20 22:11 - 2013-08-08 21:14 - 00000000 ____D C:\Users\*****\AppData\Roaming\NetSpeedMonitor
2013-07-20 22:11 - 2013-07-20 22:11 - 00000000 ____D C:\Program Files\NetSpeedMonitor
2013-07-20 20:58 - 2013-07-25 20:31 - 00002184 _____ C:\Windows\Directx.log
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\directx
2013-07-19 21:10 - 2013-07-19 21:10 - 00019981 _____ C:\Users\*****\Desktop\formular.odt
2013-07-19 19:51 - 2013-07-19 19:51 - 00010111 _____ C:\Users\*****\Desktop\Unbenannt 1.odt
2013-07-19 14:19 - 2013-07-19 14:45 - 460601995 _____ C:\Users\*****\Desktop\House Music _ New Dance Club Mix [PeeTee] #30.mp4
2013-07-17 01:11 - 2013-07-17 01:11 - 00000000 ____D C:\Users\*****\Desktop\Jules & Moss - Panda High [TURNBEUTEL11]
2013-07-15 11:41 - 2013-07-15 11:42 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2013-07-13 11:51 - 2013-07-13 11:51 - 00000792 _____ C:\Users\*****\.recently-used.xbel
2013-07-12 21:36 - 2013-07-19 22:32 - 00000000 ____D C:\Users\*****\Documents\OpenTTD
2013-07-12 14:02 - 2013-07-12 14:50 - 416972409 _____ C:\Users\*****\Desktop\High Contrast Essential mix 5.4.2003.flv
==================== One Month Modified Files and Folders =======
2013-08-08 21:14 - 2013-05-20 22:35 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc
2013-08-08 21:13 - 2013-05-20 00:52 - 00012593 _____ C:\Windows\se*****t.log
2013-08-08 21:13 - 2013-05-17 18:18 - 00000828 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2013-08-08 21:13 - 2013-05-17 17:26 - 00671112 _____ C:\Windows\WindowsUpdate.log
2013-08-08 21:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 21:09 - 2013-08-08 20:58 - 00000757 _____ C:\Users\*****\Desktop\JRT.txt
2013-08-08 21:05 - 2013-08-08 21:01 - 00007278 _____ C:\Users\*****\Desktop\HitmanPro_20130808_2101.log
2013-08-08 21:01 - 2013-08-08 21:01 - 00000000 ____D C:\Program Files\HitmanPro
2013-08-08 21:01 - 2013-08-08 21:00 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-08 21:01 - 2009-07-14 06:50 - 00020112 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 21:01 - 2009-07-14 06:50 - 00020112 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 21:00 - 2013-08-08 21:00 - 09853928 _____ (SurfRight B.V.) C:\Users\*****\Downloads\HitmanPro_x64.exe
2013-08-08 20:59 - 2011-04-12 10:14 - 00671326 _____ C:\Windows\system32\perfh007.dat
2013-08-08 20:59 - 2011-04-12 10:14 - 00137622 _____ C:\Windows\system32\perfc007.dat
2013-08-08 20:59 - 2009-07-14 07:12 - 01546758 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-08 20:56 - 2013-08-08 20:56 - 00000000 ____D C:\Windows\ERUNT
2013-08-08 20:55 - 2013-08-08 20:55 - 00957230 _____ (Oleg N. Scherbakov) C:\Users\*****\Downloads\JRT.exe
2013-08-08 20:55 - 2013-08-08 20:55 - 00001081 _____ C:\Users\*****\Desktop\AdwCleaner[S1].txt
2013-08-08 20:53 - 2013-08-08 20:53 - 00001093 _____ C:\AdwCleaner[S1].txt
2013-08-08 20:53 - 2013-06-02 01:04 - 00002970 _____ C:\Windows\PFRO.log
2013-08-08 20:53 - 2013-05-18 23:43 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-08 20:52 - 2013-08-08 20:52 - 00666633 _____ C:\Users\*****\Downloads\adwcleaner.exe
2013-08-08 20:35 - 2013-08-08 20:35 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\*****\Downloads\tdsskiller.exe
2013-08-08 20:31 - 2013-08-08 20:31 - 00010854 _____ C:\ComboFix.txt
2013-08-08 20:31 - 2013-08-08 20:26 - 00000000 ____D C:\Qoobox
2013-08-08 20:30 - 2013-08-08 20:26 - 00000000 ____D C:\Windows\erdnt
2013-08-08 20:30 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-08 20:25 - 2013-08-08 20:25 - 05100713 ____R (Swearware) C:\Users\*****\Downloads\ComboFix.exe
2013-08-08 20:24 - 2013-08-08 20:24 - 00007942 _____ C:\Users\*****\Desktop\Mappe1.xlsx
2013-08-08 18:34 - 2013-08-08 18:33 - 00012277 _____ C:\Users\*****\Downloads\Addition.txt
2013-08-08 18:33 - 2013-08-08 18:33 - 01790059 _____ (Farbar) C:\Users\*****\Downloads\FRST64.exe
2013-08-08 18:33 - 2013-08-08 18:33 - 00000000 ____D C:\FRST
2013-08-08 17:53 - 2013-08-08 17:53 - 00377856 _____ C:\Users\*****\Downloads\gmer_2.1.19163.exe
2013-08-08 17:51 - 2013-06-02 01:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\Users\*****\AppData\Roaming\Malwarebytes
2013-08-08 17:42 - 2013-08-08 17:42 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 17:41 - 2013-08-08 17:41 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-08 16:55 - 2013-08-08 16:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-08 16:43 - 2013-07-27 18:35 - 00000000 ____D C:\Users\*****\Desktop\lossless
2013-08-08 10:30 - 2013-05-17 18:18 - 00000830 _____ C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2013-08-04 15:32 - 2013-07-07 22:45 - 00011232 _____ C:\Users\*****\Desktop\adressen.odt
2013-08-03 17:41 - 2013-07-30 19:34 - 00000000 ____D C:\Users\*****\Desktop\ebaybilder
2013-08-01 23:26 - 2013-08-01 23:26 - 00286542 _____ C:\Users\*****\Desktop\adressse.odt
2013-08-01 23:26 - 2013-05-18 01:13 - 00000000 ____D C:\Users\*****\Desktop\desk
2013-08-01 14:50 - 2013-08-01 14:50 - 00000000 ____D C:\Users\*****\Desktop\tococd2
2013-08-01 14:49 - 2013-08-01 14:48 - 00000000 ____D C:\Users\*****\Desktop\tococd1
2013-08-01 14:45 - 2013-08-01 14:44 - 00000000 ____D C:\Users\*****\Desktop\bloc
2013-08-01 14:42 - 2013-08-01 14:42 - 00000000 ____D C:\Users\*****\Desktop\everyday
2013-07-30 19:48 - 2013-05-17 18:19 - 00000000 ____D C:\Users\*****\AppData\Local\Paint.NET
2013-07-25 20:31 - 2013-07-25 20:31 - 00001148 _____ C:\Users\*****\Desktop\GTA2.lnk
2013-07-25 20:31 - 2013-07-20 20:58 - 00002184 _____ C:\Windows\Directx.log
2013-07-23 13:15 - 2013-07-23 13:15 - 00003210 _____ C:\Windows\System32\Tasks\{F5C1062C-480A-4635-A4A1-805DE9A5D4D8}
2013-07-23 13:05 - 2013-05-17 18:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 12:18 - 2013-07-22 12:14 - 00000050 _____ C:\Users\*****\Desktop\AIDAkey.txt
2013-07-22 12:12 - 2013-07-22 12:12 - 00001231 _____ C:\Users\*****\Desktop\AIDA64 Extreme Edition.lnk
2013-07-22 12:12 - 2013-07-22 12:12 - 00000000 ____D C:\Program Files (x86)\FinalWire
2013-07-22 12:12 - 2013-07-22 12:11 - 15199352 _____ (FinalWire Ltd. ) C:\Users\*****\Downloads\aida64extreme300b2500.exe
2013-07-20 22:11 - 2013-07-20 22:11 - 00000000 ____D C:\Program Files\NetSpeedMonitor
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2013-07-20 20:58 - 2013-07-20 20:58 - 00000000 ____D C:\Program Files (x86)\directx
2013-07-19 22:32 - 2013-07-12 21:36 - 00000000 ____D C:\Users\*****\Documents\OpenTTD
2013-07-19 21:10 - 2013-07-19 21:10 - 00019981 _____ C:\Users\*****\Desktop\formular.odt
2013-07-19 19:51 - 2013-07-19 19:51 - 00010111 _____ C:\Users\*****\Desktop\Unbenannt 1.odt
2013-07-19 14:45 - 2013-07-19 14:19 - 460601995 _____ C:\Users\*****\Desktop\House Music _ New Dance Club Mix [PeeTee] #30.mp4
2013-07-17 01:11 - 2013-07-17 01:11 - 00000000 ____D C:\Users\*****\Desktop\Jules & Moss - Panda High [TURNBEUTEL11]
2013-07-15 11:42 - 2013-07-15 11:41 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2013-07-15 11:42 - 2013-05-18 23:43 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-15 11:42 - 2013-05-18 23:43 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-15 11:42 - 2013-05-18 23:43 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-13 11:51 - 2013-07-13 11:51 - 00000792 _____ C:\Users\*****\.recently-used.xbel
2013-07-13 11:51 - 2013-05-17 17:25 - 00000000 ____D C:\Users\*****
2013-07-12 14:50 - 2013-07-12 14:02 - 416972409 _____ C:\Users\*****\Desktop\High Contrast Essential mix 5.4.2003.flv
2013-07-09 14:33 - 2013-06-21 14:44 - 00000000 ____D C:\Users\*****\Downloads\dwn
2013-07-09 14:31 - 2013-05-17 18:19 - 00090608 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-02 12:06
==================== End Of Log ============================
besten gruss, danke |
|
08.08.2013, 20:20
| #10 |
| /// Malware-holic | web.de suche ungewollt in firefox nach update Hi, 1. Instaliere den Internet explorer 10, auch wenn du den FF nutzt muss dieser aktuell sein. Internet Explorer*10 herunterladen - Internet Explorer*10 herunterladen 2. Fix mit FRST Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter FF SelectedSearchEngine: WEB.DE Suche
bitte teste, ob es im Firefox, internet explorer, und sonstigen evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt. Teste wie pc und programme allgemein laufen. Wenn alles läuft: 4. Die Reihenfolge ist hier entscheidend.
5. PC absichern: als antimalware programm würde ich emsisoft empfehlen. diese haben für mich den besten schutz kostet aber etwas. Computeractive Software Store - Emsisoft Anti-Malware 8 [1-PC] - 63% off RRP testversion: Meine Antivirus-Empfehlung: Emsisoft Anti-Malware insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren. vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen. kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen. http://www.trojaner-board.de/110895-...antivirus.html sag mir welches du nutzt, dann gebe ich konfigurationshinweise. bitte dein bisheriges av deinstalieren die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch! http://www.trojaner-board.de/96344-a...-rechners.html Starte bitte mit der Passage, Windows Vista und Windows 7 Bitte beginne damit, Windows Updates zu instalieren. Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst. Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist: - Updates automatisch Instalieren, - Täglich - Uhrzeit wählen - Bitte den gesammten rest anhaken, außer: - detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist. Klicke jetzt die Schaltfläche "OK" Klicke jetzt "nach Updates suchen". Bitte instaliere zunächst wichtige Updates. Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren. Mache das selbe bitte mit den optionalen Updates. Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist. aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen. als browser rate ich dir zu chrome: http://support.google.com/chrome/bin...&answer=118663 anleitung lesen bitte falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen. Sandboxie Die devinition einer Sandbox ist hier nachzulesen: Sandbox Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen. Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen. Download Link: Sandboxie - Download - Filepony anleitung: http://www.trojaner-board.de/71542-a...sandboxie.html ausführliche anleitung als pdf, auch abarbeiten: Sandbox Einstellungen | bitte folgende zusatz konfiguration machen: sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen. dort klicke auf sandbox einstellungen. beschrenkungen, bei programm start und internet zugriff schreibe: chrome.exe dann gehe auf anwendungen, webbrowser, chrome. dort aktiviere alles außer gesammten profil ordner freigeben. Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen. Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate. Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten. Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten. Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar. Weiter mit: Maßnahmen für ALLE Windows-Versionen alles komplett durcharbeiten anmerkung zu file hippo. in den settings zusätzlich auswählen: hide beta updates. Run updateChecker when Windows starts Backup Programm: in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an: http://www.trojaner-board.de/82962-w...en-backup.html Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar. Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist. Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern bitte auch lesen, wie mache ich programme für alle sichtbar: Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox. wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird Sandboxie immer gestartet wenn du nen browser aufrufst. wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser passwort sicherheit: jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort bei der passwort verwaltung und erstellung hilft roboform Password Manager, Form Filler, Password Management | RoboForm Password Manager anleitung: RoboForm Manual
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 20:26
| #11 |
| | web.de suche ungewollt in firefox nach update hi, Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-08-2013
Ran by *** at 2013-08-08 21:23:28 Run:1
Running from C:\Users\**\Downloads
Boot Mode: Normal
==============================================
Firefox SelectedSearchEngine deleted successfully.
==== End of Fixlog ====
besten gruss |
|
08.08.2013, 20:33
| #12 |
| /// Malware-holic | web.de suche ungewollt in firefox nach update Sorry. Fix mit FRST Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter FF SearchPlugin: C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\webde-suche.xml
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
08.08.2013, 20:38
| #13 | |
| | web.de suche ungewollt in firefox nach update hi, Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-08-2013
Ran by * at 2013-08-08 21:36:05 Run:2
Running from C:\Users\**\Downloads
Boot Mode: Normal
==============================================
C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\webde-suche.xml => Moved successfully.
"C:\Users\**\AppData\Roaming\Mozilla\Firefox\Profiles\7lradw1d.default\searchplugins\webde-suche.xml" => not found.
==== End of Fixlog ====
besten gruss edit: Zitat:
Geändert von raichu (08.08.2013 um 20:50 Uhr) |
|
09.08.2013, 13:38
| #14 |
| /// Malware-holic | web.de suche ungewollt in firefox nach update Weiter mit 4 und 5 bitte :-)
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
09.08.2013, 14:47
| #15 |
| | web.de suche ungewollt in firefox nach update hi, vielen dank für deinen einsatz. eine kleine symbolische spende habe ich soeben getätig. wenn mal wieder was ist, weiss ich wo ich hilfe bekommen  danke & besten gruss |
|
| Themen zu web.de suche ungewollt in firefox nach update |
| administrator, anti-malware, appdata, autostart, dateien, erfolgreich, explorer, firefox, gelöscht, gen, google, malwarebytes, minute, quarantäne, registrierung, scan, scannen, service, speicher, suche, temp, trojaner, ungewollt, update, version |
WARNUNG an die MITLESER: 
Linear-Darstellung
