Hallo Trojaner-Board-Team,

seit heute (oder vielleicht auch gestern) habe ich das Problem, dass sich Virenscanner (Echtzeitschutz) nicht mehr starten lassen.

Bis vor Kurzem (aka wenige Stunden) hatte ich noch Avira AntiVir drauf, seit heute nun avast! Free Antivirus (jeweils aktuellste Version).

Nachdem ich Dank einer Meldung meines Wartungscenters festgestellt hatte, dass mein Antivir keine Lust mehr hatte (Schirm-Symbol war geschlossen), habe ich versucht das Teil manuell zu starten. Nach Klick auf den entsprechenden Button meldete Antivir "Keine Rückmeldung". Das hielt dann einige Sekunden an und nachdem es sich wieder gefangen hatte, war der Status wie zuvor -> Echtzeitscanner aus.
Also habe ich ein wenig gegoogelt. Nachdem ich diverse Beiträge in diversen Foren (unter anderem dieses und gully-board) gelesen hatte und mir einige Testberichte zu kostenlosen Virenscannern angeschaut hatte, habe ich mich für avast! entschieden.
AntiVir deinstalliert, Avast installiert... und hier nun ein Ähnliches Spiel. Echtzeitschutz ist deaktiviert und lässt sich nicht aktivieren. Wenn ich einen manuellen Scan durchführen will, erscheint folgende Meldung: "Die Prüfung konnte nicht gestartet werden. In der Endpunktzuordnung sind keine weiteren Endpunkte verfügbar" ( ).
Natürlich habe ich auch danach gegoogelt.

Ergebnis vom avadas-Forum: " Malwarebytes Anti-Malware " ausführen. Habe ich gemacht, hier das Ergebnis vom ersten Lauf:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 11.06.2014
Scan Time: 19:47:34
Logfile: 
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.11.06
Rootkit Database: v2014.06.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sarge

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 304950
Time Elapsed: 8 min, 52 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Deep Rootkit Scan: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.PriceGong.A, HKU\S-1-5-21-1610289843-898006340-3999519046-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, Quarantined, [7939b3c0b3c8142232d34d6b17eb11ef], 
PUP.Optional.Softonic.A, HKU\S-1-5-21-1610289843-898006340-3999519046-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, Quarantined, [189a591a18632e08c77d3a72956d7b85], 

Registry Values: 0
(No malicious items detected)

Registry Data: 2
PUP.Optional.Conduit, HKU\S-1-5-21-1610289843-898006340-3999519046-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848&SSPV=IESB04, Good: (hxxp://www.google.com), Bad: (hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848&SSPV=IESB04),Replaced,[06ac94dff88354e2c690383aed17a957]
PUP.Optional.Conduit, HKU\S-1-5-21-1610289843-898006340-3999519046-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com?SearchSource=10&ctid=CT3031778, Good: (hxxp://www.google.com), Bad: (hxxp://search.conduit.com?SearchSource=10&ctid=CT3031778),Replaced,[cbe71e55651601352135cda5cd374eb2]

Folders: 2
PUP.Optional.OpenCandy, C:\Users\Sarge\AppData\Roaming\OpenCandy, Quarantined, [a80a8de64e2d3afcaebe2a5c92706f91], 
PUP.Optional.OpenCandy, C:\Users\Sarge\AppData\Roaming\OpenCandy\85C1D5DC16A74B2EBC9328BE2B22ECE8, Quarantined, [a80a8de64e2d3afcaebe2a5c92706f91], 

Files: 2
PUP.Optional.OpenCandy, C:\Users\Sarge\AppData\Roaming\OpenCandy\85C1D5DC16A74B2EBC9328BE2B22ECE8\TuneUpUtilities2012_de-DE.exe, Quarantined, [a80a8de64e2d3afcaebe2a5c92706f91], 
PUP.Optional.Conduit.A, C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2625848&SearchSource=2&CUI=UN84005470459662977&q=");), Replaced,[773b7bf899e26bcbbd08b8e8fa0a6799]

Physical Sectors: 0
(No malicious items detected)
(end)
         

Die ganzen gemeldeten Dinge habe ich durch das Tool in die Quarantäne verbannt. Nächster Scan zeigte dann dieses Ergebnis:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 11.06.2014
Scan Time: 20:01:08
Logfile: 
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.11.06
Rootkit Database: v2014.06.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Sarge

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 304932
Time Elapsed: 10 min, 37 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Deep Rootkit Scan: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)
         

Soweit, so gut, dachte ich... avast! ließ sich trotzdem nicht starten
Also weiter gegoogelt. Ebenfalls im avadas-forum dann auf einen Uninstaller für avast! gestoßen, das Ding ausgeführt, den Scanner neu installiert und... nichts. Geht immer noch nicht.

Also mal in den Tab "Dienste" vom Task-Manager geschaut. Der Dienst "avast! Antivirus" hat den Status beendet. Starten per Rechtsklick versucht: "Der Vorgang konnte nicht beendet werden. Zugriff verweigert"

Joa... was gibts noch zu sagen?
Als ich heute den rechner zum ersten Mal gestartet hatte, waren alle Verknüpfungen, die auf den Ordner "D:\Programme" (und dessen Unterordner) verwiesen, nicht ausführbar wegen angeblich fehlender Berichtigungen. Wie oben in den Logs zu sehen: Administrator-Account.
Dieses Problem habe ich zwischenzeitlich partiell gelöst, nachdem ich die Sicherheitseinstellungen für diesen Ordner überarbeitet hatte. Partiell deswegen, weil einige Verknüpfungen immer noch nicht ausführbar sind. Jedenfalls klingt das und die Tatsache, dass sich Schutzdienste nicht mehr starten lassen, stark dafür, dass ich mir irgendwas eingefangen habe, dass sich noch irgendwo versteckt und von dem " Malwarebytes Anti-Malware " nicht gefunden wird.

Wie gesagt: Ich habe unter anderem in eurem Forum einiges gelesen und schon einige Ansätze gefunden, die ich eventuell verfolgen könnte. Aber ihr sagt stets, das man alles nur "in Begleitung" machen sollte und daran möchte ich mich nun halten, bevor ich noch irgendwas "kaputt spiele".

Joa... ich glaube, ich habe alles zu meiner Situation gesagt und hoffe nun auf eure Hilfe. Übrigens: Obwohl ich noch diverse andere Foren durchsucht habe, habe ich nur in diesem Forum mein Anliegen gepostet, also keine Sorge

Vielen Dank im Voraus!

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
• Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
• Bitte kein Crossposting ( posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
• Poste die Logfiles direkt in deinen Thread in Code-Tags.
• Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und bei einem Befall durch Malware immer der sicherste Weg. Adware lässt sich in den allermeisten Fällen problemlos entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Posten in Code Tags
Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:

• Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [] CODE /CODE.
• Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also CODE Logfile /CODE
• Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.

Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hallo Sandra,

Ich bin aktuell beruflich recht eingespannt und weiß nicht, wann ich es genau schaffen werde, den Scan durchzuführen. Ich bin am Ball, aber es kann einige Tage dauern, bis ich mich wieder melde.
Das wollte ich nur mal kurz sagen, bevor du dich evtl wunderst, ob da noch was von mir kommt, oder nicht.

Bis denne und schonmal vielen Dank für deine Hilfe

/edit:
Habe es heute doch noch geschafft... hier die Logs:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 02
Ran by Sarge (administrator) on SARGE-PC on 13-06-2014 16:29:04
Running from C:\Users\Sarge\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVAST Software) D:\Programme\AVAST Software\Avast\AvastUI.exe
(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => D:\Programme\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-11] (AVAST Software)
HKU\S-1-5-21-1610289843-898006340-3999519046-1000\...\Run: [DAEMON Tools Lite] => D:\Programme\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-1610289843-898006340-3999519046-1000\...\MountPoints2: {e904f073-92ca-11e2-aa88-1c6f6584f010} - G:\AutoRun.exe
HKU\S-1-5-21-1610289843-898006340-3999519046-1000\...\MountPoints2: {e904f082-92ca-11e2-aa88-1c6f6584f010} - G:\AutoRun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEC2FEE5B58FFCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKLM-x32 - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
URLSearchHook: HKCU - (No Name) - {ff88a983-649d-4207-9336-9b999280b436} - No File
URLSearchHook: HKCU - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {FF88A983-649D-4207-9336-9B999280B436} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @live.heroesandgenerals.com/npretox - D:\Spiele\Heroes & Generals\live\npretox-1.0.6.1\npretoxlive-1.0.6.1.dll (Reto-Moto ApS)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF SearchPlugin: C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\searchplugins\dvdvideosofttb-de-customized-web-search.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\ich@maltegoetz.de [2013-12-13]
FF Extension: DDBAC Plug-In - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\{271A3CF5-5A54-447B-A08F-BE805F0DA60A} [2012-06-28]
FF Extension: Classic Theme Restorer - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-14]
FF Extension: Adblock Plus - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-04-27]
FF Extension: avast! Online Security - D:\Programme\AVAST Software\Avast\WebRep\FF [2014-06-11]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - D:\Programme\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - D:\Programme\AVAST Software\Avast\WebRep\FF [2014-06-11]
FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) =================

S2 avast! Antivirus; D:\Programme\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-11] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-01-20] ()

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-11] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-11] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-11] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-11] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-11] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-11] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-11] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-11] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-26] (DT Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-03-24] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-03-24] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-03-24] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-03-24] () [File not signed]
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-01-19] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [530488 2011-12-08] () [File not signed]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-13 16:29 - 2014-06-13 16:29 - 00011651 _____ () C:\Users\Sarge\Desktop\FRST.txt
2014-06-13 16:28 - 2014-06-13 16:29 - 00000000 ____D () C:\FRST
2014-06-13 16:27 - 2014-06-13 16:27 - 02081792 _____ (Farbar) C:\Users\Sarge\Desktop\FRST64.exe
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-11 20:49 - 2014-06-11 20:49 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-11 20:49 - 2014-06-11 20:49 - 00001003 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-11 20:49 - 2014-06-11 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-11 20:48 - 2014-06-11 20:48 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-11 20:46 - 2014-06-11 20:46 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-06-11 20:20 - 2014-06-11 20:50 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\AVAST Software
2014-06-11 20:19 - 2014-06-11 20:49 - 00003916 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-11 20:19 - 2014-06-11 20:18 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:49 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-11 20:18 - 2014-06-11 20:18 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:18 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402510754505
2014-06-11 19:44 - 2014-06-11 21:13 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-11 19:44 - 2014-06-11 19:44 - 00000736 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-11 19:44 - 2014-06-11 19:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-11 19:44 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-11 19:44 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-11 19:44 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-11 19:33 - 2014-06-11 19:33 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402508002897
2014-06-11 19:33 - 2014-06-11 19:33 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402508002897
2014-06-11 16:08 - 2014-06-11 16:08 - 00257593 _____ () C:\Users\Sarge\Desktop\Berlin_noch nicht fertig.wlmp
2014-06-11 14:41 - 2014-06-11 14:41 - 00000000 ____D () C:\Users\Sarge\AppData\Local\{D6375859-3411-447B-9557-38DA65199AD6}
2014-06-11 14:33 - 2014-06-11 14:33 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2014-05-25 16:53 - 2014-06-10 17:40 - 00000000 ____D () C:\Users\Sarge\AppData\Local\ftblauncher
2014-05-20 19:38 - 2014-05-20 19:38 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-05-16 17:24 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-16 17:24 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-16 17:24 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-16 17:24 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-16 17:24 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-16 17:24 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 19:00 - 2014-05-14 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-05-14 18:59 - 2014-05-14 19:00 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-05-14 18:59 - 2014-05-14 18:59 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-05-14 18:59 - 2014-05-14 18:59 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-05-14 18:59 - 2014-05-14 18:59 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-05-14 18:43 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-14 18:43 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-14 18:43 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 18:43 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 18:43 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 18:43 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 18:43 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 18:43 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 18:43 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 18:43 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-14 18:43 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-14 18:43 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 18:43 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 18:43 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 18:43 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 18:43 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 18:43 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 18:43 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 18:43 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 18:43 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 18:43 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 18:43 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 18:43 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 18:43 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 18:43 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 18:43 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 18:43 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 18:43 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 18:43 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 18:43 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-14 18:43 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-14 18:43 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-14 18:43 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-14 18:43 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-14 18:42 - 2014-05-14 18:42 - 00004224 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-05-14 18:42 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-14 18:42 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-14 18:42 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-05-14 18:42 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

==================== One Month Modified Files and Folders =======

2014-06-13 16:29 - 2014-06-13 16:29 - 00011651 _____ () C:\Users\Sarge\Desktop\FRST.txt
2014-06-13 16:29 - 2014-06-13 16:28 - 00000000 ____D () C:\FRST
2014-06-13 16:29 - 2013-03-25 20:12 - 01467975 _____ () C:\Windows\WindowsUpdate.log
2014-06-13 16:29 - 2011-04-20 14:06 - 00000000 ____D () C:\Users\Sarge\AppData\Local\Temp
2014-06-13 16:27 - 2014-06-13 16:27 - 02081792 _____ (Farbar) C:\Users\Sarge\Desktop\FRST64.exe
2014-06-13 16:25 - 2013-03-25 20:10 - 00913884 _____ () C:\Windows\PFRO.log
2014-06-13 16:25 - 2013-03-25 20:10 - 00033882 _____ () C:\Windows\setupact.log
2014-06-13 16:25 - 2011-04-20 14:43 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-06-13 16:25 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-11 21:13 - 2014-06-11 19:44 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-11 21:08 - 2009-07-14 06:45 - 00014944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-11 21:08 - 2009-07-14 06:45 - 00014944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-11 20:51 - 2009-07-14 19:58 - 00714062 _____ () C:\Windows\system32\perfh007.dat
2014-06-11 20:51 - 2009-07-14 19:58 - 00156778 _____ () C:\Windows\system32\perfc007.dat
2014-06-11 20:51 - 2009-07-14 07:13 - 01662854 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-11 20:50 - 2014-06-11 20:20 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\AVAST Software
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-11 20:49 - 2014-06-11 20:49 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-11 20:49 - 2014-06-11 20:49 - 00001003 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-11 20:49 - 2014-06-11 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-11 20:49 - 2014-06-11 20:19 - 00003916 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-11 20:49 - 2014-06-11 20:18 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-11 20:48 - 2014-06-11 20:48 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-11 20:46 - 2014-06-11 20:46 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-06-11 20:18 - 2014-06-11 20:19 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:18 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:18 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402510754505
2014-06-11 19:44 - 2014-06-11 19:44 - 00000736 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-11 19:44 - 2014-06-11 19:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-11 19:33 - 2014-06-11 19:33 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402508002897
2014-06-11 19:33 - 2014-06-11 19:33 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402508002897
2014-06-11 19:11 - 2011-11-11 15:31 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\PapDesigner
2014-06-11 19:02 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-11 16:08 - 2014-06-11 16:08 - 00257593 _____ () C:\Users\Sarge\Desktop\Berlin_noch nicht fertig.wlmp
2014-06-11 14:41 - 2014-06-11 14:41 - 00000000 ____D () C:\Users\Sarge\AppData\Local\{D6375859-3411-447B-9557-38DA65199AD6}
2014-06-11 14:41 - 2012-01-03 17:20 - 00000000 ____D () C:\Users\Sarge\AppData\Local\Windows Live
2014-06-11 14:39 - 2012-10-24 15:32 - 00000000 ____D () C:\ProgramData\HappyCloud
2014-06-11 14:33 - 2014-06-11 14:33 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2014-06-10 17:40 - 2014-05-25 16:53 - 00000000 ____D () C:\Users\Sarge\AppData\Local\ftblauncher
2014-05-25 16:54 - 2014-05-05 17:19 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\ftblauncher
2014-05-23 15:09 - 2011-07-19 11:58 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-22 14:46 - 2012-12-28 21:04 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-05-20 19:51 - 2012-10-08 20:12 - 00000000 ____D () C:\Users\Sarge\Documents\4A Games
2014-05-20 19:42 - 2012-10-08 20:09 - 00000000 ____D () C:\Users\Sarge\AppData\Local\4A Games
2014-05-20 19:38 - 2014-05-20 19:38 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-05-20 19:38 - 2013-07-13 19:40 - 00296576 _____ () C:\Windows\DirectX.log
2014-05-20 19:38 - 2011-04-20 14:43 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-05-20 13:07 - 2011-04-20 19:08 - 00000000 ____D () C:\Users\Sarge\Desktop\Spiele
2014-05-16 17:28 - 2011-04-20 14:06 - 00000000 ___RD () C:\Users\Sarge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 17:28 - 2011-04-20 14:06 - 00000000 ___RD () C:\Users\Sarge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 17:26 - 2014-05-06 16:10 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-16 17:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-16 17:23 - 2013-08-14 21:27 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-16 17:21 - 2011-04-23 15:38 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 19:01 - 2011-04-20 19:19 - 00000000 ____D () C:\Users\Sarge\AppData\Local\Adobe
2014-05-14 19:00 - 2014-05-14 19:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-05-14 19:00 - 2014-05-14 18:59 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-05-14 19:00 - 2012-04-02 07:10 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 19:00 - 2011-05-19 16:34 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 18:59 - 2014-05-14 18:59 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-05-14 18:59 - 2014-05-14 18:59 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-05-14 18:59 - 2014-05-14 18:59 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-05-14 18:55 - 2013-10-26 10:56 - 00000000 ____D () C:\ProgramData\Oracle
2014-05-14 18:42 - 2014-05-14 18:42 - 00004224 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-05-14 18:42 - 2012-06-28 19:49 - 00000000 ____D () C:\Program Files (x86)\Java

Files to move or delete:
====================
C:\ProgramData\hash.dat


Some content of TEMP:
====================
C:\Users\Sarge\AppData\Local\Temp\aimemb.dll
C:\Users\Sarge\AppData\Local\Temp\aimemb64.dll
C:\Users\Sarge\AppData\Local\Temp\ammemb.dll
C:\Users\Sarge\AppData\Local\Temp\ammemb64.dll
C:\Users\Sarge\AppData\Local\Temp\avgnt.exe
C:\Users\Sarge\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-05-16 19:42

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---


Addition.txt
FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-06-2014 02
Ran by Sarge at 2014-06-13 16:31:01
Running from C:\Users\Sarge\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

@BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.08 - GIGABYTE)
Ace of Spades (HKLM-x32\...\Steam App 224540) (Version:  - Jagex Limited)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.6.0.19120 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.6 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.0.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.45.2 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alan Wake (HKLM-x32\...\Steam App 108710) (Version:  - Remedy Entertainment)
Alien Breed: Impact (HKLM-x32\...\Steam App 22610) (Version:  - Team17 Software Ltd. )
Alpha Prime (HKLM-x32\...\Steam App 2590) (Version:  - Black Element)
Amnesia: The Dark Descent (HKLM-x32\...\Steam App 57300) (Version:  - Frictional Games)
Anna - Extended Edition (HKLM-x32\...\Steam App 217690) (Version:  - Dreampainters)
Any Video Converter 3.3.2 (HKLM-x32\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.0.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.0 - EA Digital Illusions CE AB)
Belkin Connect Wireless USB Adapter (HKLM-x32\...\InstallShield_{08B73C99-D071-488F-8861-5DDA897C510D}) (Version: 1.0.0.3 - Belkin)
Belkin Connect Wireless USB Adapter (x32 Version: 1.0.0.3 - Belkin) Hidden
Belkin USB Wireless Adapter (HKLM-x32\...\InstallShield_{549CE1BD-88E4-4C5E-BF75-B155624714CC}) (Version: 1.0.0.12 - Belkin)
Belkin USB Wireless Adapter (x32 Version: 1.0.0.12 - Belkin) Hidden
Borderlands (HKLM-x32\...\{52B65911-1559-4ED5-9461-46957FDD48CD}) (Version: 1.0.295 - 2K Games)
Bridge Constructor (HKLM-x32\...\Steam App 250460) (Version:  - )
Bridge Project (HKLM-x32\...\Steam App 232950) (Version:  - Halycon Media GmbH & Co. KG)
Broken Sword 2 - the Smoking Mirror: Remastered (HKLM-x32\...\Steam App 33600) (Version:  - Revolution Software Ltd)
Brütal Legend (HKLM-x32\...\Steam App 225260) (Version:  - Double Fine Productions)
Carrier Command: Gaea Mission (HKLM-x32\...\Steam App 65740) (Version:  - Bohemia Interactive)
Cave Story+ (HKLM-x32\...\Steam App 200900) (Version:  - Nicalis)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Cities XL Platinum (HKLM-x32\...\Steam App 231140) (Version:  - Focus Home Interactive)
Command & Conquer The First Decade (HKLM-x32\...\{66D6F3BD-CA23-41A4-9FA3-96B26B32528C}) (Version: 1.00.0000 - Electronic Arts)
Command and Conquer: Red Alert 3 - Uprising (HKLM-x32\...\Steam App 24800) (Version:  - EA Los Angeles)
Company of Heroes (New Steam Version) (HKLM-x32\...\Steam App 228200) (Version:  - )
Confrontation (HKLM-x32\...\Steam App 204560) (Version:  - Cyanide Studios)
Crusader Kings II (HKLM-x32\...\Steam App 203770) (Version:  - Paradox Development Studio)
Cthulhu Saves the World  (HKLM-x32\...\Steam App 107310) (Version:  - Zeboyd Games)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0333 - Disc Soft Ltd)
DDBAC (HKLM-x32\...\{F9336255-6BBB-4B38-9F98-E85988BF99CA}) (Version: 4.3.75 - DataDesign)
Dead Island (HKLM-x32\...\Steam App 91310) (Version:  - Techland)
Dead Space (HKLM-x32\...\Steam App 17470) (Version:  - EA Redwood Shores)
Desktop Dungeons (HKLM-x32\...\Steam App 226620) (Version:  - QCF Design)
Diablo II (HKLM-x32\...\Diablo II) (Version:  - Blizzard Entertainment)
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.55.4 - Electronic Arts)
Die Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.5.1 - Electronic Arts)
Die Sims™ 3 Luxus-Accessoires (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.13.1 - Electronic Arts)
Doom 3 (HKLM-x32\...\InstallShield_{EEFB15EB-FE8B-47DF-A496-1C4D1420294A}) (Version: 1.00.0000 - Activision)
Doom 3 (x32 Version: 1.00.0000 - Activision) Hidden
Dual-Core Optimizer (HKLM-x32\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
Duke Nukem 3D: Megaton Edition (HKLM-x32\...\Steam App 225140) (Version:  - 3D Realms)
Dungeon Defenders (HKLM-x32\...\Steam App 65800) (Version:  - Trendy Entertainment)
Dungeon Defenders 7.48 (HKLM-x32\...\Dungeon Defenders 7.48) (Version: 7.48 - Trendy Entertainment)
Dungeon Keeper 2 (HKLM-x32\...\Dungeon Keeper II) (Version:  - )
Dustforce (HKLM-x32\...\Steam App 65300) (Version:  - Hitbox Team)
Earth 2160 (HKLM-x32\...\Earth 2160) (Version: 1.01 Eng - Zuxxez Entertainment AG)
EASEUS Partition Master 8.0.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version:  - EASEUS)
Easy Tune 6 B10.0516.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B10.0516.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Eets Munchies (HKLM-x32\...\Steam App 214550) (Version:  - )
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
Europa Universalis III (HKLM-x32\...\Steam App 25800) (Version:  - Paradox Development Studio)
F.E.A.R. (HKLM-x32\...\Steam App 21090) (Version:  - Monolith )
Fallout (HKLM-x32\...\Steam App 38400) (Version:  - Interplay Inc.)
FEZ (HKLM-x32\...\Steam App 224760) (Version:  - Polytron Corporation)
Free YouTube to MP3 Converter version 3.11.30.903 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.30.903 - DVDVideoSoft Ltd.)
Frozen Synapse (HKLM-x32\...\Steam App 98200) (Version:  - Mode 7)
FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version:  - Subset Games)
Galactic Civilizations I: Ultimate Edition (HKLM-x32\...\Steam App 214150) (Version:  - )
Galactic Civilizations II: Ultimate Edition (HKLM-x32\...\Steam App 202200) (Version:  - )
Game of Thrones  (HKLM-x32\...\Steam App 208730) (Version:  - Cyanide Studios)
GameSpy Comrade (HKLM-x32\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)
GeoGebra 4.4 (HKLM-x32\...\GeoGebra 4.4) (Version: 4.3.31.0 - International GeoGebra Institute)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
Happy Cloud Client (HKCU\...\HappyCloud) (Version: 4.28 - Happy Cloud, Inc.)
Hard Reset (HKLM-x32\...\Steam App 98400) (Version:  - Flying Wild Hog)
Hero Editor V1.04 (HKLM-x32\...\ST6UNST #1) (Version:  - )
Heroes & Generals (HKLM-x32\...\Heroes & Generals) (Version: 1.0.6.1 - Reto-Moto)
Inkscape 0.48.4 (HKLM-x32\...\Inkscape) (Version: 0.48.4 - )
Java 7 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417025FF}) (Version: 7.0.250 - Oracle)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle)
Java(TM) 6 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416025FF}) (Version: 6.0.250 - Oracle)
Java(TM) 6 Update 37 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216033FF}) (Version: 6.0.370 - Oracle)
Java(TM) SE Development Kit 6 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0160250}) (Version: 1.6.0.250 - Oracle)
Java(TM) SE Development Kit 6 Update 25 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0160250}) (Version: 1.6.0.250 - Oracle)
Jets'n'Guns GOLD 1.211 (HKLM-x32\...\Jets'n'Guns GOLD) (Version: 1.211 - Rake In Grass)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KeePass Password Safe 1.21 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.21 - Dominik Reichl)
Kingdom Rush (HKLM-x32\...\Steam App 246420) (Version:  - Ironhide Game Studio)
Knights of Pen and Paper +1 (HKLM-x32\...\Steam App 231740) (Version:  - Behold Studios)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
Leviathan: Warships (HKLM-x32\...\Steam App 202270) (Version:  - Pieces Interactive)
Lone Survivor: The Director's Cut (HKLM-x32\...\Steam App 209830) (Version:  - Jasper Byrne)
Magicka (HKLM-x32\...\Steam App 42910) (Version:  - Arrowhead Game Studios)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Medal of Honor(TM) Single Player (HKLM-x32\...\Steam App 47790) (Version:  - Electronic Arts)
Medieval II: Total War (HKLM-x32\...\Steam App 4700) (Version:  - The Creative Assembly)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Metal Slug 3 (HKLM-x32\...\Steam App 250180) (Version:  - DotEmu)
Metro 2033 (HKLM-x32\...\Steam App 43110) (Version:  - THQ)
Metro: Last Light (HKLM-x32\...\Steam App 43160) (Version:  - 4A Games)
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires (HKLM-x32\...\Age of Empires) (Version:  - )
Microsoft Age of Empires Expansion (HKLM-x32\...\Age of Empires Expansion 1.0) (Version:  - )
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )
Microsoft Application Compatibility Toolkit 5.6 (HKLM-x32\...\{0F5AEBB0-43F3-4571-ACE7-A7942E8AA179}) (Version: 5.6.7324.0 - Microsoft Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Might and Magic® VI (HKLM-x32\...\Might and Magic® VI) (Version:  - )
MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org)
Mount & Blade: Warband (HKLM-x32\...\Steam App 48700) (Version:  - Tale Worlds)
Mount & Blade: With Fire and Sword (HKLM-x32\...\Steam App 48720) (Version:  - TaleWorlds)
Mozilla Firefox 10.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 10.0.2 (x86 de)) (Version: 10.0.2 - Mozilla)
Mozilla Firefox 29.0.1 (x86 de) (HKCU\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Mutant Mudds Deluxe (HKLM-x32\...\Steam App 247370) (Version:  - Renegade Kid)
Neverwinter (HKLM-x32\...\Steam App 109600) (Version:  - Cryptic Studios)
Neverwinter Nights 2 (HKLM-x32\...\{F20C1251-1D0A-4944-B2AE-678581B33B19}) (Version: 1.00.0000 - Obsidian)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 5.9 - )
NVIDIA 3D Vision Controller-Treiber 301.42 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 301.42 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.16.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.16.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.108.688 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 311.06 (Version: 311.06 - NVIDIA Corporation) Hidden
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
Oil Rush version 1.35 (HKLM-x32\...\Oil Rush_is1) (Version: 1.35 - )
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Orcs Must Die! (HKLM-x32\...\Steam App 102600) (Version:  - Robot Entertainment)
Orcs Must Die! 2 (HKLM-x32\...\Steam App 201790) (Version:  - Robot Entertainment)
Organ Trail: Director's Cut (HKLM-x32\...\Steam App 233740) (Version:  - The Men Who Wear Many Hats)
Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)
PDF Blender (HKLM-x32\...\PDF Blender) (Version:  - )
PlanetSide 2 (HKLM-x32\...\Steam App 218230) (Version:  - Sony Online Entertainment)
Populous (HKLM-x32\...\{476CD9DE-C45F-4443-BFA7-E51C58B7E455}) (Version: 1.0.0.0 - Electronic Arts)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Puzzle Agent 2 (HKLM-x32\...\Steam App 94590) (Version:  - Telltale Games)
Puzzle Bots (HKLM-x32\...\Steam App 80300) (Version:  - Lively Ivy)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.18.322.2010 - Realtek)
Reus (HKLM-x32\...\Steam App 222730) (Version:  - Abbey Games)
Rock of Ages (HKLM-x32\...\Steam App 22230) (Version:  - ACE Team)
S.T.A.L.K.E.R. - Shadow of Chernobyl (HKLM-x32\...\S.T.A.L.K.E.R. - Shadow of Chernobyl_is1) (Version: 1.0000 - THQ)
SAMSUNG Intelli-studio (HKLM-x32\...\Intelli-studio) (Version:  - )
Samsung RAW Converter 4 (HKLM-x32\...\InstallShield_{D09E159D-0264-4597-B200-A9B4C0866F25}) (Version: 4 - Ichikawa Soft Laboratory)
Samsung RAW Converter 4 (x32 Version: 4 - Ichikawa Soft Laboratory) Hidden
Sanctum 2 (HKLM-x32\...\Steam App 210770) (Version:  - Coffee Stain Studios)
Savant - Ascent (HKLM-x32\...\Steam App 259530) (Version:  - DPad Studios)
Serious Sam 2 (HKLM-x32\...\Steam App 204340) (Version:  - Croteam)
Serious Sam 3: BFE (HKLM-x32\...\Steam App 41070) (Version:  - Croteam)
Serious Sam HD: The Second Encounter (HKLM-x32\...\Steam App 41010) (Version:  - Croteam)
Sid Meier's Civilization 4 Complete (HKLM-x32\...\{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}) (Version: 1.74 - Firaxis Games)
Sid Meier's Civilization IV Colonization (HKLM-x32\...\{EF36A836-BF89-4A4F-B079-057B0C68C1E0}) (Version: 1.00 - Firaxis Games)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Sine Mora (HKLM-x32\...\Steam App 207040) (Version:  - Digital Reality)
SkyDrift (HKLM-x32\...\Steam App 91100) (Version:  - Digital Reality)
Spacebase DF-9 Prototype (HKLM-x32\...\Steam App 228020) (Version:  - )
Stealth Bastard Deluxe (HKLM-x32\...\Steam App 209190) (Version:  - Curve Studios)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Switch Audiodatei-Konverter (HKLM-x32\...\Switch) (Version:  - NCH Software)
Syder Arcade (HKLM-x32\...\Steam App 252310) (Version:  - Studio Evil)
System Requirements Lab CYRI (HKLM-x32\...\{1F77C418-2C90-459C-BD33-B56A4182B9FA}) (Version: 4.4.26.0 - Husdawg, LLC)
System Shock 2 (HKLM-x32\...\Steam App 238210) (Version:  - Irrational Games)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version:  - TeamSpeak Systems GmbH)
Teslagrad (HKLM-x32\...\Steam App 249590) (Version:  - Rain Games)
Texmaker (HKLM-x32\...\Texmaker) (Version:  - )
The Bard's Tale (HKLM-x32\...\Steam App 41900) (Version:  - inXile Entertainment)
The Shivah (HKLM-x32\...\Steam App 252370) (Version:  - )
The Walking Dead (HKLM-x32\...\Steam App 207610) (Version:  - )
Titan Quest (HKLM-x32\...\Steam App 4540) (Version:  - IronLore)
Type:Rider (HKLM-x32\...\Steam App 258890) (Version:  - Ex Nihilo)
UE3Redist (HKCU\...\InstallShield_{6530FDAA-5B1F-4830-95BB-650E9804D239}) (Version: 1.00.0000 - Epic Games)
UE3Redist (x32 Version: 1.00.0000 - Epic Games) Hidden
UFO: Afterlight (HKLM-x32\...\Steam App 237950) (Version:  - Altar Games)
VLC media player 2.0.1 (HKLM-x32\...\VLC media player) (Version: 2.0.1 - VideoLAN)
VVVVVV (HKLM-x32\...\Steam App 70300) (Version:  - Terry Cavanagh)
War of the Roses (HKLM-x32\...\Steam App 42160) (Version:  - Fatshark)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
Wargame: European Escalation (HKLM-x32\...\Steam App 58610) (Version:  - Eugen Systems)
Warhammer 40,000: Dawn of War - Game of the Year Edition (HKLM-x32\...\Steam App 4570) (Version:  - Relic Entertainment)
Warlock - Master of the Arcane (HKLM-x32\...\Steam App 203630) (Version:  - Ino-Co Plus)
Winamp (HKLM-x32\...\Winamp) (Version: 5.61  - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
Wise Disk Cleaner 6.31 (HKLM-x32\...\Wise Disk Cleaner_is1) (Version:  - WiseCleaner.com, Inc.)
World of Tanks v.0.6.3.11 (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version:  - Wargaming.net)
Worms Blast (HKLM-x32\...\Steam App 70650) (Version:  - Team17 Software Ltd.)
X3: Terran Conflict (HKLM-x32\...\Steam App 2820) (Version:  - Egosoft)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {39468EAE-CA72-4AB4-8159-196246E80B10} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {3EBE4BE1-5ED4-46A7-9868-6EE93E09ECA8} - System32\Tasks\{6C950DAB-481A-424C-BCE1-D59D04E7BC1D} => C:\Users\Sarge\Desktop\sim city 2000\INSTALL.EXE
Task: {697D279F-F62A-41AB-9BD2-E8DC92C34B34} - System32\Tasks\{F4073565-9514-45AA-95D1-901AE959D150} => C:\Users\Sarge\Desktop\sim city 2000\INSTALL.EXE
Task: {6DAEA846-E793-4678-BB71-EF4459BC23D8} - System32\Tasks\avast! Emergency Update => D:\Programme\AVAST Software\Avast\AvastEmUpdate.exe [2014-06-11] (AVAST Software)
Task: {70186BE2-28B5-4FE1-81D7-A576F6F34D5F} - System32\Tasks\Launch HTC Sync Loader => D:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {764EA06A-A3FD-42BC-88C7-877FB06C33A1} - System32\Tasks\{A5570C4A-4C9A-47A5-81DC-3FB86325D90A} => D:\Spiele\WARCRAFT\WAR.EXE [2011-06-28] ()
Task: {9AC2667E-19C0-4402-8FC2-D84626EE3E2B} - System32\Tasks\NCH Software\SwitchReminder => C:\Program Files (x86)\NCH Software\Switch\Switch.exe [2012-09-27] (NCH Software)
Task: {AFF7B1E8-FEBF-425C-A0BB-510476407717} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
Task: {B9033BD7-97DD-4291-881E-23D79308DFE1} - System32\Tasks\{6EE72DC7-A070-4BAB-B186-0D6E51561221} => D:\Spiele\WARCRAFT\WAR.EXE [2011-06-28] ()
Task: {BC548202-A8E6-4AC5-B088-0C48470D1904} - System32\Tasks\{73E6A5A4-CA1A-477D-B047-D528D31AE7D5} => D:\Spiele\WARCRAFT\WAR.EXE [2011-06-28] ()
Task: {C633A347-0297-484C-A4B3-288D15200D9B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

==================== Loaded Modules (whitelisted) =============

2012-01-19 21:42 - 2013-01-18 17:00 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-01-19 19:39 - 2012-01-20 21:22 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-06-11 20:49 - 2014-06-11 20:49 - 19336120 _____ () D:\Programme\AVAST Software\Avast\libcef.dll
2014-05-14 18:40 - 2014-05-14 18:40 - 03839088 _____ () D:\Programme\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: ehRecvr => 3
MSCONFIG\Services: ehSched => 3
MSCONFIG\Services: Fax => 3
MSCONFIG\Services: TapiSrv => 3
MSCONFIG\Services: WerSvc => 3
MSCONFIG\Services: WMPNetworkSvc => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "D:\Programme\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: Comrade.exe => C:\Program Files (x86)\GameSpy\Comrade\Comrade.exe
MSCONFIG\startupreg: DataCardMonitor => D:\Programme\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe
MSCONFIG\startupreg: EA Core => "D:\Programme\Electronic Arts\EADM\Core.exe" -silent
MSCONFIG\startupreg: EADM => "D:\Programme\Electronic Arts\EADM\EADMUI\EADMUI.exe"
MSCONFIG\startupreg: HTC Sync Loader => "D:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup
MSCONFIG\startupreg: HW_OPENEYE_OUC_T-Mobile Internet Manager => "D:\Programme\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Steam => "D:\Programme\Steam\Steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: WinampAgent => D:\Programme\Winamp\winampa.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/25/2014 04:54:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: UIAnimation.dll, Version: 6.2.9200.16492, Zeitstempel: 0x50f309ee
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000000424d
ID des fehlerhaften Prozesses: 0x6b8
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (04/29/2014 03:56:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.1.3133, Zeitstempel: 0x4d88ec8b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038e19
ID des fehlerhaften Prozesses: 0x1310
Startzeit der fehlerhaften Anwendung: 0xwinamp.exe0
Pfad der fehlerhaften Anwendung: winamp.exe1
Pfad des fehlerhaften Moduls: winamp.exe2
Berichtskennung: winamp.exe3

Error: (04/29/2014 03:55:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.1.3133, Zeitstempel: 0x4d88ec8b
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038e19
ID des fehlerhaften Prozesses: 0x11b0
Startzeit der fehlerhaften Anwendung: 0xwinamp.exe0
Pfad der fehlerhaften Anwendung: winamp.exe1
Pfad des fehlerhaften Moduls: winamp.exe2
Berichtskennung: winamp.exe3

Error: (04/22/2014 06:04:05 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Error: Failed to poke open firewall

Error: (04/21/2014 08:30:51 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Error: Failed to poke open firewall

Error: (04/16/2014 06:45:29 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Error: Failed to poke open firewall

Error: (04/15/2014 05:14:23 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Error: Failed to poke open firewall

Error: (04/14/2014 06:27:09 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Error: Failed to poke open firewall

Error: (04/13/2014 09:41:50 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Error: Failed to poke open firewall

Error: (04/06/2014 02:51:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Kingdom Rush.exe, Version: 4.3.3.30826, Zeitstempel: 0x52cd4305
Name des fehlerhaften Moduls: Kingdom Rush.exe, Version: 4.3.3.30826, Zeitstempel: 0x52cd4305
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00409aa7
ID des fehlerhaften Prozesses: 0xb98
Startzeit der fehlerhaften Anwendung: 0xKingdom Rush.exe0
Pfad der fehlerhaften Anwendung: Kingdom Rush.exe1
Pfad des fehlerhaften Moduls: Kingdom Rush.exe2
Berichtskennung: Kingdom Rush.exe3


System errors:
=============
Error: (06/13/2014 04:28:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avast! Antivirus" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%5

Error: (06/13/2014 04:27:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (06/13/2014 04:27:37 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/13/2014 04:25:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avast! Antivirus" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%5

Error: (06/11/2014 08:50:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avast! Antivirus" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%5

Error: (06/11/2014 08:49:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avast! Antivirus" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%5

Error: (06/11/2014 08:49:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (06/11/2014 08:49:27 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/11/2014 08:45:31 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
AFD
aswRdr
aswRvrt
aswSnx
aswSP
aswVmm
CSC
DfsC
discache
NetBIOS
NetBT
nsiproxy
Psched
rdbss
spldr
sptd
tdx
vwififlt
Wanarpv6
WfpLwf

Error: (06/11/2014 08:45:31 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (05/25/2014 04:54:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4UIAnimation.dll6.2.9200.1649250f309eec0000005000000000000424d6b801cf7827c5115af8C:\Windows\Explorer.EXEC:\Windows\System32\UIAnimation.dll6e001d2a-e41c-11e3-af6d-1c6f6584f010

Error: (04/29/2014 03:56:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: winamp.exe5.6.1.31334d88ec8bntdll.dll6.1.7601.18247521ea8e7c000000500038e19131001cf63b2d5cdb4d1D:\Programme\Winamp\winamp.exeC:\Windows\SysWOW64\ntdll.dll16c2f6f9-cfa6-11e3-9040-1c6f6584f010

Error: (04/29/2014 03:55:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: winamp.exe5.6.1.31334d88ec8bntdll.dll6.1.7601.18247521ea8e7c000000500038e1911b001cf63b2b3b57c24D:\Programme\Winamp\winamp.exeC:\Windows\SysWOW64\ntdll.dllfa6e0c26-cfa5-11e3-9040-1c6f6584f010

Error: (04/22/2014 06:04:05 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Failed to poke open firewall

Error: (04/21/2014 08:30:51 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Failed to poke open firewall

Error: (04/16/2014 06:45:29 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Failed to poke open firewall

Error: (04/15/2014 05:14:23 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Failed to poke open firewall

Error: (04/14/2014 06:27:09 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Failed to poke open firewall

Error: (04/13/2014 09:41:50 PM) (Source: Steam Client Service) (EventID: 1) (User: )
Description: Failed to poke open firewall

Error: (04/06/2014 02:51:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Kingdom Rush.exe4.3.3.3082652cd4305Kingdom Rush.exe4.3.3.3082652cd4305c000000500409aa7b9801cf51816f072450D:\Programme\Steam\steamapps\common\Kingdom Rush\Kingdom Rush.exeD:\Programme\Steam\steamapps\common\Kingdom Rush\Kingdom Rush.exe35888fc3-bd8a-11e3-8abb-1c6f6584f010


CodeIntegrity Errors:
===================================
  Date: 2013-05-24 17:39:03.198
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-24 17:39:03.104
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-23 18:03:22.964
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-23 18:03:22.870
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-20 12:38:50.104
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-20 12:38:50.011
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-18 10:21:26.995
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-18 10:21:26.902
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-17 16:58:18.385
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-05-17 16:58:18.292
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\fses.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 4093.55 MB
Available physical RAM: 2008.88 MB
Total Pagefile: 8185.29 MB
Available Pagefile: 6087.91 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:50.55 GB) (Free:9.16 GB) NTFS
Drive d: (Stuff) (Fixed) (Total:880.86 GB) (Free:199.59 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: B5581F9D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=51 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=881 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---

Ja, der Service von AVAST läuft tatsächlich nicht.


Funktioniert Avast nach diesem Fix?
Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

C:\Windows\system32\Drivers\aswsnx.sys.1402512569269
C:\Windows\system32\Drivers\aswsp.sys.1402512569269
C:\Windows\system32\Drivers\aswstm.sys.1402510754505
C:\Windows\system32\Drivers\aswsnx.sys.1402510754505
C:\Windows\system32\Drivers\aswsp.sys.1402510754505
C:\Windows\system32\Drivers\aswsnx.sys.1402508002897
C:\Windows\system32\Drivers\aswsp.sys.1402508002897
cmd: sc start "avast! Antivirus"
reboot:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Zitat von Bootsektor

Funktioniert Avast nach diesem Fix?

Leider nein

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-06-2014 02
Ran by Sarge at 2014-06-15 11:04:36 Run:1
Running from C:\Users\Sarge\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Windows\system32\Drivers\aswsnx.sys.1402512569269
C:\Windows\system32\Drivers\aswsp.sys.1402512569269
C:\Windows\system32\Drivers\aswstm.sys.1402510754505
C:\Windows\system32\Drivers\aswsnx.sys.1402510754505
C:\Windows\system32\Drivers\aswsp.sys.1402510754505
C:\Windows\system32\Drivers\aswsnx.sys.1402508002897
C:\Windows\system32\Drivers\aswsp.sys.1402508002897
cmd: sc start "avast! Antivirus"
reboot:
*****************

Could not move "C:\Windows\system32\Drivers\aswsnx.sys.1402512569269" => Scheduled to move on reboot.
Could not move "C:\Windows\system32\Drivers\aswsp.sys.1402512569269" => Scheduled to move on reboot.
Could not move "C:\Windows\system32\Drivers\aswstm.sys.1402510754505" => Scheduled to move on reboot.
Could not move "C:\Windows\system32\Drivers\aswsnx.sys.1402510754505" => Scheduled to move on reboot.
Could not move "C:\Windows\system32\Drivers\aswsp.sys.1402510754505" => Scheduled to move on reboot.
Could not move "C:\Windows\system32\Drivers\aswsnx.sys.1402508002897" => Scheduled to move on reboot.
Could not move "C:\Windows\system32\Drivers\aswsp.sys.1402508002897" => Scheduled to move on reboot.

=========  sc start "avast! Antivirus" =========

[SC] StartService FEHLER 5:

Zugriff verweigert


========= End of CMD: =========


=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-06-15 11:06:34)<=

"C:\Windows\system32\Drivers\aswsnx.sys.1402512569269" => File could not move.
"C:\Windows\system32\Drivers\aswsp.sys.1402512569269" => File could not move.
"C:\Windows\system32\Drivers\aswstm.sys.1402510754505" => File could not move.
"C:\Windows\system32\Drivers\aswsnx.sys.1402510754505" => File could not move.
"C:\Windows\system32\Drivers\aswsp.sys.1402510754505" => File could not move.
"C:\Windows\system32\Drivers\aswsnx.sys.1402508002897" => File could not move.
"C:\Windows\system32\Drivers\aswsp.sys.1402508002897" => File could not move.

==== End of Fixlog ====
         

Das hat auch nicht funktioniert.

Dann bitte jetzt einmal Combofix

Schritt 1
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

und ein neues FRST-log
Schritt 2
Starte noch einmal FRST.

• Ändere keine der Voreinstellungen und drücke auf Scan.
• Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
• Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

ComboFix 14-06-16.01 - Sarge 16.06.2014  18:30:09.1.6 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4094.2908 [GMT 2:00]
ausgeführt von:: c:\users\Sarge\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\security\Database\tmp.edb
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-16 bis 2014-06-16  ))))))))))))))))))))))))))))))
.
.
2014-06-16 16:45 . 2014-06-16 16:45	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-06-16 16:45 . 2014-06-16 16:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-13 14:31 . 2014-04-30 23:20	10702536	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{A6294C11-4852-4F58-88DF-252F21222A3D}\mpengine.dll
2014-06-13 14:28 . 2014-06-15 09:06	--------	d-----w-	C:\FRST
2014-06-11 18:49 . 2014-06-11 18:49	85328	----a-w-	c:\windows\system32\drivers\aswstm.sys
2014-06-11 18:49 . 2014-06-11 18:49	1039096	----a-w-	c:\windows\system32\drivers\aswsnx.sys
2014-06-11 18:49 . 2014-06-11 18:49	208416	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-06-11 18:49 . 2014-06-11 18:49	423240	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-06-11 18:49 . 2014-06-11 18:49	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-06-11 18:49 . 2014-06-11 18:49	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-06-11 18:49 . 2014-06-11 18:49	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-06-11 18:49 . 2014-06-11 18:49	334648	----a-w-	c:\windows\system32\aswBoot.exe
2014-06-11 18:49 . 2014-06-11 18:49	43152	----a-w-	c:\windows\avastSS.scr
2014-06-11 18:48 . 2014-06-11 18:48	--------	d-----w-	c:\programdata\AVAST Software
2014-06-11 18:20 . 2014-06-11 18:50	--------	d-----w-	c:\users\Sarge\AppData\Roaming\AVAST Software
2014-06-11 18:18 . 2014-06-11 18:49	29208	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-06-11 17:44 . 2014-06-11 19:13	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-11 17:44 . 2014-06-11 17:44	--------	d-----w-	c:\programdata\Malwarebytes
2014-06-11 17:44 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-06-11 17:44 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-06-11 17:44 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-05-25 14:53 . 2014-06-10 15:40	--------	d-----w-	c:\users\Sarge\AppData\Local\ftblauncher
2014-05-20 17:38 . 2014-05-20 17:38	--------	d-----w-	c:\program files (x86)\AGEIA Technologies
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-13 14:52 . 2011-04-23 13:38	95414520	----a-w-	c:\windows\system32\MRT.exe
2014-05-14 17:00 . 2012-04-02 05:10	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-14 17:00 . 2011-05-19 14:34	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-09 06:14 . 2014-05-14 16:43	477184	----a-w-	c:\windows\system32\aepdu.dll
2014-05-09 06:11 . 2014-05-14 16:43	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-04-14 18:13 . 2014-05-14 16:42	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-12 02:22 . 2014-05-14 16:43	95680	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:22 . 2014-05-14 16:43	155072	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:19 . 2014-05-14 16:43	136192	----a-w-	c:\windows\system32\sspicli.dll
2014-04-12 02:19 . 2014-05-14 16:43	29184	----a-w-	c:\windows\system32\sspisrv.dll
2014-04-12 02:19 . 2014-05-14 16:43	28160	----a-w-	c:\windows\system32\secur32.dll
2014-04-12 02:19 . 2014-05-14 16:43	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-04-12 02:19 . 2014-05-14 16:43	31232	----a-w-	c:\windows\system32\lsass.exe
2014-04-12 02:12 . 2014-05-14 16:43	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-04-12 02:10 . 2014-05-14 16:43	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-03-31 07:35 . 2011-04-20 13:12	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-03-25 02:43 . 2014-05-14 16:43	14175744	----a-w-	c:\windows\system32\shell32.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AvastUI.exe"="d:\programme\AVAST Software\Avast\AvastUI.exe" [2014-06-11 3890208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys;c:\windows\etdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-06-11 18:49	290888	----a-w-	d:\programme\AVAST Software\Avast\ashShA64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to MP3 Converter - c:\users\Sarge\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{ff88a983-649d-4207-9336-9b999280b436} - (no file)
URLSearchHooks-{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{FF88A983-649D-4207-9336-9B999280B436} - (no file)
AddRemove-Dungeon Keeper II - c:\windows\IsUn0407.exe
AddRemove-Might and Magic® VI - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce,
   9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-1610289843-898006340-3999519046-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1610289843-898006340-3999519046-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-1610289843-898006340-3999519046-1000\Software\SecuROM\License information*]
"datasecu"=hex:35,b7,b4,56,9e,3e,7c,aa,db,36,83,27,5e,72,5c,82,6e,66,f7,01,f3,
   74,e4,01,01,59,a4,3b,44,93,40,dd,f3,4b,b0,b2,e5,dd,8d,23,2c,cb,0f,ca,02,ab,\
"rkeysecu"=hex:e5,fd,ff,8b,df,e9,e9,fe,31,2f,a4,68,66,7c,36,85
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-16  18:47:30
ComboFix-quarantined-files.txt  2014-06-16 16:47
.
Vor Suchlauf: 9.594.585.088 Bytes frei
Nach Suchlauf: 9.538.904.064 Bytes frei
.
- - End Of File - - AAE74C19B8F91F387284425A79D91ED2
         

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

[/CODE]



FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-06-2014
Ran by Sarge (administrator) on SARGE-PC on 16-06-2014 18:58:53
Running from C:\Users\Sarge\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) D:\Programme\AVAST Software\Avast\AvastUI.exe
(Don HO don.h@free.fr) D:\Programme\Notepad++\notepad++.exe
(Mozilla Corporation) D:\Programme\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => D:\Programme\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-11] (AVAST Software)
HKU\S-1-5-21-1610289843-898006340-3999519046-1000\...\Run: [DAEMON Tools Lite] => D:\Programme\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEC2FEE5B58FFCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKLM-x32 - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848&SSPV=IESB04
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @live.heroesandgenerals.com/npretox - D:\Spiele\Heroes & Generals\live\npretox-1.0.6.1\npretoxlive-1.0.6.1.dll (Reto-Moto ApS)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll No File
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF SearchPlugin: C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\searchplugins\dvdvideosofttb-de-customized-web-search.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\ich@maltegoetz.de [2013-12-13]
FF Extension: DDBAC Plug-In - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\{271A3CF5-5A54-447B-A08F-BE805F0DA60A} [2012-06-28]
FF Extension: Classic Theme Restorer - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-14]
FF Extension: Adblock Plus - C:\Users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-04-27]
FF Extension: avast! Online Security - D:\Programme\AVAST Software\Avast\WebRep\FF [2014-06-11]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - D:\Programme\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - D:\Programme\AVAST Software\Avast\WebRep\FF [2014-06-11]
FF StartMenuInternet: FIREFOX.EXE - D:\Programme\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) =================

S2 avast! Antivirus; D:\Programme\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-11] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2012-01-20] ()

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-11] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-11] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-11] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-11] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-11] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-11] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-11] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-11] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-06-26] (DT Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-03-24] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-03-24] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-03-24] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-03-24] () [File not signed]
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-01-19] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [530488 2011-12-08] () [File not signed]
U3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-16 18:58 - 2014-06-16 18:58 - 00000000 ____D () C:\Users\Sarge\Desktop\FRST-OlderVersion
2014-06-16 18:47 - 2014-06-16 18:47 - 00014990 _____ () C:\ComboFix.txt
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\temp
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-16 18:28 - 2014-06-16 18:47 - 00000000 ____D () C:\Qoobox
2014-06-16 18:28 - 2014-06-16 18:46 - 00000000 ____D () C:\Windows\erdnt
2014-06-16 18:28 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-16 18:28 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-16 18:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-16 18:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-16 18:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-16 18:28 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-16 18:28 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-16 18:28 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-16 18:26 - 2014-06-16 18:27 - 05206841 ____R (Swearware) C:\Users\Sarge\Desktop\ComboFix.exe
2014-06-13 16:33 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-13 16:33 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-13 16:33 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-13 16:33 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-13 16:33 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-13 16:33 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-13 16:33 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-13 16:33 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-13 16:33 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-13 16:33 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-13 16:33 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-13 16:33 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-13 16:33 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-13 16:33 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-13 16:33 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-13 16:33 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-13 16:33 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-13 16:33 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-13 16:33 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-13 16:33 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-13 16:33 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-13 16:33 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-13 16:33 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-13 16:33 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-13 16:33 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-13 16:33 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-13 16:33 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-13 16:33 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-13 16:33 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-13 16:33 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-13 16:33 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-13 16:33 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-13 16:33 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-13 16:33 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-13 16:33 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-13 16:33 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-13 16:33 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-13 16:33 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-13 16:33 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-13 16:33 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-13 16:33 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-13 16:33 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-13 16:33 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-13 16:33 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-13 16:33 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-13 16:33 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-13 16:33 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-13 16:33 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-13 16:33 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-13 16:33 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-13 16:33 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-13 16:33 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-13 16:33 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-13 16:33 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-13 16:33 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-13 16:33 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-13 16:33 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-13 16:33 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-13 16:33 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-13 16:33 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-13 16:33 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-13 16:33 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-13 16:33 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-13 16:33 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-13 16:31 - 2014-06-13 16:31 - 00043785 _____ () C:\Users\Sarge\Desktop\Addition.txt
2014-06-13 16:29 - 2014-06-16 18:58 - 00011365 _____ () C:\Users\Sarge\Desktop\FRST.txt
2014-06-13 16:28 - 2014-06-16 18:58 - 00000000 ____D () C:\FRST
2014-06-13 16:27 - 2014-06-16 18:58 - 02081280 _____ (Farbar) C:\Users\Sarge\Desktop\FRST64.exe
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-11 20:49 - 2014-06-11 20:49 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-11 20:49 - 2014-06-11 20:49 - 00001003 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-11 20:49 - 2014-06-11 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-11 20:48 - 2014-06-11 20:48 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-11 20:46 - 2014-06-11 20:46 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-06-11 20:20 - 2014-06-11 20:50 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\AVAST Software
2014-06-11 20:19 - 2014-06-11 20:49 - 00003916 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-11 20:19 - 2014-06-11 20:18 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:49 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-11 20:18 - 2014-06-11 20:18 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:18 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402510754505
2014-06-11 19:44 - 2014-06-11 21:13 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-11 19:44 - 2014-06-11 19:44 - 00000736 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-11 19:44 - 2014-06-11 19:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-11 19:44 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-11 19:44 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-11 19:44 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-11 19:33 - 2014-06-11 19:33 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402508002897
2014-06-11 19:33 - 2014-06-11 19:33 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402508002897
2014-06-11 16:08 - 2014-06-11 16:08 - 00257593 _____ () C:\Users\Sarge\Desktop\Berlin_noch nicht fertig.wlmp
2014-06-11 14:41 - 2014-06-11 14:41 - 00000000 ____D () C:\Users\Sarge\AppData\Local\{D6375859-3411-447B-9557-38DA65199AD6}
2014-06-11 14:33 - 2014-06-11 14:33 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2014-05-25 16:53 - 2014-06-10 17:40 - 00000000 ____D () C:\Users\Sarge\AppData\Local\ftblauncher
2014-05-20 19:38 - 2014-05-20 19:38 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies

==================== One Month Modified Files and Folders =======

2014-06-16 18:59 - 2014-06-13 16:29 - 00011365 _____ () C:\Users\Sarge\Desktop\FRST.txt
2014-06-16 18:59 - 2011-04-20 14:06 - 00000000 ____D () C:\Users\Sarge\AppData\Local\Temp
2014-06-16 18:58 - 2014-06-16 18:58 - 00000000 ____D () C:\Users\Sarge\Desktop\FRST-OlderVersion
2014-06-16 18:58 - 2014-06-13 16:28 - 00000000 ____D () C:\FRST
2014-06-16 18:58 - 2014-06-13 16:27 - 02081280 _____ (Farbar) C:\Users\Sarge\Desktop\FRST64.exe
2014-06-16 18:47 - 2014-06-16 18:47 - 00014990 _____ () C:\ComboFix.txt
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\temp
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\Public\AppData\Local\temp
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\Default\AppData\Local\temp
2014-06-16 18:47 - 2014-06-16 18:47 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp
2014-06-16 18:47 - 2014-06-16 18:28 - 00000000 ____D () C:\Qoobox
2014-06-16 18:47 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-06-16 18:46 - 2014-06-16 18:28 - 00000000 ____D () C:\Windows\erdnt
2014-06-16 18:46 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-06-16 18:27 - 2014-06-16 18:26 - 05206841 ____R (Swearware) C:\Users\Sarge\Desktop\ComboFix.exe
2014-06-16 18:16 - 2009-07-14 06:45 - 00014944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-16 18:16 - 2009-07-14 06:45 - 00014944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-16 18:14 - 2009-07-14 19:58 - 00714062 _____ () C:\Windows\system32\perfh007.dat
2014-06-16 18:14 - 2009-07-14 19:58 - 00156778 _____ () C:\Windows\system32\perfc007.dat
2014-06-16 18:14 - 2009-07-14 07:13 - 01662854 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-16 18:12 - 2013-03-25 20:12 - 01659123 _____ () C:\Windows\WindowsUpdate.log
2014-06-16 18:08 - 2013-03-25 20:10 - 00034106 _____ () C:\Windows\setupact.log
2014-06-16 18:08 - 2011-04-20 14:43 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-06-16 18:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-13 16:53 - 2013-08-14 21:27 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-13 16:52 - 2011-04-23 15:38 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-13 16:31 - 2014-06-13 16:31 - 00043785 _____ () C:\Users\Sarge\Desktop\Addition.txt
2014-06-13 16:25 - 2013-03-25 20:10 - 00913884 _____ () C:\Windows\PFRO.log
2014-06-11 21:13 - 2014-06-11 19:44 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-11 20:50 - 2014-06-11 20:20 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\AVAST Software
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402512569269
2014-06-11 20:49 - 2014-06-11 20:49 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-06-11 20:49 - 2014-06-11 20:49 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-06-11 20:49 - 2014-06-11 20:49 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-06-11 20:49 - 2014-06-11 20:49 - 00001003 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-06-11 20:49 - 2014-06-11 20:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-06-11 20:49 - 2014-06-11 20:19 - 00003916 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-11 20:49 - 2014-06-11 20:18 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-06-11 20:48 - 2014-06-11 20:48 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-06-11 20:46 - 2014-06-11 20:46 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-06-11 20:18 - 2014-06-11 20:19 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:18 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402510754505
2014-06-11 20:18 - 2014-06-11 20:18 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402510754505
2014-06-11 19:44 - 2014-06-11 19:44 - 00000736 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-11 19:44 - 2014-06-11 19:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-11 19:33 - 2014-06-11 19:33 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1402508002897
2014-06-11 19:33 - 2014-06-11 19:33 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1402508002897
2014-06-11 19:11 - 2011-11-11 15:31 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\PapDesigner
2014-06-11 19:02 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-11 16:08 - 2014-06-11 16:08 - 00257593 _____ () C:\Users\Sarge\Desktop\Berlin_noch nicht fertig.wlmp
2014-06-11 14:41 - 2014-06-11 14:41 - 00000000 ____D () C:\Users\Sarge\AppData\Local\{D6375859-3411-447B-9557-38DA65199AD6}
2014-06-11 14:41 - 2012-01-03 17:20 - 00000000 ____D () C:\Users\Sarge\AppData\Local\Windows Live
2014-06-11 14:39 - 2012-10-24 15:32 - 00000000 ____D () C:\ProgramData\HappyCloud
2014-06-11 14:33 - 2014-06-11 14:33 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
2014-06-10 17:40 - 2014-05-25 16:53 - 00000000 ____D () C:\Users\Sarge\AppData\Local\ftblauncher
2014-05-30 12:21 - 2014-06-13 16:33 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 12:02 - 2014-06-13 16:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 12:02 - 2014-06-13 16:33 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 11:45 - 2014-06-13 16:33 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 11:39 - 2014-06-13 16:33 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 11:39 - 2014-06-13 16:33 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 11:38 - 2014-06-13 16:33 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 11:28 - 2014-06-13 16:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 11:27 - 2014-06-13 16:33 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 11:24 - 2014-06-13 16:33 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 11:21 - 2014-06-13 16:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 11:21 - 2014-06-13 16:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 11:20 - 2014-06-13 16:33 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 11:18 - 2014-06-13 16:33 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-30 11:11 - 2014-06-13 16:33 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 11:08 - 2014-06-13 16:33 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 11:06 - 2014-06-13 16:33 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 11:02 - 2014-06-13 16:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-30 10:55 - 2014-06-13 16:33 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:49 - 2014-06-13 16:33 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:46 - 2014-06-13 16:33 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:44 - 2014-06-13 16:33 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-30 10:44 - 2014-06-13 16:33 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 10:43 - 2014-06-13 16:33 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-30 10:42 - 2014-06-13 16:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-13 16:33 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-30 10:35 - 2014-06-13 16:33 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 10:34 - 2014-06-13 16:33 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-30 10:33 - 2014-06-13 16:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-30 10:30 - 2014-06-13 16:33 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-30 10:29 - 2014-06-13 16:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 10:28 - 2014-06-13 16:33 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-30 10:27 - 2014-06-13 16:33 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-30 10:24 - 2014-06-13 16:33 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 10:23 - 2014-06-13 16:33 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 10:16 - 2014-06-13 16:33 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-30 10:10 - 2014-06-13 16:33 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-13 16:33 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-30 10:04 - 2014-06-13 16:33 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-30 10:02 - 2014-06-13 16:33 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-30 09:56 - 2014-06-13 16:33 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-30 09:56 - 2014-06-13 16:33 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:54 - 2014-06-13 16:33 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-30 09:50 - 2014-06-13 16:33 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-13 16:33 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-30 09:43 - 2014-06-13 16:33 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:40 - 2014-06-13 16:33 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-30 09:30 - 2014-06-13 16:33 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:21 - 2014-06-13 16:33 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-30 09:15 - 2014-06-13 16:33 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-30 09:13 - 2014-06-13 16:33 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 09:13 - 2014-06-13 16:33 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-25 16:54 - 2014-05-05 17:19 - 00000000 ____D () C:\Users\Sarge\AppData\Roaming\ftblauncher
2014-05-23 15:09 - 2011-07-19 11:58 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-22 14:46 - 2012-12-28 21:04 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-05-20 19:51 - 2012-10-08 20:12 - 00000000 ____D () C:\Users\Sarge\Documents\4A Games
2014-05-20 19:42 - 2012-10-08 20:09 - 00000000 ____D () C:\Users\Sarge\AppData\Local\4A Games
2014-05-20 19:38 - 2014-05-20 19:38 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-05-20 19:38 - 2013-07-13 19:40 - 00296576 _____ () C:\Windows\DirectX.log
2014-05-20 19:38 - 2011-04-20 14:43 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-05-20 13:07 - 2011-04-20 19:08 - 00000000 ____D () C:\Users\Sarge\Desktop\Spiele

Files to move or delete:
====================
C:\ProgramData\hash.dat


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-05-16 19:42

==================== End Of Log ============================
         

--- --- ---

--- --- ---

OK, da wurde schon was gelöscht, ich muss aber noch eine andere Infektion ausschließen.

Schritt 1
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Die aktuelle Version vom TDSSKiller hat eine dritte Option "Use KSN to scan objects", welche per Default aktiviert ist.

Diese habe ich - da sie in der Anleitung nicht benannt ist - deaktiviert. Hier das Log:

18:20:59.0885 0x0f74  TDSS rootkit removing tool 3.0.0.39 Jun  5 2014 20:35:54
18:21:03.0163 0x0f74  ============================================================
18:21:03.0163 0x0f74  Current date / time: 2014/06/17 18:21:03.0163
18:21:03.0163 0x0f74  SystemInfo:
18:21:03.0163 0x0f74  
18:21:03.0163 0x0f74  OS Version: 6.1.7601 ServicePack: 1.0
18:21:03.0163 0x0f74  Product type: Workstation
18:21:03.0164 0x0f74  ComputerName: SARGE-PC
18:21:03.0164 0x0f74  UserName: Sarge
18:21:03.0164 0x0f74  Windows directory: C:\Windows
18:21:03.0164 0x0f74  System windows directory: C:\Windows
18:21:03.0164 0x0f74  Running under WOW64
18:21:03.0164 0x0f74  Processor architecture: Intel x64
18:21:03.0164 0x0f74  Number of processors: 6
18:21:03.0164 0x0f74  Page size: 0x1000
18:21:03.0164 0x0f74  Boot type: Normal boot
18:21:03.0164 0x0f74  ============================================================
18:21:06.0095 0x0f74  KLMD registered as C:\Windows\system32\drivers\30670333.sys
18:21:06.0287 0x0f74  System UUID: {B9A7A48C-9D7B-990C-FE13-3339D5BB2FC7}
18:21:06.0713 0x0f74  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1F8B1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
18:21:06.0728 0x0f74  ============================================================
18:21:06.0728 0x0f74  \Device\Harddisk0\DR0:
18:21:06.0729 0x0f74  MBR partitions:
18:21:06.0729 0x0f74  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
18:21:06.0729 0x0f74  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x6519A10
18:21:06.0729 0x0f74  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x654C210, BlocksNum 0x6E1B9400
18:21:06.0729 0x0f74  ============================================================
18:21:06.0760 0x0f74  D: <-> \Device\Harddisk0\DR0\Partition3
18:21:06.0782 0x0f74  C: <-> \Device\Harddisk0\DR0\Partition2
18:21:06.0782 0x0f74  ============================================================
18:21:06.0782 0x0f74  Initialize success
18:21:06.0782 0x0f74  ============================================================
18:30:18.0032 0x0778  ============================================================
18:30:18.0032 0x0778  Scan started
18:30:18.0032 0x0778  Mode: Manual; SigCheck; TDLFS; 
18:30:18.0032 0x0778  ============================================================
18:30:18.0032 0x0778  KSN ping started
18:30:20.0559 0x0778  KSN ping finished: true
18:30:21.0511 0x0778  ================ Scan system memory ========================
18:30:21.0511 0x0778  System memory - ok
18:30:21.0511 0x0778  ================ Scan services =============================
18:30:21.0714 0x0778  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
18:30:21.0807 0x0778  1394ohci - ok
18:30:21.0838 0x0778  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
18:30:21.0870 0x0778  ACPI - ok
18:30:21.0870 0x0778  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
18:30:21.0932 0x0778  AcpiPmi - ok
18:30:21.0994 0x0778  [ B362181ED3771DC03B4141927C80F801, 69514E5177A0AEA89C27C2234712F9F82E8D8F99E1FD4273898C9324C6FF7472 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
18:30:22.0026 0x0778  AdobeARMservice - ok
18:30:22.0057 0x0778  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
18:30:22.0072 0x0778  adp94xx - ok
18:30:22.0088 0x0778  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
18:30:22.0104 0x0778  adpahci - ok
18:30:22.0119 0x0778  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
18:30:22.0135 0x0778  adpu320 - ok
18:30:22.0150 0x0778  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
18:30:22.0182 0x0778  AeLookupSvc - ok
18:30:22.0213 0x0778  [ 79059559E89D06E8B80CE2944BE20228, 6E041D2FED2D0C3D8E16E56CB61D3245F9144EA92F5BDC9A4AA30598D1C8E6EE ] AFD             C:\Windows\system32\drivers\afd.sys
18:30:22.0275 0x0778  AFD - ok
18:30:22.0306 0x0778  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
18:30:22.0306 0x0778  agp440 - ok
18:30:22.0322 0x0778  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
18:30:22.0400 0x0778  ALG - ok
18:30:22.0431 0x0778  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
18:30:22.0447 0x0778  aliide - ok
18:30:22.0462 0x0778  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
18:30:22.0478 0x0778  amdide - ok
18:30:22.0478 0x0778  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
18:30:22.0540 0x0778  AmdK8 - ok
18:30:22.0572 0x0778  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
18:30:22.0603 0x0778  AmdPPM - ok
18:30:22.0634 0x0778  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
18:30:22.0650 0x0778  amdsata - ok
18:30:22.0665 0x0778  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
18:30:22.0681 0x0778  amdsbs - ok
18:30:22.0696 0x0778  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
18:30:22.0712 0x0778  amdxata - ok
18:30:22.0728 0x0778  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
18:30:22.0852 0x0778  AppID - ok
18:30:22.0868 0x0778  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
18:30:22.0915 0x0778  AppIDSvc - ok
18:30:22.0946 0x0778  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
18:30:23.0008 0x0778  Appinfo - ok
18:30:23.0024 0x0778  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
18:30:23.0071 0x0778  AppMgmt - ok
18:30:23.0071 0x0778  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
18:30:23.0086 0x0778  arc - ok
18:30:23.0086 0x0778  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
18:30:23.0102 0x0778  arcsas - ok
18:30:23.0196 0x0778  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
18:30:23.0227 0x0778  aspnet_state - ok
18:30:23.0258 0x0778  [ 340B0467E98A8C92697D73034DB4BCB7, 342572B566747A05DA5391CFC027A6703AECCE29C3D288428884D8641A35D0F5 ] aswHwid         C:\Windows\system32\drivers\aswHwid.sys
18:30:23.0305 0x0778  aswHwid - ok
18:30:23.0352 0x0778  [ ED5B09937D559FFA53FC988D20031E98, EC9E50C9BC2184AE93944EA3115A25BADF5FFB91D11776498EBC9A0D60029A84 ] aswMonFlt       C:\Windows\system32\drivers\aswMonFlt.sys
18:30:23.0367 0x0778  aswMonFlt - ok
18:30:23.0398 0x0778  [ 33C77DCB0AEC76E26BD6352A1A5281BB, CEA7BB3407C1F900DE5CB09F42AF7734811F86B7DE0085FADC7AAE8178D59665 ] aswRdr          C:\Windows\system32\drivers\aswRdr2.sys
18:30:23.0414 0x0778  aswRdr - ok
18:30:23.0430 0x0778  [ BF5B9E9E97CED45208E498D9FA73688F, BCB2CC516EAD040573D80599C2306ECB26FCCB16A97B940327CD3A3CE9077877 ] aswRvrt         C:\Windows\system32\drivers\aswRvrt.sys
18:30:23.0445 0x0778  aswRvrt - ok
18:30:23.0492 0x0778  [ F88CE00A7736C349ED1414D7ECDC9BED, 8C0783CE32968874065C2F46088B34F9C872F26C98AB8E8BA895D84CCB25E534 ] aswSnx          C:\Windows\system32\drivers\aswSnx.sys
18:30:23.0523 0x0778  aswSnx - ok
18:30:23.0586 0x0778  [ 3AE912B08E2A1ABB2B63F3C56BED95C2, BE99BA3A74427444FEE5D47D70BDBA631DBBF50D80B0483C0675F87119926765 ] aswSP           C:\Windows\system32\drivers\aswSP.sys
18:30:23.0601 0x0778  aswSP - ok
18:30:23.0632 0x0778  [ A7115ED31675BB823CFA9FE571C25676, DEEBB3920934DCDDD488DCFCB1E6F4C7EFDD3C79F31E41D59E292C3CF9400E95 ] aswStm          C:\Windows\system32\drivers\aswStm.sys
18:30:23.0664 0x0778  aswStm - ok
18:30:23.0695 0x0778  [ 47CBD3F64E412FFAFD93404580A3C7B9, F9B02E232416BAFC21BCBCDC0A3D9E5E855BFAF11F29ED2C4C469692E6688278 ] aswVmm          C:\Windows\system32\drivers\aswVmm.sys
18:30:23.0710 0x0778  aswVmm - ok
18:30:23.0726 0x0778  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
18:30:23.0788 0x0778  AsyncMac - ok
18:30:23.0804 0x0778  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
18:30:23.0820 0x0778  atapi - ok
18:30:23.0866 0x0778  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
18:30:23.0929 0x0778  AudioEndpointBuilder - ok
18:30:23.0944 0x0778  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
18:30:23.0991 0x0778  AudioSrv - ok
18:30:24.0147 0x0778  [ 37D17AE2936867F88EB3C4CBCBC6B8A1, E1F4D288CE1E5482A5594C8F9EEDE1E8134466F5E0C7DA32D88985497CD8588B ] avast! Antivirus D:\Programme\AVAST Software\Avast\AvastSvc.exe
18:30:24.0178 0x0778  avast! Antivirus - ok
18:30:24.0210 0x0778  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
18:30:24.0272 0x0778  AxInstSV - ok
18:30:24.0303 0x0778  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
18:30:24.0350 0x0778  b06bdrv - ok
18:30:24.0366 0x0778  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
18:30:24.0397 0x0778  b57nd60a - ok
18:30:24.0428 0x0778  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
18:30:24.0459 0x0778  BDESVC - ok
18:30:24.0475 0x0778  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
18:30:24.0553 0x0778  Beep - ok
18:30:24.0584 0x0778  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
18:30:24.0615 0x0778  BFE - ok
18:30:24.0693 0x0778  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\system32\qmgr.dll
18:30:24.0756 0x0778  BITS - ok
18:30:24.0771 0x0778  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
18:30:24.0818 0x0778  blbdrive - ok
18:30:24.0849 0x0778  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
18:30:24.0896 0x0778  bowser - ok
18:30:24.0896 0x0778  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
18:30:24.0927 0x0778  BrFiltLo - ok
18:30:24.0927 0x0778  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
18:30:24.0958 0x0778  BrFiltUp - ok
18:30:24.0974 0x0778  [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
18:30:25.0021 0x0778  BridgeMP - ok
18:30:25.0036 0x0778  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
18:30:25.0052 0x0778  Browser - ok
18:30:25.0068 0x0778  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
18:30:25.0114 0x0778  Brserid - ok
18:30:25.0130 0x0778  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
18:30:25.0146 0x0778  BrSerWdm - ok
18:30:25.0146 0x0778  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
18:30:25.0177 0x0778  BrUsbMdm - ok
18:30:25.0177 0x0778  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
18:30:25.0192 0x0778  BrUsbSer - ok
18:30:25.0192 0x0778  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
18:30:25.0224 0x0778  BTHMODEM - ok
18:30:25.0255 0x0778  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
18:30:25.0270 0x0778  bthserv - ok
18:30:25.0286 0x0778  catchme - ok
18:30:25.0286 0x0778  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
18:30:25.0317 0x0778  cdfs - ok
18:30:25.0333 0x0778  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
18:30:25.0364 0x0778  cdrom - ok
18:30:25.0395 0x0778  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
18:30:25.0411 0x0778  CertPropSvc - ok
18:30:25.0426 0x0778  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
18:30:25.0458 0x0778  circlass - ok
18:30:25.0489 0x0778  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
18:30:25.0504 0x0778  CLFS - ok
18:30:25.0567 0x0778  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
18:30:25.0582 0x0778  clr_optimization_v2.0.50727_32 - ok
18:30:25.0614 0x0778  [ D1CEEA2B47CB998321C579651CE3E4F8, 654013B8FD229A50017B08DEC6CA19C7DDA8CE0771260E057A92625201D539B1 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
18:30:25.0629 0x0778  clr_optimization_v2.0.50727_64 - ok
18:30:25.0660 0x0778  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
18:30:25.0707 0x0778  clr_optimization_v4.0.30319_32 - ok
18:30:25.0738 0x0778  [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
18:30:25.0754 0x0778  clr_optimization_v4.0.30319_64 - ok
18:30:25.0770 0x0778  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
18:30:25.0785 0x0778  CmBatt - ok
18:30:25.0801 0x0778  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
18:30:25.0816 0x0778  cmdide - ok
18:30:25.0848 0x0778  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys
18:30:25.0879 0x0778  CNG - ok
18:30:25.0894 0x0778  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
18:30:25.0894 0x0778  Compbatt - ok
18:30:25.0910 0x0778  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
18:30:25.0941 0x0778  CompositeBus - ok
18:30:25.0941 0x0778  COMSysApp - ok
18:30:25.0957 0x0778  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
18:30:25.0972 0x0778  crcdisk - ok
18:30:25.0988 0x0778  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll
18:30:26.0019 0x0778  CryptSvc - ok
18:30:26.0050 0x0778  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
18:30:26.0097 0x0778  CSC - ok
18:30:26.0128 0x0778  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
18:30:26.0160 0x0778  CscService - ok
18:30:26.0206 0x0778  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
18:30:26.0269 0x0778  DcomLaunch - ok
18:30:26.0300 0x0778  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
18:30:26.0347 0x0778  defragsvc - ok
18:30:26.0394 0x0778  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
18:30:26.0425 0x0778  DfsC - ok
18:30:26.0456 0x0778  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
18:30:26.0503 0x0778  Dhcp - ok
18:30:26.0518 0x0778  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
18:30:26.0550 0x0778  discache - ok
18:30:26.0565 0x0778  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
18:30:26.0581 0x0778  Disk - ok
18:30:26.0596 0x0778  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
18:30:26.0674 0x0778  Dnscache - ok
18:30:26.0690 0x0778  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
18:30:26.0737 0x0778  dot3svc - ok
18:30:26.0768 0x0778  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
18:30:26.0799 0x0778  DPS - ok
18:30:26.0830 0x0778  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
18:30:26.0877 0x0778  drmkaud - ok
18:30:26.0924 0x0778  [ 46571ED73AE84469DCA53081D33CF3C8, 8BB386BB4F6AD39F06A8607CD1DF3D67CFA45BBE52E40EDB90EB8C862283EBFF ] dtsoftbus01     C:\Windows\system32\DRIVERS\dtsoftbus01.sys
18:30:26.0955 0x0778  dtsoftbus01 - ok
18:30:27.0002 0x0778  [ 88612F1CE3BF42256913BF6E61C70D52, 7CF190F83FA8F15C33008EB381D3E345CEF37CBC046227DED26B36799EF4D9A7 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
18:30:27.0033 0x0778  DXGKrnl - ok
18:30:27.0064 0x0778  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
18:30:27.0096 0x0778  EapHost - ok
18:30:27.0236 0x0778  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
18:30:27.0345 0x0778  ebdrv - ok
18:30:27.0361 0x0778  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS             C:\Windows\System32\lsass.exe
18:30:27.0423 0x0778  EFS - ok
18:30:27.0470 0x0778  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
18:30:27.0548 0x0778  ehRecvr - ok
18:30:27.0579 0x0778  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
18:30:27.0626 0x0778  ehSched - ok
18:30:27.0657 0x0778  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
18:30:27.0688 0x0778  elxstor - ok
18:30:27.0720 0x0778  [ 9EAFB3B3B60B8AD958985152A9309ACA, EC58F487D50A125DA3F747670282EA2104580CCAAF709EA494B61C7549576AE6 ] epmntdrv        C:\Windows\system32\epmntdrv.sys
18:30:27.0720 0x0778  epmntdrv - detected UnsignedFile.Multi.Generic ( 1 )
18:30:27.0782 0x0778  epmntdrv ( UnsignedFile.Multi.Generic ) - warning
18:30:30.0247 0x0778  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
18:30:30.0294 0x0778  ErrDev - ok
18:30:30.0309 0x0778  [ 84486624268E078255BC7AA47F0960BC, EC2540698B974572F0AC4A93D57C63295BAF66BF50F7416B9DFF5DE790EBDBE7 ] etdrv           C:\Windows\etdrv.sys
18:30:30.0325 0x0778  etdrv - ok
18:30:30.0340 0x0778  [ FB949ED2C93C878A189039F3D7730942, 857AFB9965F14C80C21948C05A44D37948BD206961101DFF087735D6A7CCAA8A ] EuGdiDrv        C:\Windows\system32\EuGdiDrv.sys
18:30:30.0356 0x0778  EuGdiDrv - detected UnsignedFile.Multi.Generic ( 1 )
18:30:30.0356 0x0778  EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning
18:30:30.0356 0x0778  Force sending object to P2P due to detect: EuGdiDrv
18:30:45.0129 0x0778  Object send P2P result: true
18:30:47.0625 0x0778  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
18:30:47.0688 0x0778  EventSystem - ok
18:30:47.0703 0x0778  ewusbnet - ok
18:30:47.0719 0x0778  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
18:30:47.0750 0x0778  exfat - ok
18:30:47.0766 0x0778  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
18:30:47.0797 0x0778  fastfat - ok
18:30:47.0859 0x0778  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
18:30:47.0937 0x0778  Fax - ok
18:30:47.0953 0x0778  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
18:30:47.0984 0x0778  fdc - ok
18:30:47.0984 0x0778  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
18:30:48.0031 0x0778  fdPHost - ok
18:30:48.0046 0x0778  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
18:30:48.0078 0x0778  FDResPub - ok
18:30:48.0093 0x0778  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
18:30:48.0109 0x0778  FileInfo - ok
18:30:48.0109 0x0778  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
18:30:48.0156 0x0778  Filetrace - ok
18:30:48.0156 0x0778  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
18:30:48.0171 0x0778  flpydisk - ok
18:30:48.0187 0x0778  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
18:30:48.0202 0x0778  FltMgr - ok
18:30:48.0249 0x0778  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
18:30:48.0296 0x0778  FontCache - ok
18:30:48.0343 0x0778  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
18:30:48.0358 0x0778  FontCache3.0.0.0 - ok
18:30:48.0358 0x0778  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
18:30:48.0374 0x0778  FsDepends - ok
18:30:48.0405 0x0778  [ DC0DCE4EC2C5D2CF6472F9FD6AA9A7DC, 7022722FA38E81F6F4D0EF9F0FBEDD27C09A238B5246A3C36AEAAC11FF76FE07 ] fssfltr         C:\Windows\system32\DRIVERS\fssfltr.sys
18:30:48.0421 0x0778  fssfltr - ok
18:30:48.0530 0x0778  [ 40CDFAD174B3D5E80F95DDA003C0B97F, 2DA149CE42B87681ECDCC8905D0957443F430A9C7002FF78F22A95F9112A7C4C ] fsssvc          C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
18:30:48.0561 0x0778  fsssvc - ok
18:30:48.0592 0x0778  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
18:30:48.0639 0x0778  Fs_Rec - ok
18:30:48.0670 0x0778  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
18:30:48.0686 0x0778  fvevol - ok
18:30:48.0702 0x0778  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
18:30:48.0717 0x0778  gagp30kx - ok
18:30:48.0748 0x0778  [ 7907E14F9BCF3A4689C9A74A1A873CB6, 17927B93B2D6AB4271C158F039CAE2D60591D6A14458F5A5690AEC86F5D54229 ] gdrv            C:\Windows\gdrv.sys
18:30:48.0748 0x0778  gdrv - ok
18:30:48.0780 0x0778  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
18:30:48.0842 0x0778  gpsvc - ok
18:30:48.0873 0x0778  [ 8126331FBD4ED29EB3B356F9C905064D, A58BCE904591DD762410E99960FD956FB579C2CE78FA7BF1406075D29537EF82 ] GVTDrv64        C:\Windows\GVTDrv64.sys
18:30:48.0904 0x0778  GVTDrv64 - ok
18:30:48.0904 0x0778  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
18:30:48.0951 0x0778  hcw85cir - ok
18:30:48.0982 0x0778  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
18:30:49.0014 0x0778  HdAudAddService - ok
18:30:49.0029 0x0778  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
18:30:49.0045 0x0778  HDAudBus - ok
18:30:49.0060 0x0778  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
18:30:49.0076 0x0778  HidBatt - ok
18:30:49.0092 0x0778  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
18:30:49.0107 0x0778  HidBth - ok
18:30:49.0107 0x0778  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
18:30:49.0138 0x0778  HidIr - ok
18:30:49.0154 0x0778  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\System32\hidserv.dll
18:30:49.0201 0x0778  hidserv - ok
18:30:49.0232 0x0778  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
18:30:49.0248 0x0778  HidUsb - ok
18:30:49.0279 0x0778  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
18:30:49.0310 0x0778  hkmsvc - ok
18:30:49.0341 0x0778  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
18:30:49.0388 0x0778  HomeGroupListener - ok
18:30:49.0419 0x0778  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
18:30:49.0435 0x0778  HomeGroupProvider - ok
18:30:49.0466 0x0778  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
18:30:49.0482 0x0778  HpSAMD - ok
18:30:49.0528 0x0778  [ 81FC369485C12837DE3D708B7C8FDA7D, 3B6118FBD4D65A38E297BF32D9193A6F0CA556ADAEC56F4DAA03EE70F8166FD7 ] HTCAND64        C:\Windows\system32\Drivers\ANDROIDUSB.sys
18:30:49.0606 0x0778  HTCAND64 - ok
18:30:49.0684 0x0778  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
18:30:49.0731 0x0778  HTTP - ok
18:30:49.0778 0x0778  hwdatacard - ok
18:30:49.0809 0x0778  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
18:30:49.0825 0x0778  hwpolicy - ok
18:30:49.0840 0x0778  hwusbdev - ok
18:30:49.0872 0x0778  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
18:30:49.0887 0x0778  i8042prt - ok
18:30:49.0934 0x0778  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
18:30:49.0950 0x0778  iaStorV - ok
18:30:49.0996 0x0778  [ DAF66902F08796F9C694901660E5A64A, F4A4764DED05980426BAB54AAF040BC27A39C80315F5161E8D0B4C7F694BD8E6 ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
18:30:50.0028 0x0778  IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
18:30:50.0028 0x0778  IDriverT ( UnsignedFile.Multi.Generic ) - warning
18:30:50.0028 0x0778  Force sending object to P2P due to detect: IDriverT
18:31:08.0982 0x0778  Object send P2P result: true
18:31:11.0493 0x0778  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD, 2B9512324DBA4A97F6AC34E8067EE08E3B6874CD60F6CB4209AFC22A34D2BE99 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
18:31:11.0525 0x0778  idsvc - ok
18:31:11.0556 0x0778  IEEtwCollectorService - ok
18:31:11.0571 0x0778  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
18:31:11.0603 0x0778  iirsp - ok
18:31:11.0649 0x0778  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
18:31:11.0696 0x0778  IKEEXT - ok
18:31:11.0696 0x0778  IntcAzAudAddService - ok
18:31:11.0727 0x0778  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
18:31:11.0727 0x0778  intelide - ok
18:31:11.0743 0x0778  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
18:31:11.0759 0x0778  intelppm - ok
18:31:11.0774 0x0778  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
18:31:11.0805 0x0778  IPBusEnum - ok
18:31:11.0837 0x0778  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:31:11.0883 0x0778  IpFilterDriver - ok
18:31:11.0930 0x0778  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
18:31:11.0977 0x0778  iphlpsvc - ok
18:31:11.0993 0x0778  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
18:31:12.0008 0x0778  IPMIDRV - ok
18:31:12.0024 0x0778  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
18:31:12.0055 0x0778  IPNAT - ok
18:31:12.0071 0x0778  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
18:31:12.0102 0x0778  IRENUM - ok
18:31:12.0117 0x0778  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
18:31:12.0117 0x0778  isapnp - ok
18:31:12.0149 0x0778  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
18:31:12.0164 0x0778  iScsiPrt - ok
18:31:12.0164 0x0778  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
18:31:12.0180 0x0778  kbdclass - ok
18:31:12.0211 0x0778  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
18:31:12.0227 0x0778  kbdhid - ok
18:31:12.0242 0x0778  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso          C:\Windows\system32\lsass.exe
18:31:12.0242 0x0778  KeyIso - ok
18:31:12.0273 0x0778  [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
18:31:12.0289 0x0778  KSecDD - ok
18:31:12.0305 0x0778  [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
18:31:12.0320 0x0778  KSecPkg - ok
18:31:12.0336 0x0778  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
18:31:12.0398 0x0778  ksthunk - ok
18:31:12.0429 0x0778  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
18:31:12.0476 0x0778  KtmRm - ok
18:31:12.0523 0x0778  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\System32\srvsvc.dll
18:31:12.0554 0x0778  LanmanServer - ok
18:31:12.0585 0x0778  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
18:31:12.0617 0x0778  LanmanWorkstation - ok
18:31:12.0648 0x0778  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
18:31:12.0679 0x0778  lltdio - ok
18:31:12.0695 0x0778  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
18:31:12.0741 0x0778  lltdsvc - ok
18:31:12.0757 0x0778  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
18:31:12.0804 0x0778  lmhosts - ok
18:31:12.0819 0x0778  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
18:31:12.0819 0x0778  LSI_FC - ok
18:31:12.0835 0x0778  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
18:31:12.0835 0x0778  LSI_SAS - ok
18:31:12.0851 0x0778  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
18:31:12.0851 0x0778  LSI_SAS2 - ok
18:31:12.0866 0x0778  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
18:31:12.0866 0x0778  LSI_SCSI - ok
18:31:12.0897 0x0778  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
18:31:12.0944 0x0778  luafv - ok
18:31:12.0960 0x0778  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
18:31:12.0975 0x0778  Mcx2Svc - ok
18:31:12.0991 0x0778  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
18:31:13.0007 0x0778  megasas - ok
18:31:13.0007 0x0778  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
18:31:13.0022 0x0778  MegaSR - ok
18:31:13.0038 0x0778  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
18:31:13.0085 0x0778  MMCSS - ok
18:31:13.0085 0x0778  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
18:31:13.0116 0x0778  Modem - ok
18:31:13.0131 0x0778  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
18:31:13.0163 0x0778  monitor - ok
18:31:13.0163 0x0778  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
18:31:13.0178 0x0778  mouclass - ok
18:31:13.0178 0x0778  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
18:31:13.0194 0x0778  mouhid - ok
18:31:13.0225 0x0778  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
18:31:13.0241 0x0778  mountmgr - ok
18:31:13.0256 0x0778  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
18:31:13.0272 0x0778  mpio - ok
18:31:13.0287 0x0778  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
18:31:13.0319 0x0778  mpsdrv - ok
18:31:13.0381 0x0778  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
18:31:13.0428 0x0778  MpsSvc - ok
18:31:13.0459 0x0778  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
18:31:13.0490 0x0778  MRxDAV - ok
18:31:13.0521 0x0778  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
18:31:13.0568 0x0778  mrxsmb - ok
18:31:13.0615 0x0778  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:31:13.0646 0x0778  mrxsmb10 - ok
18:31:13.0662 0x0778  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:31:13.0677 0x0778  mrxsmb20 - ok
18:31:13.0693 0x0778  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
18:31:13.0693 0x0778  msahci - ok
18:31:13.0709 0x0778  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
18:31:13.0724 0x0778  msdsm - ok
18:31:13.0724 0x0778  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
18:31:13.0755 0x0778  MSDTC - ok
18:31:13.0771 0x0778  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
18:31:13.0802 0x0778  Msfs - ok
18:31:13.0818 0x0778  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
18:31:13.0849 0x0778  mshidkmdf - ok
18:31:13.0880 0x0778  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
18:31:13.0911 0x0778  msisadrv - ok
18:31:13.0927 0x0778  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
18:31:13.0974 0x0778  MSiSCSI - ok
18:31:13.0974 0x0778  msiserver - ok
18:31:13.0989 0x0778  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
18:31:14.0021 0x0778  MSKSSRV - ok
18:31:14.0036 0x0778  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
18:31:14.0067 0x0778  MSPCLOCK - ok
18:31:14.0083 0x0778  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
18:31:14.0114 0x0778  MSPQM - ok
18:31:14.0145 0x0778  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
18:31:14.0161 0x0778  MsRPC - ok
18:31:14.0177 0x0778  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
18:31:14.0192 0x0778  mssmbios - ok
18:31:14.0192 0x0778  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
18:31:14.0223 0x0778  MSTEE - ok
18:31:14.0239 0x0778  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
18:31:14.0255 0x0778  MTConfig - ok
18:31:14.0255 0x0778  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
18:31:14.0270 0x0778  Mup - ok
18:31:14.0301 0x0778  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
18:31:14.0348 0x0778  napagent - ok
18:31:14.0379 0x0778  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
18:31:14.0411 0x0778  NativeWifiP - ok
18:31:14.0457 0x0778  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
18:31:14.0489 0x0778  NDIS - ok
18:31:14.0504 0x0778  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
18:31:14.0520 0x0778  NdisCap - ok
18:31:14.0551 0x0778  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
18:31:14.0567 0x0778  NdisTapi - ok
18:31:14.0598 0x0778  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
18:31:14.0629 0x0778  Ndisuio - ok
18:31:14.0660 0x0778  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
18:31:14.0691 0x0778  NdisWan - ok
18:31:14.0723 0x0778  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
18:31:14.0801 0x0778  NDProxy - ok
18:31:14.0816 0x0778  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
18:31:14.0863 0x0778  NetBIOS - ok
18:31:14.0879 0x0778  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
18:31:14.0925 0x0778  NetBT - ok
18:31:14.0941 0x0778  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon        C:\Windows\system32\lsass.exe
18:31:14.0957 0x0778  Netlogon - ok
18:31:14.0988 0x0778  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
18:31:15.0019 0x0778  Netman - ok
18:31:15.0050 0x0778  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:31:15.0066 0x0778  NetMsmqActivator - ok
18:31:15.0066 0x0778  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:31:15.0081 0x0778  NetPipeActivator - ok
18:31:15.0128 0x0778  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
18:31:15.0191 0x0778  netprofm - ok
18:31:15.0191 0x0778  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:31:15.0206 0x0778  NetTcpActivator - ok
18:31:15.0222 0x0778  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
18:31:15.0222 0x0778  NetTcpPortSharing - ok
18:31:15.0237 0x0778  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
18:31:15.0237 0x0778  nfrd960 - ok
18:31:15.0269 0x0778  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\Windows\System32\nlasvc.dll
18:31:15.0300 0x0778  NlaSvc - ok
18:31:15.0315 0x0778  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
18:31:15.0347 0x0778  Npfs - ok
18:31:15.0362 0x0778  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
18:31:15.0409 0x0778  nsi - ok
18:31:15.0425 0x0778  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
18:31:15.0456 0x0778  nsiproxy - ok
18:31:15.0549 0x0778  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
18:31:15.0596 0x0778  Ntfs - ok
18:31:15.0627 0x0778  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
18:31:15.0659 0x0778  Null - ok
18:31:15.0690 0x0778  [ 102806B360D0E6BC6E55BF47EF655D43, A0571D4B231568E7C977328C4D4633597B47C05E2668ACDBE2DE01BB46FF872F ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
18:31:15.0690 0x0778  NVHDA - ok
18:31:16.0033 0x0778  [ FCBA1C22727939E7CFF9EB08FE9692AB, 081FBF38EA17746C5CF2260AD32B62385D4A075476E30CBB9A2AA080F8AA0CA4 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
18:31:16.0236 0x0778  nvlddmkm - ok
18:31:16.0251 0x0778  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
18:31:16.0267 0x0778  nvraid - ok
18:31:16.0298 0x0778  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
18:31:16.0314 0x0778  nvstor - ok
18:31:16.0345 0x0778  [ 10C232F6CFFD51D2332898AE7AE0FF23, 92E5452D8467852C22D702ACAFB5DBFD312A8F72A4353B8D0A9C18AEFCE4B2B2 ] NVSvc           C:\Windows\system32\nvvsvc.exe
18:31:16.0376 0x0778  NVSvc - ok
18:31:16.0485 0x0778  [ 4789E020D2617046862D1790FC235FF6, FCFD56DF2CADA830E7B2D4B91D5A9D2FE783B1396CBA124000765168FA5B6574 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
18:31:16.0517 0x0778  nvUpdatusService - ok
18:31:16.0548 0x0778  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
18:31:16.0563 0x0778  nv_agp - ok
18:31:16.0579 0x0778  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
18:31:16.0610 0x0778  ohci1394 - ok
18:31:16.0641 0x0778  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
18:31:16.0673 0x0778  p2pimsvc - ok
18:31:16.0688 0x0778  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
18:31:16.0719 0x0778  p2psvc - ok
18:31:16.0735 0x0778  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
18:31:16.0751 0x0778  Parport - ok
18:31:16.0766 0x0778  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
18:31:16.0782 0x0778  partmgr - ok
18:31:16.0797 0x0778  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
18:31:16.0829 0x0778  PcaSvc - ok
18:31:16.0844 0x0778  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
18:31:16.0860 0x0778  pci - ok
18:31:16.0891 0x0778  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
18:31:16.0891 0x0778  pciide - ok
18:31:16.0907 0x0778  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
18:31:16.0922 0x0778  pcmcia - ok
18:31:16.0938 0x0778  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
18:31:16.0953 0x0778  pcw - ok
18:31:16.0985 0x0778  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
18:31:17.0031 0x0778  PEAUTH - ok
18:31:17.0125 0x0778  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
18:31:17.0187 0x0778  PeerDistSvc - ok
18:31:17.0234 0x0778  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
18:31:17.0250 0x0778  PerfHost - ok
18:31:17.0312 0x0778  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
18:31:17.0390 0x0778  pla - ok
18:31:17.0453 0x0778  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
18:31:17.0484 0x0778  PlugPlay - ok
18:31:17.0515 0x0778  PnkBstrA - ok
18:31:17.0531 0x0778  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
18:31:17.0546 0x0778  PNRPAutoReg - ok
18:31:17.0577 0x0778  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
18:31:17.0593 0x0778  PNRPsvc - ok
18:31:17.0624 0x0778  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
18:31:17.0671 0x0778  PolicyAgent - ok
18:31:17.0702 0x0778  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
18:31:17.0749 0x0778  Power - ok
18:31:17.0765 0x0778  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
18:31:17.0796 0x0778  PptpMiniport - ok
18:31:17.0827 0x0778  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
18:31:17.0843 0x0778  Processor - ok
18:31:17.0874 0x0778  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\Windows\system32\profsvc.dll
18:31:17.0905 0x0778  ProfSvc - ok
18:31:17.0921 0x0778  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
18:31:17.0921 0x0778  ProtectedStorage - ok
18:31:17.0952 0x0778  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
18:31:17.0983 0x0778  Psched - ok
18:31:18.0030 0x0778  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
18:31:18.0077 0x0778  ql2300 - ok
18:31:18.0077 0x0778  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
18:31:18.0092 0x0778  ql40xx - ok
18:31:18.0123 0x0778  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
18:31:18.0155 0x0778  QWAVE - ok
18:31:18.0170 0x0778  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
18:31:18.0201 0x0778  QWAVEdrv - ok
18:31:18.0217 0x0778  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
18:31:18.0248 0x0778  RasAcd - ok
18:31:18.0264 0x0778  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
18:31:18.0295 0x0778  RasAgileVpn - ok
18:31:18.0311 0x0778  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
18:31:18.0342 0x0778  RasAuto - ok
18:31:18.0373 0x0778  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
18:31:18.0404 0x0778  Rasl2tp - ok
18:31:18.0420 0x0778  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
18:31:18.0467 0x0778  RasMan - ok
18:31:18.0482 0x0778  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
18:31:18.0513 0x0778  RasPppoe - ok
18:31:18.0545 0x0778  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
18:31:18.0560 0x0778  RasSstp - ok
18:31:18.0591 0x0778  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
18:31:18.0638 0x0778  rdbss - ok
18:31:18.0654 0x0778  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
18:31:18.0669 0x0778  rdpbus - ok
18:31:18.0685 0x0778  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
18:31:18.0716 0x0778  RDPCDD - ok
18:31:18.0747 0x0778  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
18:31:18.0794 0x0778  RDPDR - ok
18:31:18.0794 0x0778  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
18:31:18.0841 0x0778  RDPENCDD - ok
18:31:18.0857 0x0778  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
18:31:18.0872 0x0778  RDPREFMP - ok
18:31:18.0903 0x0778  [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
18:31:18.0919 0x0778  RDPWD - ok
18:31:18.0981 0x0778  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
18:31:18.0997 0x0778  rdyboost - ok
18:31:19.0028 0x0778  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
18:31:19.0075 0x0778  RemoteAccess - ok
18:31:19.0091 0x0778  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
18:31:19.0137 0x0778  RemoteRegistry - ok
18:31:19.0137 0x0778  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
18:31:19.0184 0x0778  RpcEptMapper - ok
18:31:19.0200 0x0778  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
18:31:19.0231 0x0778  RpcLocator - ok
18:31:19.0262 0x0778  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
18:31:19.0293 0x0778  RpcSs - ok
18:31:19.0325 0x0778  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
18:31:19.0356 0x0778  rspndr - ok
18:31:19.0387 0x0778  [ 4FBDA07EF0A3097CE14C5CABF723B278, 6F1E21362F0057E9C6A180D9189AEB51761F4C019A6835E50E4AD19ED1F58FE6 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
18:31:19.0403 0x0778  RTL8167 - ok
18:31:19.0465 0x0778  [ FC00C0DE6DC83DE1B2B01420E2195B21, BA9670F67BEFE4DD39D9F98329AA69380E167383448C9488F4E500E0ECF22A97 ] RTL8192su       C:\Windows\system32\DRIVERS\RTL8192su.sys
18:31:19.0496 0x0778  RTL8192su - ok
18:31:19.0512 0x0778  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
18:31:19.0543 0x0778  s3cap - ok
18:31:19.0543 0x0778  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs           C:\Windows\system32\lsass.exe
18:31:19.0559 0x0778  SamSs - ok
18:31:19.0574 0x0778  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
18:31:19.0590 0x0778  sbp2port - ok
18:31:19.0621 0x0778  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
18:31:19.0668 0x0778  SCardSvr - ok
18:31:19.0683 0x0778  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
18:31:19.0715 0x0778  scfilter - ok
18:31:19.0761 0x0778  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
18:31:19.0839 0x0778  Schedule - ok
18:31:19.0871 0x0778  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
18:31:19.0902 0x0778  SCPolicySvc - ok
18:31:19.0933 0x0778  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
18:31:19.0964 0x0778  SDRSVC - ok
18:31:19.0980 0x0778  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
18:31:20.0011 0x0778  secdrv - ok
18:31:20.0027 0x0778  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
18:31:20.0073 0x0778  seclogon - ok
18:31:20.0073 0x0778  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\system32\sens.dll
18:31:20.0120 0x0778  SENS - ok
18:31:20.0136 0x0778  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
18:31:20.0183 0x0778  SensrSvc - ok
18:31:20.0198 0x0778  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
18:31:20.0214 0x0778  Serenum - ok
18:31:20.0229 0x0778  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
18:31:20.0245 0x0778  Serial - ok
18:31:20.0261 0x0778  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
18:31:20.0276 0x0778  sermouse - ok
18:31:20.0323 0x0778  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
18:31:20.0354 0x0778  SessionEnv - ok
18:31:20.0370 0x0778  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
18:31:20.0385 0x0778  sffdisk - ok
18:31:20.0401 0x0778  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
18:31:20.0432 0x0778  sffp_mmc - ok
18:31:20.0448 0x0778  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
18:31:20.0463 0x0778  sffp_sd - ok
18:31:20.0479 0x0778  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
18:31:20.0495 0x0778  sfloppy - ok
18:31:20.0541 0x0778  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
18:31:20.0573 0x0778  SharedAccess - ok
18:31:20.0604 0x0778  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
18:31:20.0651 0x0778  ShellHWDetection - ok
18:31:20.0666 0x0778  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
18:31:20.0682 0x0778  SiSRaid2 - ok
18:31:20.0697 0x0778  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
18:31:20.0713 0x0778  SiSRaid4 - ok
18:31:20.0713 0x0778  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
18:31:20.0760 0x0778  Smb - ok
18:31:20.0775 0x0778  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
18:31:20.0791 0x0778  SNMPTRAP - ok
18:31:20.0807 0x0778  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
18:31:20.0822 0x0778  spldr - ok
18:31:20.0853 0x0778  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
18:31:20.0900 0x0778  Spooler - ok
18:31:21.0025 0x0778  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
18:31:21.0165 0x0778  sppsvc - ok
18:31:21.0181 0x0778  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
18:31:21.0212 0x0778  sppuinotify - ok
18:31:21.0259 0x0778  [ D519AD2DE7968CD2B47FEA807C5B29B2, 8B658F7E21EB67D010DAF484479201A09146A16560DBAE8F1B620F5320A74D6A ] sptd            C:\Windows\System32\Drivers\sptd.sys
18:31:21.0259 0x0778  Suspicious file ( NoAccess ): C:\Windows\System32\Drivers\sptd.sys. md5: D519AD2DE7968CD2B47FEA807C5B29B2, sha256: 8B658F7E21EB67D010DAF484479201A09146A16560DBAE8F1B620F5320A74D6A
18:31:21.0275 0x0778  sptd - detected LockedFile.Multi.Generic ( 1 )
18:31:21.0275 0x0778  sptd ( LockedFile.Multi.Generic ) - warning
18:31:23.0755 0x0778  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
18:31:23.0817 0x0778  srv - ok
18:31:23.0849 0x0778  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
18:31:23.0864 0x0778  srv2 - ok
18:31:23.0880 0x0778  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
18:31:23.0911 0x0778  srvnet - ok
18:31:23.0942 0x0778  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
18:31:23.0973 0x0778  SSDPSRV - ok
18:31:23.0989 0x0778  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
18:31:24.0020 0x0778  SstpSvc - ok
18:31:24.0114 0x0778  [ 6E1A473DD2A4714EAF7D11E2315DF794, 4460546191072C7DF8B2E5A00577BA8E4FF5A1B2EA399DDF65EBE1AE4A5A5C84 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
18:31:24.0161 0x0778  Steam Client Service - ok
18:31:24.0239 0x0778  [ 5A19667A580B1CE886EAF968B9743F45, 0A9EBE4057A0A6EF4732623794C2416A6BD8B87356DA46652BD92762505F57C7 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
18:31:24.0270 0x0778  Stereo Service - ok
18:31:24.0285 0x0778  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
18:31:24.0285 0x0778  stexstor - ok
18:31:24.0317 0x0778  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
18:31:24.0363 0x0778  stisvc - ok
18:31:24.0395 0x0778  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
18:31:24.0395 0x0778  storflt - ok
18:31:24.0441 0x0778  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
18:31:24.0457 0x0778  StorSvc - ok
18:31:24.0473 0x0778  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
18:31:24.0473 0x0778  storvsc - ok
18:31:24.0504 0x0778  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
18:31:24.0504 0x0778  swenum - ok
18:31:24.0535 0x0778  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
18:31:24.0582 0x0778  swprv - ok
18:31:24.0675 0x0778  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
18:31:24.0738 0x0778  SysMain - ok
18:31:24.0769 0x0778  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
18:31:24.0785 0x0778  TabletInputService - ok
18:31:24.0800 0x0778  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
18:31:24.0847 0x0778  TapiSrv - ok
18:31:24.0863 0x0778  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
18:31:24.0894 0x0778  TBS - ok
18:31:25.0003 0x0778  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
18:31:25.0050 0x0778  Tcpip - ok
18:31:25.0097 0x0778  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
18:31:25.0143 0x0778  TCPIP6 - ok
18:31:25.0175 0x0778  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
18:31:25.0206 0x0778  tcpipreg - ok
18:31:25.0221 0x0778  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
18:31:25.0268 0x0778  TDPIPE - ok
18:31:25.0299 0x0778  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
18:31:25.0299 0x0778  TDTCP - ok
18:31:25.0331 0x0778  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
18:31:25.0362 0x0778  tdx - ok
18:31:25.0377 0x0778  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
18:31:25.0393 0x0778  TermDD - ok
18:31:25.0409 0x0778  [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService     C:\Windows\System32\termsrv.dll
18:31:25.0471 0x0778  TermService - ok
18:31:25.0487 0x0778  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
18:31:25.0580 0x0778  Themes - ok
18:31:25.0627 0x0778  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
18:31:25.0674 0x0778  THREADORDER - ok
18:31:25.0767 0x0778  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
18:31:25.0830 0x0778  TrkWks - ok
18:31:25.0845 0x0778  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
18:31:25.0908 0x0778  TrustedInstaller - ok
18:31:25.0923 0x0778  [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
18:31:25.0939 0x0778  tssecsrv - ok
18:31:25.0955 0x0778  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
18:31:25.0970 0x0778  TsUsbFlt - ok
18:31:26.0001 0x0778  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
18:31:26.0064 0x0778  tunnel - ok
18:31:26.0079 0x0778  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
18:31:26.0095 0x0778  uagp35 - ok
18:31:26.0111 0x0778  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
18:31:26.0157 0x0778  udfs - ok
18:31:26.0173 0x0778  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
18:31:26.0204 0x0778  UI0Detect - ok
18:31:26.0204 0x0778  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
18:31:26.0220 0x0778  uliagpkx - ok
18:31:26.0235 0x0778  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\drivers\umbus.sys
18:31:26.0251 0x0778  umbus - ok
18:31:26.0267 0x0778  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
18:31:26.0282 0x0778  UmPass - ok
18:31:26.0298 0x0778  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
18:31:26.0329 0x0778  UmRdpService - ok
18:31:26.0345 0x0778  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
18:31:26.0391 0x0778  upnphost - ok
18:31:26.0423 0x0778  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\drivers\usbccgp.sys
18:31:26.0485 0x0778  usbccgp - ok
18:31:26.0516 0x0778  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
18:31:26.0563 0x0778  usbcir - ok
18:31:26.0594 0x0778  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
18:31:26.0610 0x0778  usbehci - ok
18:31:26.0641 0x0778  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
18:31:26.0672 0x0778  usbhub - ok
18:31:26.0688 0x0778  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
18:31:26.0703 0x0778  usbohci - ok
18:31:26.0719 0x0778  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
18:31:26.0750 0x0778  usbprint - ok
18:31:26.0766 0x0778  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:31:26.0797 0x0778  USBSTOR - ok
18:31:26.0813 0x0778  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
18:31:26.0828 0x0778  usbuhci - ok
18:31:26.0844 0x0778  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
18:31:26.0875 0x0778  UxSms - ok
18:31:26.0891 0x0778  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc        C:\Windows\system32\lsass.exe
18:31:26.0906 0x0778  VaultSvc - ok
18:31:26.0922 0x0778  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
18:31:26.0922 0x0778  vdrvroot - ok
18:31:26.0984 0x0778  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
18:31:27.0047 0x0778  vds - ok
18:31:27.0047 0x0778  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
18:31:27.0062 0x0778  vga - ok
18:31:27.0062 0x0778  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
18:31:27.0093 0x0778  VgaSave - ok
18:31:27.0125 0x0778  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
18:31:27.0140 0x0778  vhdmp - ok
18:31:27.0156 0x0778  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
18:31:27.0156 0x0778  viaide - ok
18:31:27.0187 0x0778  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
18:31:27.0203 0x0778  vmbus - ok
18:31:27.0218 0x0778  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
18:31:27.0249 0x0778  VMBusHID - ok
18:31:27.0249 0x0778  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
18:31:27.0265 0x0778  volmgr - ok
18:31:27.0312 0x0778  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
18:31:27.0343 0x0778  volmgrx - ok
18:31:27.0359 0x0778  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
18:31:27.0374 0x0778  volsnap - ok
18:31:27.0390 0x0778  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
18:31:27.0405 0x0778  vsmraid - ok
18:31:27.0499 0x0778  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
18:31:27.0577 0x0778  VSS - ok
18:31:27.0577 0x0778  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
18:31:27.0593 0x0778  vwifibus - ok
18:31:27.0608 0x0778  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
18:31:27.0624 0x0778  vwififlt - ok
18:31:27.0655 0x0778  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
18:31:27.0686 0x0778  W32Time - ok
18:31:27.0702 0x0778  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
18:31:27.0717 0x0778  WacomPen - ok
18:31:27.0733 0x0778  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
18:31:27.0764 0x0778  WANARP - ok
18:31:27.0764 0x0778  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
18:31:27.0795 0x0778  Wanarpv6 - ok
18:31:27.0842 0x0778  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
18:31:27.0905 0x0778  wbengine - ok
18:31:27.0920 0x0778  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
18:31:27.0951 0x0778  WbioSrvc - ok
18:31:27.0967 0x0778  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
18:31:27.0983 0x0778  wcncsvc - ok
18:31:27.0998 0x0778  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
18:31:28.0014 0x0778  WcsPlugInService - ok
18:31:28.0014 0x0778  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
18:31:28.0029 0x0778  Wd - ok
18:31:28.0107 0x0778  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
18:31:28.0139 0x0778  Wdf01000 - ok
18:31:28.0154 0x0778  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
18:31:28.0232 0x0778  WdiServiceHost - ok
18:31:28.0232 0x0778  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
18:31:28.0263 0x0778  WdiSystemHost - ok
18:31:28.0279 0x0778  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
18:31:28.0295 0x0778  WebClient - ok
18:31:28.0310 0x0778  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
18:31:28.0357 0x0778  Wecsvc - ok
18:31:28.0373 0x0778  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
18:31:28.0419 0x0778  wercplsupport - ok
18:31:28.0435 0x0778  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
18:31:28.0466 0x0778  WerSvc - ok
18:31:28.0497 0x0778  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
18:31:28.0529 0x0778  WfpLwf - ok
18:31:28.0529 0x0778  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
18:31:28.0529 0x0778  WIMMount - ok
18:31:28.0560 0x0778  WinDefend - ok
18:31:28.0560 0x0778  WinHttpAutoProxySvc - ok
18:31:28.0607 0x0778  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
18:31:28.0685 0x0778  Winmgmt - ok
18:31:28.0747 0x0778  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll
18:31:28.0841 0x0778  WinRM - ok
18:31:28.0887 0x0778  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUSB          C:\Windows\system32\DRIVERS\WinUSB.sys
18:31:28.0934 0x0778  WinUSB - ok
18:31:29.0012 0x0778  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
18:31:29.0059 0x0778  Wlansvc - ok
18:31:29.0121 0x0778  [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
18:31:29.0153 0x0778  wlcrasvc - ok
18:31:29.0277 0x0778  [ 2BACD71123F42CEA603F4E205E1AE337, 1FEF20554110371D738F462ECFFA999158EFEED02062414C58C1B61C422BF0B9 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
18:31:29.0324 0x0778  wlidsvc - ok
18:31:29.0355 0x0778  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
18:31:29.0371 0x0778  WmiAcpi - ok
18:31:29.0387 0x0778  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
18:31:29.0402 0x0778  wmiApSrv - ok
18:31:29.0402 0x0778  WMPNetworkSvc - ok
18:31:29.0433 0x0778  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
18:31:29.0449 0x0778  WPCSvc - ok
18:31:29.0480 0x0778  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
18:31:29.0511 0x0778  WPDBusEnum - ok
18:31:29.0527 0x0778  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
18:31:29.0605 0x0778  ws2ifsl - ok
18:31:29.0621 0x0778  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\system32\wscsvc.dll
18:31:29.0636 0x0778  wscsvc - ok
18:31:29.0652 0x0778  WSearch - ok
18:31:29.0761 0x0778  [ D9EF901DCA379CFE914E9FA13B73B4C4, 3BE9693B7B2AFEE23D72AF5DA211379724D752F0EC18ACB7D3DE3DDFC5AE0004 ] wuauserv        C:\Windows\system32\wuaueng.dll
18:31:29.0823 0x0778  wuauserv - ok
18:31:29.0855 0x0778  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
18:31:29.0886 0x0778  WudfPf - ok
18:31:29.0901 0x0778  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
18:31:29.0917 0x0778  WUDFRd - ok
18:31:29.0933 0x0778  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
18:31:29.0948 0x0778  wudfsvc - ok
18:31:29.0979 0x0778  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
18:31:30.0026 0x0778  WwanSvc - ok
18:31:30.0089 0x0778  [ 4A5CE13408945E525503B5F73D29B9C5, D58BB31AF17752508EA67931BF170CE46877DC204FC5DA7EED5A078AEB0CA0FD ] xnacc           C:\Windows\system32\DRIVERS\xnacc.sys
18:31:30.0151 0x0778  xnacc - ok
18:31:30.0151 0x0778  ================ Scan global ===============================
18:31:30.0182 0x0778  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
18:31:30.0229 0x0778  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
18:31:30.0245 0x0778  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
18:31:30.0260 0x0778  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
18:31:30.0291 0x0778  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
18:31:30.0291 0x0778  [ Global ] - ok
18:31:30.0291 0x0778  ================ Scan MBR ==================================
18:31:30.0307 0x0778  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
18:31:30.0603 0x0778  \Device\Harddisk0\DR0 - ok
18:31:30.0619 0x0778  ================ Scan VBR ==================================
18:31:30.0619 0x0778  [ AFBD1645A296DC0B37B630F8628F56C1 ] \Device\Harddisk0\DR0\Partition1
18:31:30.0681 0x0778  \Device\Harddisk0\DR0\Partition1 - ok
18:31:30.0681 0x0778  [ 482A8B7674D762703C8FAFE802421322 ] \Device\Harddisk0\DR0\Partition2
18:31:30.0713 0x0778  \Device\Harddisk0\DR0\Partition2 - ok
18:31:30.0728 0x0778  [ 4E546A1C33E9EDFEBE60DEBE13A87607 ] \Device\Harddisk0\DR0\Partition3
18:31:30.0759 0x0778  \Device\Harddisk0\DR0\Partition3 - ok
18:31:30.0759 0x0778  ================ Scan generic autorun ======================
18:31:30.0791 0x0778  [ EBC0E8C0A4DDA2C32A7D5863462A321A, 2F410138DB66D0219254339F1F098E401CEDAA032596F1F67BC54F394256FC68 ] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
18:31:30.0822 0x0778  amd_dc_opt - detected UnsignedFile.Multi.Generic ( 1 )
18:31:30.0822 0x0778  amd_dc_opt ( UnsignedFile.Multi.Generic ) - warning
18:31:33.0302 0x0778  [ 5B6E8E09BE6401A7E022F52FDFCB2FF8, 471C556CF9405BBB380A8CEFE945C126B954B7C94F79CC72441B51F80141FC5E ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
18:31:33.0333 0x0778  SunJavaUpdateSched - ok
18:31:33.0365 0x0778  [ 61E4289E91E88C90478D7F4BEB10DCF7, 1D0F4034E0111CF5758F470C15A22A0A28EB8269CB5BF07222C9C0FB07A15C55 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
18:31:33.0380 0x0778  APSDaemon - ok
18:31:33.0443 0x0778  [ 08E7173D1B74095335052459200CB1EA, 5B6EB8A65B5F451BF6115EB7CD1355E5870E6D764F22D767D13216BF17C5668F ] C:\Program Files (x86)\QuickTime\QTTask.exe
18:31:33.0474 0x0778  QuickTime Task - detected UnsignedFile.Multi.Generic ( 1 )
18:31:33.0474 0x0778  QuickTime Task ( UnsignedFile.Multi.Generic ) - warning
18:31:35.0954 0x0778  [ 048EA4B978851788E9F5E8E4F081DF7A, EB62719AC0DCC18FF056F2CD84438BF14B61E38F0619617C81961C6257BDFCEC ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
18:31:35.0985 0x0778  Adobe ARM - ok
18:31:36.0204 0x0778  [ 5CA0EB9538C6ACEBDC3593FC53527B9D, 35AC60899254C7414FF42BCDA4165FB58F6369BD5EDCAC24EBB1B5A095664CAC ] D:\Programme\AVAST Software\Avast\AvastUI.exe
18:31:36.0297 0x0778  AvastUI.exe - ok
18:31:36.0469 0x0778  [ AFE3883FB37A5567C913E7DFCF2924A5, 3CA38EE302E0FF343DB87AE90DA868DCE5B7B490C2AA32164AF8DD4773482265 ] D:\Programme\DAEMON Tools Lite\DTLite.exe
18:31:36.0563 0x0778  DAEMON Tools Lite - ok
18:31:36.0656 0x0778  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
18:31:36.0719 0x0778  Sidebar - ok
18:31:36.0797 0x0778  [ AFE3883FB37A5567C913E7DFCF2924A5, 3CA38EE302E0FF343DB87AE90DA868DCE5B7B490C2AA32164AF8DD4773482265 ] D:\Programme\DAEMON Tools Lite\DTLite.exe
18:31:36.0875 0x0778  DAEMON Tools Lite - ok
18:31:36.0906 0x0778  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
18:31:36.0937 0x0778  mctadmin - ok
18:31:36.0984 0x0778  Win FW state via NFP2: enabled
18:31:39.0417 0x0778  ============================================================
18:31:39.0417 0x0778  Scan finished
18:31:39.0417 0x0778  ============================================================
18:31:39.0433 0x0dd4  Detected object count: 6
18:31:39.0433 0x0dd4  Actual detected object count: 6
18:32:47.0809 0x0dd4  epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user
18:32:47.0809 0x0dd4  epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:32:47.0824 0x0dd4  EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user
18:32:47.0824 0x0dd4  EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:32:47.0824 0x0dd4  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
18:32:47.0824 0x0dd4  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:32:47.0824 0x0dd4  sptd ( LockedFile.Multi.Generic ) - skipped by user
18:32:47.0824 0x0dd4  sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
18:32:47.0824 0x0dd4  amd_dc_opt ( UnsignedFile.Multi.Generic ) - skipped by user
18:32:47.0824 0x0dd4  amd_dc_opt ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:32:47.0824 0x0dd4  QuickTime Task ( UnsignedFile.Multi.Generic ) - skipped by user
18:32:47.0824 0x0dd4  QuickTime Task ( UnsignedFile.Multi.Generic ) - User select action: Skip 
18:33:15.0470 0x0908  Deinitialize success
         

Das ist sauber Gut.

Dann bitte
Schritt 1
Combofix-Skript

WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

• Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
• Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
• Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
• Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
  
  
  

  Reglock::
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
           

• Speichere dies als CFScript.txt auf deinem Desktop.
• Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
  Danach wieder anstellen nicht vergessen!
• Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
• Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  
  
• Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
• Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
  Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Schritt 2

• Gehe auf den Windowsbutton unten links
• kopiere in das Eingabefeld

  C:\Program Files\AVAST Software\Avast
           

  und drücke Enter
• suche im sich geöffneten Ordner nach AvastSvc.exe
• !rechtsklicke! darauf
• gehe auf Eigenschaften, mache hier einen Linksklick
• schaue im Reiter Sicherheit unter Erweitert (rechts unten anklicken) ob du sämtliche Berechtigungen für diese Datei besitzt und teile mir mit, was dort steht

Es wurde noch etwas gelöscht.


Combofix Logfile:

ComboFix 14-06-16.01 - Sarge 18.06.2014  17:56:06.2.6 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4094.2500 [GMT 2:00]
ausgeführt von:: c:\users\Sarge\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Sarge\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
D:\install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-18 bis 2014-06-18  ))))))))))))))))))))))))))))))
.
.
2014-06-18 16:01 . 2014-06-18 16:01	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-06-13 14:28 . 2014-06-16 16:59	--------	d-----w-	C:\FRST
2014-06-11 18:49 . 2014-06-11 18:49	85328	----a-w-	c:\windows\system32\drivers\aswstm.sys
2014-06-11 18:49 . 2014-06-11 18:49	1039096	----a-w-	c:\windows\system32\drivers\aswsnx.sys
2014-06-11 18:49 . 2014-06-11 18:49	208416	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-06-11 18:49 . 2014-06-11 18:49	423240	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-06-11 18:49 . 2014-06-11 18:49	79184	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-06-11 18:49 . 2014-06-11 18:49	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-06-11 18:49 . 2014-06-11 18:49	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-06-11 18:49 . 2014-06-11 18:49	334648	----a-w-	c:\windows\system32\aswBoot.exe
2014-06-11 18:49 . 2014-06-11 18:49	43152	----a-w-	c:\windows\avastSS.scr
2014-06-11 18:48 . 2014-06-11 18:48	--------	d-----w-	c:\programdata\AVAST Software
2014-06-11 18:20 . 2014-06-11 18:50	--------	d-----w-	c:\users\Sarge\AppData\Roaming\AVAST Software
2014-06-11 18:18 . 2014-06-11 18:49	29208	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-06-11 17:44 . 2014-06-11 19:13	122584	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-11 17:44 . 2014-06-11 17:44	--------	d-----w-	c:\programdata\Malwarebytes
2014-06-11 17:44 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-06-11 17:44 . 2014-05-12 05:26	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-06-11 17:44 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-05-25 14:53 . 2014-06-10 15:40	--------	d-----w-	c:\users\Sarge\AppData\Local\ftblauncher
2014-05-20 17:38 . 2014-05-20 17:38	--------	d-----w-	c:\program files (x86)\AGEIA Technologies
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-13 14:52 . 2011-04-23 13:38	95414520	----a-w-	c:\windows\system32\MRT.exe
2014-05-14 17:00 . 2012-04-02 05:10	692400	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-14 17:00 . 2011-05-19 14:34	70832	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-09 06:14 . 2014-05-14 16:43	477184	----a-w-	c:\windows\system32\aepdu.dll
2014-05-09 06:11 . 2014-05-14 16:43	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-04-14 18:13 . 2014-05-14 16:42	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-12 02:22 . 2014-05-14 16:43	95680	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:22 . 2014-05-14 16:43	155072	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:19 . 2014-05-14 16:43	136192	----a-w-	c:\windows\system32\sspicli.dll
2014-04-12 02:19 . 2014-05-14 16:43	29184	----a-w-	c:\windows\system32\sspisrv.dll
2014-04-12 02:19 . 2014-05-14 16:43	28160	----a-w-	c:\windows\system32\secur32.dll
2014-04-12 02:19 . 2014-05-14 16:43	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-04-12 02:19 . 2014-05-14 16:43	31232	----a-w-	c:\windows\system32\lsass.exe
2014-04-12 02:12 . 2014-05-14 16:43	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-04-12 02:10 . 2014-05-14 16:43	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-03-31 07:35 . 2011-04-20 13:12	270496	------w-	c:\windows\system32\MpSigStub.exe
2014-03-25 02:43 . 2014-05-14 16:43	14175744	----a-w-	c:\windows\system32\shell32.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"AvastUI.exe"="d:\programme\AVAST Software\Avast\AvastUI.exe" [2014-06-11 3890208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 etdrv;etdrv;c:\windows\etdrv.sys;c:\windows\etdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys;c:\windows\GVTDrv64.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-06-11 18:49	290888	----a-w-	d:\programme\AVAST Software\Avast\ashShA64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to MP3 Converter - c:\users\Sarge\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Sarge\AppData\Roaming\Mozilla\Firefox\Profiles\0ryckftv.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Dungeon Keeper II - c:\windows\IsUn0407.exe
AddRemove-Might and Magic® VI - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,38,12,05,e2,ce,
   9b,5d,cd,68,0d,d4,09,57,15,ce,b1,b6,9d
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-1610289843-898006340-3999519046-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1610289843-898006340-3999519046-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-1610289843-898006340-3999519046-1000\Software\SecuROM\License information*]
"datasecu"=hex:35,b7,b4,56,9e,3e,7c,aa,db,36,83,27,5e,72,5c,82,6e,66,f7,01,f3,
   74,e4,01,01,59,a4,3b,44,93,40,dd,f3,4b,b0,b2,e5,dd,8d,23,2c,cb,0f,ca,02,ab,\
"rkeysecu"=hex:e5,fd,ff,8b,df,e9,e9,fe,31,2f,a4,68,66,7c,36,85
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Zeit der Fertigstellung: 2014-06-18  18:02:56
ComboFix-quarantined-files.txt  2014-06-18 16:02
ComboFix2.txt  2014-06-16 16:47
.
Vor Suchlauf: 9.576.677.376 Bytes frei
Nach Suchlauf: 9.484.034.048 Bytes frei
.
- - End Of File - - 6754C267207EA708DC12E5916E502687
A36C5E4F47E84449FF07ED3517B43A31
         

Für die AvastSvc.exe habe ich Vollzugriff.

/edit: Kleine Zwischenfrage: Gemäß der Logfile habe ich knapp 100MB "verloren". Sind das Daten, die in Quarantäne verbannt wurden, oder wie erklärt sich das? Beim ersten Lauf waren es auch knapp 60MB...
Oder sagt diese Zeile etwas vollkommen anderes aus? Weil von "frei" kann man nicht wirklich sprechen, da dieser knappe 1TB alles ist, was meine Platte hergibt - und davon ist der meiste Teil belegt.

Hallo ekeks,

/edit: Kleine Zwischenfrage: Gemäß der Logfile habe ich knapp 100MB "verloren". Sind das Daten, die in Quarantäne verbannt wurden, oder wie erklärt sich das? Beim ersten Lauf waren es auch knapp 60MB...

Ja auch. Es kommt natürlich auch immer darauf an, was das System in der Zwischenzeit macht.

Kannst du dich noch erinnern, was du zu dem Zeitpunkt am PC gemacht hast, als das Antivirenprogramm nicht mehr funktionierte?

Hattest du, als du Avira deinstalliert hast, auch das removal Tool verwendet. Lass das nochmal laufen und deinstalliere auch Avast nochmal komplett und installiere es dann nochmal.

Schritt 1
Avira Registry Cleaner

Schritt 2
Deinstalliere Avast und benutze dafür das
Avast! uninstall-utility
Hier ist wichtig, dass du das Tool im abgesicherten Modus verwendest!

Schritt 3
Installiere danach Avast neu und berichte mir.

Zitat von Bootsektor

Kannst du dich noch erinnern, was du zu dem Zeitpunkt am PC gemacht hast, als das Antivirenprogramm nicht mehr funktionierte?

Nein, der letzte Benutzer, der an dem Rechner war, bevor mir das aufgefallen ist, war meine Freundin. Die sagte, dass einzige, was sie gemacht habe, sei der Versuch "Herr der Ringe Online" zu laden - das habe jedoch nicht funktioniert. Sie sagte, sie habe dazu die offizielle Seite von HdRO verwendet.

Mir selbst ist das dann direkt nach dem nächsten Boot aufgefallen, weil sich da sofort das Windows Sicherheitscenter gemeldet hatte.

Zitat von Bootsektor

Hattest du, als du Avira deinstalliert hast, auch das removal Tool verwendet. Lass das nochmal laufen und deinstalliere auch Avast nochmal komplett und installiere es dann nochmal.

Done.

Zitat von Bootsektor

Installiere danach Avast neu und berichte mir.

Gleiche Symptome, wie vorher
Weder Echtzeitschutz, noch Suchlauf lassen sich ausführen...

Auch der Dienst lässt sich nach wie vor nicht über den Taskmanager starten

Das ist mysteriös, ich sehe in den Logs absolut nichts, wieso die AVs nicht funktionieren sollten.

Ich schau nochmal nach den Abhängigkeiten

Schritt 1

• Gehe auf den Windowsbutton unten links
• kopiere in das Eingabefeld

  C:\Program Files\AVAST Software\Avast
           

  und drücke Enter
• suche im sich geöffneten Ordner nach AvastSvc.exe
• !rechtsklicke! darauf
• gehe auf Eigenschaften, mache hier einen Linksklick
• schaue im Reiter Abhängigkeiten ob dort eine Konfliktmeldung besteht

Schritt 2
Falls das nicht der Fall sein sollte, lege bitte ein neues Benutzerkonto mit Adminrechten auf dem PC an und installiere dort Avast (nachdem du es vorher von deinem Konto mit dem uninstall-utility entfernt hast.)

Es läuft wieder!

Aber das Problem war ein anderes. Ich hatte in meinem Eingangspost ja erwähnt, dass es Probleme mit dem Ordner "Programme" gab (und teilweise noch gibt).

Ich installiere alle meine Programme, die keine Spiele sind, auf D:\Programme (Spiele landen auf D:\Spiele). Das ist eine Angewohnheit, die ich noch aus Win95-Zeiten beibehalten habe. Also eine Systempartition, auf der nur Windows läuft, sowie alle Dinge, die unbedingt auf die Systempartition müssen. Alles andere landet auf einer anderen Partition. Dass das bei Windows 7 nicht mehr unbedingt notwendig und auch teilweise nicht zweckmäßig ist, habe ich erst später festgestellt....
Wie dem auch sei. Aus Gründen, die ich immer noch nicht ganz begreife, habe ich scheinbar keine volle Kontrolle mehr über D:\Programme und dessen Unterverzeichnisse. Ich habe nun Avast einfach mal woanders installiert und siehe da: Es läuft!
(Dass ich da nicht eher drauf gekommen bin... )

Der nun endlich durchgeführte Schnellscan von Avast hat keine Treffer gemeldet, einen Komplettscan mache ich später auch noch.

Ich möchte mich auf jeden Fall für deine Hilfe bedanken, so konnten immerhin ein paar unerwünschte Dinge entfernt werden und scheinbar ist mein System nun sauber. Dafür:

Irgendwelche Ideen, warum ich scheinbar keinen Vollzugriff mehr auf besagten Ordner habe, obwohl Windows mir sagt, ich habe Vollzugriff?

Nochmals: Vielen, vielen Dank für deine Mühe