Win7-64 Rechner läuft einmal wöchentlich extrem verlangsamt und hängt sich auf

werjo · 19.07.2014, 11:35

Mein Rechner hängt sich seit mehreren Wochen im Abstand von ca. 7 Tagen auf. Programme z.B. Excel lassen sich aus der Schnellstartleiste öffnen, hängen sich nach einer Weile aber auf. Mit Verzögerung kann ich Sie schließen und wieder öffnen.
Über den Startbutton kann ich keine Programme aufrufen, auch nicht die Systemsteuerung. Der Taskmanager öffnet sich, aber beim Klick auf "Prozesse aller Benutzer" bleibt der Rechner ganz hängen. Durch Klick auf den Power-Taster des Rechner erscheint der Abmeldeschirm, er fährt aber nicht herunter. Nach dem Neustart passiert das gleiche. Das Problem ist nun mehrmals aufgetaucht und immer am Folgetag wieder verschwunden.
Mit Avira Pro habe ich vor ca. 14 Tagen mehrer Viren gefunden und gelöscht. Gefunden wurde:
'TR/Crypt.XPACK.Gen3' [trojan]
'TR/Crypt.XPACK.Gen2' [trojan]
'HTML/ExpKit.Gen3' [virus]
'TR/Crypt.XPACK.Gen' [trojan]
Leider habe ich den Logfile nicht mehr.
Das Problem ist aber danach erneut zweimal (letzten Samstag und gestern) aufgetreten, obwohl aviira nichts mehr findet. Malwarebytes findet auch nichts.

Hier die gewünschten Logfiles:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-07-2014 01
Ran by ***** (administrator) on JOH3 on 19-07-2014 10:26:43
Running from C:\Users\*****\Downloads\Virensoftware
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(XIMETA, Inc.) C:\Program Files\NDAS\System\ndassvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(XIMETA, Inc.) C:\Program Files\NDAS\System\ndasmgmt.exe
(Qualcomm Incorporated) C:\Program Files (x86)\Eudora\eudora.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [189520 2014-07-07] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1404765255-3134804277-747363654-1000\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1404765255-3134804277-747363654-1000\...\MountPoints2: E - E:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NDAS Geräte-Manager.lnk
ShortcutTarget: NDAS Geräte-Manager.lnk -> C:\Program Files\NDAS\System\ndasmgmt.exe (XIMETA, Inc.)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eudora.exe - Verknüpfung.lnk
ShortcutTarget: eudora.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Eudora\eudora.exe (Qualcomm Incorporated)
ShellIconOverlayIdentifiers: AcronisSyncError -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} =>  No File
ShellIconOverlayIdentifiers: AcronisSyncInProgress -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} =>  No File
ShellIconOverlayIdentifiers: AcronisSyncOk -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} =>  No File
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x40D36F41BC3ACF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\09661llj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [812624 2014-07-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1030224 2014-07-10] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-07] (Avira Operations GmbH & Co. KG)
R2 ndassvc; C:\Program Files\NDAS\System\ndassvc.exe [331752 2010-01-13] (XIMETA, Inc.)

==================== Drivers (Whitelisted) ====================

R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-10] (Avira Operations GmbH & Co. KG)
R0 lfsfilt; C:\Windows\System32\DRIVERS\lfsfilt.sys [738792 2010-01-13] (XIMETA, Inc.)
R0 lpx; C:\Windows\System32\DRIVERS\lpx6x.sys [151528 2010-01-13] (XIMETA, Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 ndasbus; C:\Windows\System32\DRIVERS\ndasbus.sys [497640 2010-01-13] (XIMETA, Inc.)
R1 ndasfat; C:\Windows\System32\DRIVERS\ndasfat.sys [607720 2010-01-13] (Windows (R) Codename Longhorn DDK provider)
R0 ndasfs; C:\Windows\System32\DRIVERS\ndasfs.sys [746472 2010-01-13] (XIMETA, Inc.)
R1 ndasrofs; C:\Windows\System32\DRIVERS\ndasrofs.sys [1053160 2010-01-13] (XIMETA, Inc.)
R3 ndasscsi; C:\Windows\System32\DRIVERS\ndasscsi.sys [486888 2010-01-13] (XIMETA, Inc.)
R0 nvamacpi; C:\Windows\System32\DRIVERS\NVAMACPI.sys [28192 2009-06-05] (NVIDIA Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-05-31] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-05-31] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-05-31] (Acronis International GmbH)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-19 10:26 - 2014-07-19 10:26 - 00000000 ____D () C:\FRST
2014-07-19 10:22 - 2014-07-19 10:26 - 00000000 ____D () C:\Users\*****\Downloads\Virensoftware
2014-07-19 10:20 - 2014-07-19 10:20 - 00000478 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-07-19 10:20 - 2014-07-19 10:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-07-18 21:45 - 2014-07-19 09:55 - 00015332 _____ () C:\Windows\WindowsUpdate.log
2014-07-18 21:45 - 2014-07-19 09:51 - 00001462 _____ () C:\Windows\PFRO.log
2014-07-18 21:45 - 2014-07-19 09:51 - 00000112 _____ () C:\Windows\setupact.log
2014-07-18 21:45 - 2014-07-18 21:45 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-18 21:36 - 2014-07-18 21:36 - 00000826 _____ () C:\Users\*****\Desktop\cc_20140718_213629.reg
2014-07-16 21:05 - 2014-07-18 19:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-16 21:04 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-16 21:04 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-16 21:03 - 2014-07-16 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-11 17:50 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-11 17:50 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-11 17:50 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 17:50 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-11 17:50 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 17:50 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-11 17:50 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-11 17:50 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 17:50 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-11 17:50 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-11 17:50 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-11 17:50 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-11 17:50 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 17:50 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-11 17:50 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-11 17:50 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 17:50 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-11 17:50 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-11 17:50 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-11 17:50 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-11 17:50 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-11 17:50 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 17:50 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-11 17:50 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-11 17:50 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-11 17:50 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 17:50 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-11 17:50 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-11 17:50 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-11 17:50 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-11 17:50 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-11 17:50 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-11 17:50 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-11 17:50 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-11 17:50 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-11 17:50 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 17:50 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-11 17:50 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-11 17:50 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-11 17:50 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-11 17:50 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 17:50 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-11 17:50 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-11 17:50 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-11 17:49 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 17:49 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 17:49 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-11 17:49 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 17:49 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-11 17:49 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-11 17:49 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-11 17:49 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 17:49 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 17:49 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-11 17:49 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 17:49 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-11 17:49 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-11 17:49 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-11 17:49 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 17:49 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 17:49 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-11 17:49 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-11 17:49 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-11 17:49 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-11 17:49 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 17:49 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-07-11 17:49 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-07-09 16:41 - 2014-07-09 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-08 18:06 - 2014-07-08 18:06 - 00000000 ____D () C:\Windows\pss
2014-07-08 12:35 - 2014-07-08 12:35 - 00002778 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 10:42 - 2014-07-08 12:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 10:42 - 2014-07-08 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-07 12:39 - 2014-06-24 20:47 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2014-07-07 12:39 - 2014-06-24 20:47 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2014-07-02 19:32 - 2014-07-02 20:35 - 01350074 _____ () C:\Users\*****\Documents\Fledermäuse.pptx
2014-06-20 11:31 - 2014-06-20 11:31 - 01457351 _____ () C:\Users\*****\Documents\74
2014-06-20 10:09 - 2013-05-10 07:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-06-20 10:09 - 2013-05-10 07:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-06-20 10:09 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-06-20 10:09 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-06-20 10:02 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-06-20 10:02 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-06-20 10:02 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-06-20 10:02 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-06-20 10:02 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-06-20 10:02 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-06-20 10:02 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-06-20 10:02 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-06-20 10:02 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-06-20 10:02 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-06-20 10:02 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-06-20 10:02 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-06-20 10:02 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-06-20 10:02 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-06-20 10:02 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-06-20 10:02 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-06-20 10:02 - 2013-10-01 22:57 - 06578176 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-06-20 10:02 - 2013-10-01 22:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-06-20 09:55 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-06-20 09:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-06-20 09:55 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2014-06-20 09:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-06-20 09:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-06-20 09:53 - 2012-07-26 05:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-06-20 09:53 - 2012-07-26 05:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-06-20 09:53 - 2012-07-26 05:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-06-20 09:53 - 2012-07-26 05:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-06-20 09:53 - 2012-07-26 05:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-06-20 09:53 - 2012-07-26 04:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-06-20 09:53 - 2012-07-26 04:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-06-20 09:53 - 2012-06-02 16:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-06-20 09:47 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-20 09:47 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-20 09:47 - 2012-12-07 12:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2014-06-20 09:46 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-20 09:46 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-20 09:46 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-06-20 09:46 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-06-20 09:46 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-06-20 09:46 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-06-20 09:46 - 2013-12-04 04:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-06-20 09:46 - 2013-12-04 04:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-06-20 09:46 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-06-20 09:46 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-06-20 09:46 - 2013-12-04 04:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-06-20 09:46 - 2013-12-04 04:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-06-20 09:46 - 2013-12-04 04:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-06-20 09:46 - 2013-12-04 04:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-06-20 09:46 - 2013-12-04 04:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-06-20 09:46 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-06-20 09:46 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-06-20 09:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-06-20 09:46 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-06-20 09:46 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-06-20 09:46 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-06-20 09:46 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-06-20 09:46 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-06-20 09:46 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-06-20 09:46 - 2013-11-26 13:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-06-20 09:46 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-06-20 09:46 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-06-20 09:46 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-06-20 09:46 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-06-20 09:46 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-06-20 09:46 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-06-20 09:46 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-06-20 09:46 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-06-20 09:46 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2014-06-20 09:46 - 2013-03-19 07:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2014-06-20 09:46 - 2012-12-07 15:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2014-06-20 09:46 - 2012-12-07 15:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2014-06-20 09:46 - 2012-12-07 14:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2014-06-20 09:46 - 2012-12-07 14:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2014-06-20 09:46 - 2012-12-07 13:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2014-06-20 09:46 - 2012-12-07 13:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2014-06-20 09:46 - 2012-12-07 13:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2014-06-20 09:46 - 2012-12-07 13:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2014-06-20 09:46 - 2012-12-07 13:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2014-06-20 09:46 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2014-06-20 09:46 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2014-06-20 09:46 - 2012-12-07 13:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2014-06-20 09:46 - 2012-12-07 13:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2014-06-20 09:46 - 2012-12-07 13:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2014-06-20 09:46 - 2012-12-07 13:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2014-06-20 09:46 - 2012-12-07 13:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2014-06-20 09:46 - 2012-12-07 13:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2014-06-20 09:46 - 2012-12-07 13:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2014-06-20 09:46 - 2012-12-07 12:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2014-06-20 09:46 - 2012-10-09 20:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2014-06-20 09:46 - 2012-10-09 20:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2014-06-20 09:46 - 2012-10-09 19:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2014-06-20 09:46 - 2012-10-09 19:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2014-06-20 09:46 - 2012-10-03 19:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2014-06-20 09:46 - 2012-10-03 19:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2014-06-20 09:46 - 2012-10-03 19:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2014-06-20 09:46 - 2012-10-03 19:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2014-06-20 09:46 - 2012-10-03 19:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2014-06-20 09:46 - 2012-10-03 19:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-06-20 09:46 - 2012-10-03 18:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2014-06-20 09:46 - 2012-10-03 18:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2014-06-20 09:46 - 2012-10-03 18:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2014-06-20 09:46 - 2012-10-03 18:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-06-20 09:46 - 2012-08-22 20:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-06-20 09:46 - 2012-08-21 23:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2014-06-20 09:46 - 2012-07-04 22:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2014-06-20 09:46 - 2012-05-05 10:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2014-06-20 09:46 - 2012-05-05 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2014-06-20 09:46 - 2012-04-07 14:31 - 03216384 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-06-20 09:46 - 2012-04-07 13:26 - 02342400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-06-20 09:46 - 2012-01-13 09:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2014-06-20 09:46 - 2012-01-04 12:44 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2014-06-20 09:46 - 2012-01-04 10:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2014-06-20 09:46 - 2011-05-04 07:25 - 02315776 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2014-06-20 09:46 - 2011-05-04 07:22 - 02223616 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2014-06-20 09:46 - 2011-05-04 07:22 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2014-06-20 09:46 - 2011-05-04 07:22 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2014-06-20 09:46 - 2011-05-04 07:22 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2014-06-20 09:46 - 2011-05-04 07:22 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2014-06-20 09:46 - 2011-05-04 07:19 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2014-06-20 09:46 - 2011-05-04 07:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2014-06-20 09:46 - 2011-05-04 07:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2014-06-20 09:46 - 2011-05-04 06:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2014-06-20 09:46 - 2011-05-04 06:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2014-06-20 09:46 - 2011-05-04 06:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2014-06-20 09:46 - 2011-05-04 06:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2014-06-20 09:46 - 2011-05-04 06:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2014-06-20 09:46 - 2011-05-04 06:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2014-06-20 09:46 - 2011-05-04 06:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2014-06-20 09:46 - 2011-05-04 06:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2014-06-20 09:46 - 2011-05-04 06:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2014-06-20 09:46 - 2011-03-11 08:41 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2014-06-20 09:46 - 2011-03-11 08:41 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2014-06-20 09:46 - 2011-03-11 08:41 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2014-06-20 09:46 - 2011-03-11 08:41 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2014-06-20 09:46 - 2011-03-11 08:41 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2014-06-20 09:46 - 2011-03-11 08:33 - 02565632 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2014-06-20 09:46 - 2011-03-11 08:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2014-06-20 09:46 - 2011-03-11 07:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2014-06-20 09:46 - 2011-03-11 07:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
2014-06-20 09:46 - 2011-03-11 06:37 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-06-20 09:45 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-20 09:45 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-20 09:45 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-20 09:45 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-20 09:45 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-20 09:45 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-20 09:45 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-20 09:45 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-20 09:45 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-06-20 09:45 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-06-20 09:45 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-06-20 09:45 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-06-20 09:45 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-06-20 09:45 - 2013-10-04 04:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-06-20 09:45 - 2013-10-04 04:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-06-20 09:45 - 2013-10-04 04:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-06-20 09:45 - 2013-10-04 03:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2014-06-20 09:45 - 2013-10-04 03:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-06-20 09:45 - 2013-10-04 03:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2014-06-20 09:45 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2014-06-20 09:45 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-06-20 09:45 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-06-20 09:45 - 2012-05-01 07:40 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2014-06-20 09:45 - 2011-06-16 07:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2014-06-20 09:45 - 2011-06-16 06:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xmllite.dll
2014-06-20 09:45 - 2011-02-18 12:51 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe
2014-06-20 09:45 - 2011-02-18 07:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
2014-06-20 09:44 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-06-20 09:44 - 2014-01-01 01:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-06-20 09:44 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-06-20 09:44 - 2013-11-23 19:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-06-20 09:44 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2014-06-20 09:44 - 2013-01-24 08:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2014-06-20 09:44 - 2011-12-30 08:26 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2014-06-20 09:44 - 2011-12-30 07:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2014-06-20 09:43 - 2013-10-30 04:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-06-20 09:43 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll

==================== One Month Modified Files and Folders =======

2014-07-19 10:26 - 2014-07-19 10:26 - 00000000 ____D () C:\FRST
2014-07-19 10:26 - 2014-07-19 10:22 - 00000000 ____D () C:\Users\*****\Downloads\Virensoftware
2014-07-19 10:20 - 2014-07-19 10:20 - 00000478 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-07-19 10:20 - 2014-07-19 10:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-07-19 10:20 - 2014-03-02 14:24 - 00000000 ____D () C:\Users\*****
2014-07-19 09:58 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-19 09:58 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-19 09:55 - 2014-07-18 21:45 - 00015332 _____ () C:\Windows\WindowsUpdate.log
2014-07-19 09:55 - 2011-04-12 09:43 - 00888138 _____ () C:\Windows\system32\perfh007.dat
2014-07-19 09:55 - 2011-04-12 09:43 - 00207966 _____ () C:\Windows\system32\perfc007.dat
2014-07-19 09:55 - 2009-07-14 07:13 - 00006224 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-19 09:51 - 2014-07-18 21:45 - 00001462 _____ () C:\Windows\PFRO.log
2014-07-19 09:51 - 2014-07-18 21:45 - 00000112 _____ () C:\Windows\setupact.log
2014-07-19 09:51 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-18 21:45 - 2014-07-18 21:45 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-18 21:36 - 2014-07-18 21:36 - 00000826 _____ () C:\Users\*****\Desktop\cc_20140718_213629.reg
2014-07-18 19:56 - 2014-07-16 21:05 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-17 22:19 - 2014-03-16 17:51 - 00000000 ___RD () C:\Users\*****\Documents\Dropbox
2014-07-17 17:35 - 2014-05-16 06:57 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DropboxMaster
2014-07-17 17:35 - 2014-03-15 02:18 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-16 21:03 - 2014-07-16 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-16 19:31 - 2011-10-31 19:42 - 00002336 ____H () C:\Users\*****\Documents\Default.rdp
2014-07-15 17:58 - 2014-04-16 18:06 - 00108048 _____ () C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-15 17:58 - 2014-04-16 18:06 - 00108048 _____ () C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-15 17:58 - 2014-03-14 22:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-07-15 17:58 - 2014-03-14 22:03 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-07-15 17:58 - 2014-03-14 21:59 - 00000000 ____D () C:\ProgramData\Package Cache
2014-07-14 20:52 - 2014-03-16 17:51 - 00000000 ____D () C:\Users\*****\Documents\Briefkasten *****
2014-07-12 16:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-11 22:40 - 2014-03-15 03:53 - 00000000 ____D () C:\KonrexSpTmp
2014-07-11 17:57 - 2009-07-14 06:45 - 00415856 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 17:53 - 2014-03-14 22:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 17:52 - 2014-03-14 22:32 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-11 17:51 - 2014-03-15 00:33 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-10 13:04 - 2014-03-14 22:07 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-09 22:51 - 2014-04-01 18:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-09 16:41 - 2014-07-09 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-08 18:06 - 2014-07-08 18:06 - 00000000 ____D () C:\Windows\pss
2014-07-08 12:55 - 2014-03-16 18:20 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-07-08 12:55 - 2014-03-16 18:10 - 00000000 ____D () C:\Users\*****\AppData\Local\MigWiz
2014-07-08 12:55 - 2014-03-02 13:07 - 00000000 ____D () C:\Windows\Panther
2014-07-08 12:35 - 2014-07-08 12:35 - 00002778 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 12:35 - 2014-07-08 10:42 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 10:45 - 2014-03-17 22:27 - 00000000 ____D () C:\Windows\Minidump
2014-07-08 10:42 - 2014-07-08 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-07 16:48 - 2014-03-15 02:33 - 00000000 ____D () C:\Program Files (x86)\Eudora
2014-07-07 12:39 - 2014-03-14 22:03 - 00000000 ____D () C:\ProgramData\Avira
2014-07-03 19:27 - 2014-05-30 15:40 - 00000000 ____D () C:\Users\*****\Documents\LUCA
2014-07-03 16:51 - 2014-03-14 22:07 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-07-02 20:35 - 2014-07-02 19:32 - 01350074 _____ () C:\Users\*****\Documents\Fledermäuse.pptx
2014-07-01 22:35 - 2014-03-16 17:53 - 00000000 ____D () C:\Users\*****\Documents\Finanzen
2014-06-30 20:22 - 2014-03-16 17:51 - 00000000 ____D () C:\Users\*****\Documents\***** Siedlung Banking
2014-06-25 22:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-06-24 20:47 - 2014-07-07 12:39 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2014-06-24 20:47 - 2014-07-07 12:39 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2014-06-24 20:47 - 2014-03-14 22:07 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-24 20:47 - 2014-03-14 22:07 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-06-21 13:33 - 2010-12-04 23:50 - 00108048 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-21 13:32 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-06-20 22:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-06-20 22:14 - 2014-07-11 17:50 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-06-20 21:39 - 2014-07-11 17:50 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-06-20 11:31 - 2014-06-20 11:31 - 01457351 _____ () C:\Users\*****\Documents\74
2014-06-19 03:39 - 2014-07-11 17:49 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-19 03:06 - 2014-07-11 17:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-19 03:06 - 2014-07-11 17:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-19 02:48 - 2014-07-11 17:50 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-19 02:42 - 2014-07-11 17:50 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-19 02:42 - 2014-07-11 17:49 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-19 02:41 - 2014-07-11 17:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-19 02:41 - 2014-07-11 17:49 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-06-19 02:32 - 2014-07-11 17:50 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-19 02:31 - 2014-07-11 17:50 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-19 02:26 - 2014-07-11 17:50 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-19 02:24 - 2014-07-11 17:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-19 02:24 - 2014-07-11 17:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-19 02:23 - 2014-07-11 17:49 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-19 02:16 - 2014-07-11 17:50 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-19 02:14 - 2014-07-11 17:49 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-19 02:09 - 2014-07-11 17:50 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-19 01:59 - 2014-07-11 17:50 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-19 01:56 - 2014-07-11 17:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-19 01:53 - 2014-07-11 17:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-19 01:51 - 2014-07-11 17:49 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-19 01:50 - 2014-07-11 17:49 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-19 01:48 - 2014-07-11 17:50 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-19 01:39 - 2014-07-11 17:50 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-19 01:38 - 2014-07-11 17:50 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-19 01:37 - 2014-07-11 17:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-19 01:36 - 2014-07-11 17:50 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-19 01:35 - 2014-07-11 17:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-06-19 01:33 - 2014-07-11 17:50 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-19 01:32 - 2014-07-11 17:50 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-19 01:28 - 2014-07-11 17:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-19 01:28 - 2014-07-11 17:50 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-19 01:27 - 2014-07-11 17:50 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-19 01:27 - 2014-07-11 17:49 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-19 01:25 - 2014-07-11 17:50 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-19 01:23 - 2014-07-11 17:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-19 01:22 - 2014-07-11 17:50 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-19 01:12 - 2014-07-11 17:50 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-19 01:06 - 2014-07-11 17:50 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-19 01:01 - 2014-07-11 17:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-19 00:59 - 2014-07-11 17:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-19 00:58 - 2014-07-11 17:50 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-19 00:58 - 2014-07-11 17:49 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-19 00:52 - 2014-07-11 17:50 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-19 00:51 - 2014-07-11 17:50 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-19 00:49 - 2014-07-11 17:50 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-19 00:46 - 2014-07-11 17:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-19 00:45 - 2014-07-11 17:50 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-19 00:35 - 2014-07-11 17:50 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-19 00:34 - 2014-07-11 17:50 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-19 00:15 - 2014-07-11 17:49 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-19 00:13 - 2014-07-11 17:50 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-19 00:09 - 2014-07-11 17:50 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-19 00:07 - 2014-07-11 17:50 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptgsseo.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-09 20:57

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-07-2014 01
Ran by ***** at 2014-07-19 10:27:21
Running from C:\Users\*****\Downloads\Virensoftware
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Avira (HKLM-x32\...\{142be4a8-895b-4ed9-b1ff-11c76357e3df}) (Version: 1.1.17.31000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.17.31000 - Avira Operations GmbH & Co. KG) Hidden
Avira Professional Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.464 - Avira)
AxCrypt (Nur Entfernen) (HKLM-x32\...\AxCrypt) (Version:  - Axon Data)
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
EAGLE 6.5.0 (HKLM-x32\...\EAGLE 6.5.0) (Version: 6.5.0 - CadSoft Computer GmbH)
Eudora OSE (1.0) (HKLM-x32\...\Eudora OSE (1.0)) (Version: 1.0 (en-US) - Mozilla)
HP Officejet Pro 8600 - Grundlegende Software für das Gerät (HKLM\...\{D2D05FDB-4EDA-462D-8DB6-E0B9AD4FA25F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Konrex Stundenplanung 4.0 (HKLM-x32\...\Konrex Stundenplanung_is1) (Version:  - karoplan KG)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2000 Professional (HKLM-x32\...\{00010407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mp3tag v2.58 (HKLM-x32\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
NDAS-Software 3.72.2080 (HKLM\...\{D06E205A-1BF7-48D5-BD7F-E072D0FD6A67}) (Version: 3.72.2080 - XIMETA, Inc.)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.145.1024 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 335.23 (Version: 335.23 - NVIDIA Corporation) Hidden
PDF Editor 2 (HKLM-x32\...\PDF Editor 2) (Version:  - )
PDF24 Creator 6.4.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PureSync (x32 Version: 2.7.4 - Jumping Bytes) Hidden
PureSync 2.7.4 (HKLM-x32\...\PureSync) (Version: 2.7.4 - Jumping Bytes)
Samsung Data Migration (HKLM-x32\...\{D4DE3DB4-7734-47E5-8D92-B80146311406}) (Version: 2.6 - Samsung)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.3.0 - Samsung Electronics)
SEPA Account Converter (HKLM-x32\...\{1C3147A7-4810-45FC-AD89-064D8023A514}) (Version: 1.21.0 - Star Finanz GmbH)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SteuerSparErklärung 2014 (HKLM-x32\...\{A463EB06-22A6-47F5-9593-E52B291EF13E}) (Version: 19.11.90 - Akademische Arbeitsgemeinschaft)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

==================== Restore Points  =========================

15-06-2014 17:00:16 Windows-Sicherung
20-06-2014 07:47:50 Windows Update
22-06-2014 09:40:33 Windows Update
22-06-2014 17:00:20 Windows-Sicherung
25-06-2014 20:24:45 Windows-Sicherung
29-06-2014 17:00:20 Windows-Sicherung
08-07-2014 10:39:29 Windows Update
11-07-2014 15:50:12 Windows Update
12-07-2014 22:25:40 Windows-Sicherung
13-07-2014 17:30:25 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0562EA81-EFE2-4CC4-80F5-C07482518206} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {26DC7364-BF03-4043-92F5-4E1D04B32518} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
Task: {6798B873-DD22-4C42-88E3-7ECC1992BA68} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.00.97\AsLoader.exe [2009-08-20] (ASUSTeK Computer Inc.)
Task: {9BD05E6C-36C2-494D-B00B-BAD9A9BC9EBC} - System32\Tasks\HP AR Program Upload - 58354d9b4b43412da8fc91fc5185a6842d3b1150ae5c43a0a1f250175413f367 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)

==================== Loaded Modules (whitelisted) =============

2014-06-05 19:22 - 2014-03-04 15:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2010-01-13 15:40 - 2010-01-13 15:40 - 00248832 _____ () C:\Program Files\NDAS\System\ndasmgmt.deu.dll
2014-07-07 13:53 - 2014-07-07 13:53 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-07 13:52 - 2014-07-07 13:52 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-03-15 02:33 - 2010-07-23 06:51 - 00155648 _____ () C:\Program Files (x86)\Eudora\NSLDAP32V60.dll
2014-03-15 02:33 - 2010-07-23 06:51 - 00014848 _____ () C:\Program Files (x86)\Eudora\NSLDAPPR32V60.dll
2014-07-18 21:45 - 2014-07-07 13:53 - 00049744 _____ () C:\Users\*****\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-02-04 18:25 - 2014-02-04 18:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-02-04 18:28 - 2014-02-04 18:28 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2014-07-09 16:41 - 2014-07-09 16:41 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe

==================== Faulty Device Manager Devices =============

Name: HP ScanJet 2100C
Description: HP ScanJet 2100C
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/19/2014 09:55:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (07/19/2014 09:55:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (07/19/2014 09:55:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (07/19/2014 09:51:56 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (07/19/2014 09:51:56 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (07/18/2014 09:49:33 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst MMCSS erreicht.

Error: (07/18/2014 09:49:14 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Acronis Scheduler2 Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (07/18/2014 09:49:03 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (07/18/2014 09:48:33 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (07/18/2014 09:48:03 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst LanmanServer erreicht.

Error: (07/18/2014 09:47:33 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (07/18/2014 09:47:03 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst LanmanServer erreicht.

Error: (07/18/2014 09:46:27 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.


Microsoft Office Sessions:
=========================
Error: (07/19/2014 09:55:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (07/19/2014 09:55:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (07/19/2014 09:55:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (07/19/2014 09:51:56 AM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt


CodeIntegrity Errors:
===================================
  Date: 2014-07-19 10:15:28.840
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-19 10:01:00.525
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-19 09:51:49.615
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-19 09:51:24.997
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-19 09:51:19.858
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-18 21:48:39.036
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-18 21:47:27.822
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-18 21:47:27.247
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-18 21:47:26.261
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-07-18 21:46:01.707
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\nvapo64v.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 37%
Total physical RAM: 3967.24 MB
Available physical RAM: 2462.96 MB
Total Pagefile: 7932.66 MB
Available Pagefile: 6218.13 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:209.5 GB) (Free:133.16 GB) NTFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Fixed) (Total:465.66 GB) (Free:283.27 GB) NTFS
Drive j: (Netz_J) (Fixed) (Total:1763 GB) (Free:105.56 GB) NTFS
Drive m: (Netz_M) (Fixed) (Total:50.01 GB) (Free:5.89 GB) NTFS
Drive u: (Netz_U) (Fixed) (Total:50.01 GB) (Free:32.95 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E5E35EAC)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 233 GB) (Disk ID: 3611F8C1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=209 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 5AF29474)
Partition 1: (Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=-306016189952) - (Type=07 NTFS)

==================== End Of Log ============================

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:20 on 19/07/2014 (*****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Schon mal Danke für eure Hilfe!
Jo.

schrauber · 19.07.2014, 19:49

hi,

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

werjo · 20.07.2014, 10:24

Der TDSSKiller hat nicht gefunden.

Code:

ATTFilter

10:55:58.0886 0x1130  TDSS rootkit removing tool 3.0.0.40 Jul 10 2014 12:37:58
10:57:30.0262 0x1130  ============================================================
10:57:30.0262 0x1130  Current date / time: 2014/07/20 10:57:30.0262
10:57:30.0262 0x1130  SystemInfo:
10:57:30.0262 0x1130  
10:57:30.0262 0x1130  OS Version: 6.1.7601 ServicePack: 1.0
10:57:30.0262 0x1130  Product type: Workstation
10:57:30.0262 0x1130  ComputerName: JOH3
10:57:30.0262 0x1130  UserName: *****
10:57:30.0262 0x1130  Windows directory: C:\Windows
10:57:30.0262 0x1130  System windows directory: C:\Windows
10:57:30.0262 0x1130  Running under WOW64
10:57:30.0262 0x1130  Processor architecture: Intel x64
10:57:30.0262 0x1130  Number of processors: 2
10:57:30.0262 0x1130  Page size: 0x1000
10:57:30.0262 0x1130  Boot type: Normal boot
10:57:30.0262 0x1130  ============================================================
10:57:30.0774 0x1130  KLMD registered as C:\Windows\system32\drivers\29436984.sys
10:57:30.0869 0x1130  System UUID: {60705417-63D5-9BFA-DBCD-22066EB9218B}
10:57:31.0371 0x1130  Drive \Device\Harddisk1\DR1 - Size: 0x3A38B2E000 ( 232.89 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:57:31.0371 0x1130  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0x38080, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040
10:57:31.0372 0x1130  Drive \Device\Harddisk4\DR4 - Size: 0x1D1C0F10000 ( 1863.01 Gb ), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000048
10:57:31.0380 0x1130  Drive \Device\Harddisk3\DR3 - Size: 0xEFF4FE00 ( 3.75 Gb ), SectorSize: 0x200, Cylinders: 0x1E9, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
10:57:31.0382 0x1130  ============================================================
10:57:31.0382 0x1130  \Device\Harddisk1\DR1:
10:57:31.0383 0x1130  MBR partitions:
10:57:31.0383 0x1130  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
10:57:31.0383 0x1130  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1A2FDD81
10:57:31.0383 0x1130  \Device\Harddisk0\DR0:
10:57:31.0383 0x1130  MBR partitions:
10:57:31.0383 0x1130  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
10:57:31.0383 0x1130  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x3A353000
10:57:31.0383 0x1130  \Device\Harddisk4\DR4:
10:57:31.0384 0x1130  MBR partitions:
10:57:31.0384 0x1130  \Device\Harddisk4\DR4\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x6403941
10:57:31.0384 0x1130  \Device\Harddisk4\DR4\Partition2: MBR, Type 0x7, StartLBA 0x6403980, BlocksNum 0x6403980
10:57:31.0384 0x1130  \Device\Harddisk4\DR4\Partition3: MBR, Type 0x7, StartLBA 0xC807300, BlocksNum 0xDC6001C1
10:57:31.0384 0x1130  \Device\Harddisk3\DR3:
10:57:31.0384 0x1130  MBR partitions:
10:57:31.0384 0x1130  \Device\Harddisk3\DR3\Partition1: MBR, Type 0xB, StartLBA 0x26, BlocksNum 0x779FC2
10:57:31.0384 0x1130  ============================================================
10:57:31.0386 0x1130  C: <-> \Device\Harddisk1\DR1\Partition2
10:57:31.0392 0x1130  F: <-> \Device\Harddisk0\DR0\Partition1
10:57:31.0393 0x1130  G: <-> \Device\Harddisk0\DR0\Partition2
10:57:31.0428 0x1130  U: <-> \Device\Harddisk4\DR4\Partition1
10:57:31.0452 0x1130  M: <-> \Device\Harddisk4\DR4\Partition2
10:57:31.0465 0x1130  J: <-> \Device\Harddisk4\DR4\Partition3
10:57:31.0465 0x1130  ============================================================
10:57:31.0465 0x1130  Initialize success
10:57:31.0465 0x1130  ============================================================
10:58:29.0755 0x08a4  ============================================================
10:58:29.0755 0x08a4  Scan started
10:58:29.0755 0x08a4  Mode: Manual; SigCheck; TDLFS; 
10:58:29.0755 0x08a4  ============================================================
10:58:29.0755 0x08a4  KSN ping started
10:58:43.0455 0x08a4  KSN ping finished: true
10:58:43.0835 0x08a4  ================ Scan system memory ========================
10:58:43.0835 0x08a4  System memory - ok
10:58:43.0835 0x08a4  ================ Scan services =============================
10:58:43.0885 0x08a4  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
10:58:43.0965 0x08a4  1394ohci - ok
10:58:43.0985 0x08a4  [ 7EEB488346FBFA3731276C3EE8A8FD9E, 97D2E49C2E615E38E8176F1C1551BF452CC6A00787FF90845EFF27A4E6E20B1F ] AAV UpdateService C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
10:58:43.0995 0x08a4  AAV UpdateService - ok
10:58:44.0015 0x08a4  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
10:58:44.0035 0x08a4  ACPI - ok
10:58:44.0045 0x08a4  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
10:58:44.0075 0x08a4  AcpiPmi - ok
10:58:44.0105 0x08a4  [ CD41DFA7A778555B2055E2D388F5CB33, AE149AB7823AE3A97E2826C06968F32A7E50331484203E4581C83E441A1680F9 ] AcrSch2Svc      C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
10:58:44.0145 0x08a4  AcrSch2Svc - ok
10:58:44.0155 0x08a4  [ B362181ED3771DC03B4141927C80F801, 69514E5177A0AEA89C27C2234712F9F82E8D8F99E1FD4273898C9324C6FF7472 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
10:58:44.0165 0x08a4  AdobeARMservice - ok
10:58:44.0185 0x08a4  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
10:58:44.0225 0x08a4  adp94xx - ok
10:58:44.0245 0x08a4  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\drivers\adpahci.sys
10:58:44.0275 0x08a4  adpahci - ok
10:58:44.0285 0x08a4  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
10:58:44.0305 0x08a4  adpu320 - ok
10:58:44.0315 0x08a4  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
10:58:44.0385 0x08a4  AeLookupSvc - ok
10:58:44.0395 0x08a4  [ ABCF9C80EAACE03021BB7F450EB8993F, 8E38726C423E82954CA85266D6F38B605D010A659420A4EF99D29035A9474BFB ] afcdp           C:\Windows\system32\DRIVERS\afcdp.sys
10:58:44.0445 0x08a4  afcdp - ok
10:58:44.0545 0x08a4  [ 3B1C11CB7006495F799F8A2AB8B2D530, B7B0C4922A1843BBF8104CDC705C4FEA1F1A760C1CC2BD6BC5E4213A0E4ED9FD ] afcdpsrv        C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
10:58:44.0655 0x08a4  afcdpsrv - ok
10:58:44.0685 0x08a4  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
10:58:44.0715 0x08a4  AFD - ok
10:58:44.0715 0x08a4  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
10:58:44.0735 0x08a4  agp440 - ok
10:58:44.0745 0x08a4  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
10:58:44.0775 0x08a4  ALG - ok
10:58:44.0775 0x08a4  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
10:58:44.0795 0x08a4  aliide - ok
10:58:44.0805 0x08a4  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
10:58:44.0825 0x08a4  amdide - ok
10:58:44.0835 0x08a4  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
10:58:44.0845 0x08a4  AmdK8 - ok
10:58:44.0855 0x08a4  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
10:58:44.0875 0x08a4  AmdPPM - ok
10:58:44.0885 0x08a4  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
10:58:44.0905 0x08a4  amdsata - ok
10:58:44.0915 0x08a4  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
10:58:44.0945 0x08a4  amdsbs - ok
10:58:44.0955 0x08a4  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
10:58:44.0965 0x08a4  amdxata - ok
10:58:44.0995 0x08a4  [ B59B5CA733760BEB3C69E6DA30BA61B4, 0A0E211BF10FAD46DF1EE60EE9C19BAB1CC52D476836871576686508125D7382 ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
10:58:45.0025 0x08a4  AntiVirMailService - ok
10:58:45.0045 0x08a4  [ 4C14746BCBF9985BDBF1CD1BEED96DF8, 8EF50FBD98C9AFD85F5D08692E7AEC21812B70074AA0DC6DCDFDBC2FFE34A75D ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
10:58:45.0065 0x08a4  AntiVirSchedulerService - ok
10:58:45.0085 0x08a4  [ 4C14746BCBF9985BDBF1CD1BEED96DF8, 8EF50FBD98C9AFD85F5D08692E7AEC21812B70074AA0DC6DCDFDBC2FFE34A75D ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
10:58:45.0105 0x08a4  AntiVirService - ok
10:58:45.0135 0x08a4  [ 1BF085C13A8F62E056E6201AFCF5E675, 8768E18A536ACCF3A0F0E31F9B5FF30054ACCF1CC0E77AC7A386EDBDFC663C63 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
10:58:45.0165 0x08a4  AntiVirWebService - ok
10:58:45.0175 0x08a4  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
10:58:45.0255 0x08a4  AppID - ok
10:58:45.0265 0x08a4  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
10:58:45.0305 0x08a4  AppIDSvc - ok
10:58:45.0315 0x08a4  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
10:58:45.0335 0x08a4  Appinfo - ok
10:58:45.0355 0x08a4  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
10:58:45.0385 0x08a4  AppMgmt - ok
10:58:45.0385 0x08a4  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\drivers\arc.sys
10:58:45.0415 0x08a4  arc - ok
10:58:45.0425 0x08a4  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\drivers\arcsas.sys
10:58:45.0445 0x08a4  arcsas - ok
10:58:45.0455 0x08a4  [ EDAA17CE771C696655B6585F7CAD2100, 31F4C6A367AE384E97516CB24F9FCCAA4AA12AEF410CB0D06665EB8C3BBDC3EF ] ASInsHelp       C:\Windows\SysWow64\drivers\AsInsHelp64.sys
10:58:45.0475 0x08a4  ASInsHelp - ok
10:58:45.0475 0x08a4  [ A82C01606DC27D05D9D3BFB6BB807E32, CE231637422709D927FB6FA0C4F2215B9C0E3EBBD951FB2FA97B8E64DA479B96 ] AsIO            C:\Windows\syswow64\drivers\AsIO.sys
10:58:45.0495 0x08a4  AsIO - ok
10:58:45.0515 0x08a4  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
10:58:45.0545 0x08a4  aspnet_state - ok
10:58:45.0555 0x08a4  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
10:58:45.0585 0x08a4  AsyncMac - ok
10:58:45.0595 0x08a4  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
10:58:45.0615 0x08a4  atapi - ok
10:58:45.0635 0x08a4  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
10:58:45.0705 0x08a4  AudioEndpointBuilder - ok
10:58:45.0725 0x08a4  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
10:58:45.0775 0x08a4  AudioSrv - ok
10:58:45.0785 0x08a4  [ 4663C5AD76FE8E19592DE808156FA07D, 605827B4A9D6930BC752D124BF75D55D4927B0ABEF881CDE66F3C5CC1DB215FE ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
10:58:45.0805 0x08a4  avgntflt - ok
10:58:45.0815 0x08a4  [ 8902AEC2382A37E9E99A4E0D52DBD42B, 138F2D7E7430132B2C527D413BC845CC467F084F39C232EC3A17DD2A74EE401E ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
10:58:45.0845 0x08a4  avipbb - ok
10:58:45.0845 0x08a4  [ CD60BA2B102F114D6AF53BE17EEDCD4B, 123F5AD7387A42FB16710BF7947DE25CDC19D2C4FE02CCA4BB36887E54DC5EC7 ] Avira.OE.ServiceHost C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
10:58:45.0865 0x08a4  Avira.OE.ServiceHost - ok
10:58:45.0865 0x08a4  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
10:58:45.0885 0x08a4  avkmgr - ok
10:58:45.0895 0x08a4  [ 09036D9F85BE6B659D375D2F0BAD0AD2, CCF4D28F60CF8E2B0F781D41F9E9FA84739AC6F948C09203D2498D64222CF990 ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
10:58:45.0915 0x08a4  avnetflt - ok
10:58:45.0925 0x08a4  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
10:58:45.0955 0x08a4  AxInstSV - ok
10:58:45.0975 0x08a4  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
10:58:46.0015 0x08a4  b06bdrv - ok
10:58:46.0035 0x08a4  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
10:58:46.0065 0x08a4  b57nd60a - ok
10:58:46.0075 0x08a4  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
10:58:46.0105 0x08a4  BDESVC - ok
10:58:46.0115 0x08a4  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
10:58:46.0155 0x08a4  Beep - ok
10:58:46.0175 0x08a4  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
10:58:46.0235 0x08a4  BFE - ok
10:58:46.0265 0x08a4  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
10:58:46.0335 0x08a4  BITS - ok
10:58:46.0345 0x08a4  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
10:58:46.0365 0x08a4  blbdrive - ok
10:58:46.0375 0x08a4  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
10:58:46.0405 0x08a4  bowser - ok
10:58:46.0405 0x08a4  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
10:58:46.0425 0x08a4  BrFiltLo - ok
10:58:46.0435 0x08a4  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
10:58:46.0455 0x08a4  BrFiltUp - ok
10:58:46.0465 0x08a4  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
10:58:46.0495 0x08a4  Browser - ok
10:58:46.0505 0x08a4  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
10:58:46.0545 0x08a4  Brserid - ok
10:58:46.0555 0x08a4  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
10:58:46.0575 0x08a4  BrSerWdm - ok
10:58:46.0585 0x08a4  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
10:58:46.0605 0x08a4  BrUsbMdm - ok
10:58:46.0615 0x08a4  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
10:58:46.0635 0x08a4  BrUsbSer - ok
10:58:46.0645 0x08a4  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
10:58:46.0665 0x08a4  BTHMODEM - ok
10:58:46.0675 0x08a4  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
10:58:46.0725 0x08a4  bthserv - ok
10:58:46.0735 0x08a4  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
10:58:46.0785 0x08a4  cdfs - ok
10:58:46.0795 0x08a4  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
10:58:46.0815 0x08a4  cdrom - ok
10:58:46.0825 0x08a4  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
10:58:46.0875 0x08a4  CertPropSvc - ok
10:58:46.0885 0x08a4  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
10:58:46.0905 0x08a4  circlass - ok
10:58:46.0925 0x08a4  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
10:58:46.0955 0x08a4  CLFS - ok
10:58:46.0955 0x08a4  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:58:46.0985 0x08a4  clr_optimization_v2.0.50727_32 - ok
10:58:46.0995 0x08a4  [ D1CEEA2B47CB998321C579651CE3E4F8, 654013B8FD229A50017B08DEC6CA19C7DDA8CE0771260E057A92625201D539B1 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
10:58:47.0015 0x08a4  clr_optimization_v2.0.50727_64 - ok
10:58:47.0025 0x08a4  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:58:47.0045 0x08a4  clr_optimization_v4.0.30319_32 - ok
10:58:47.0055 0x08a4  [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
10:58:47.0075 0x08a4  clr_optimization_v4.0.30319_64 - ok
10:58:47.0085 0x08a4  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
10:58:47.0105 0x08a4  CmBatt - ok
10:58:47.0115 0x08a4  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
10:58:47.0135 0x08a4  cmdide - ok
10:58:47.0155 0x08a4  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys
10:58:47.0195 0x08a4  CNG - ok
10:58:47.0205 0x08a4  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
10:58:47.0225 0x08a4  Compbatt - ok
10:58:47.0235 0x08a4  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
10:58:47.0255 0x08a4  CompositeBus - ok
10:58:47.0265 0x08a4  COMSysApp - ok
10:58:47.0275 0x08a4  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
10:58:47.0295 0x08a4  crcdisk - ok
10:58:47.0305 0x08a4  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll
10:58:47.0345 0x08a4  CryptSvc - ok
10:58:47.0365 0x08a4  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
10:58:47.0395 0x08a4  CSC - ok
10:58:47.0425 0x08a4  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
10:58:47.0455 0x08a4  CscService - ok
10:58:47.0475 0x08a4  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
10:58:47.0535 0x08a4  DcomLaunch - ok
10:58:47.0545 0x08a4  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
10:58:47.0605 0x08a4  defragsvc - ok
10:58:47.0605 0x08a4  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
10:58:47.0655 0x08a4  DfsC - ok
10:58:47.0665 0x08a4  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
10:58:47.0695 0x08a4  Dhcp - ok
10:58:47.0705 0x08a4  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
10:58:47.0745 0x08a4  discache - ok
10:58:47.0755 0x08a4  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\drivers\disk.sys
10:58:47.0775 0x08a4  Disk - ok
10:58:47.0785 0x08a4  [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc           C:\Windows\system32\drivers\dmvsc.sys
10:58:47.0805 0x08a4  dmvsc - ok
10:58:47.0825 0x08a4  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
10:58:47.0855 0x08a4  Dnscache - ok
10:58:47.0865 0x08a4  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
10:58:47.0925 0x08a4  dot3svc - ok
10:58:47.0935 0x08a4  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
10:58:47.0975 0x08a4  DPS - ok
10:58:47.0985 0x08a4  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
10:58:47.0995 0x08a4  drmkaud - ok
10:58:48.0035 0x08a4  [ 88612F1CE3BF42256913BF6E61C70D52, 7CF190F83FA8F15C33008EB381D3E345CEF37CBC046227DED26B36799EF4D9A7 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
10:58:48.0085 0x08a4  DXGKrnl - ok
10:58:48.0095 0x08a4  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
10:58:48.0145 0x08a4  EapHost - ok
10:58:48.0235 0x08a4  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\drivers\evbda.sys
10:58:48.0365 0x08a4  ebdrv - ok
10:58:48.0375 0x08a4  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS             C:\Windows\System32\lsass.exe
10:58:48.0395 0x08a4  EFS - ok
10:58:48.0422 0x08a4  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
10:58:48.0465 0x08a4  ehRecvr - ok
10:58:48.0475 0x08a4  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
10:58:48.0505 0x08a4  ehSched - ok
10:58:48.0525 0x08a4  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
10:58:48.0555 0x08a4  elxstor - ok
10:58:48.0565 0x08a4  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
10:58:48.0585 0x08a4  ErrDev - ok
10:58:48.0605 0x08a4  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
10:58:48.0655 0x08a4  EventSystem - ok
10:58:48.0665 0x08a4  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
10:58:48.0715 0x08a4  exfat - ok
10:58:48.0725 0x08a4  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
10:58:48.0775 0x08a4  fastfat - ok
10:58:48.0795 0x08a4  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
10:58:48.0835 0x08a4  Fax - ok
10:58:48.0845 0x08a4  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\drivers\fdc.sys
10:58:48.0865 0x08a4  fdc - ok
10:58:48.0865 0x08a4  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
10:58:48.0905 0x08a4  fdPHost - ok
10:58:48.0915 0x08a4  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
10:58:48.0965 0x08a4  FDResPub - ok
10:58:48.0965 0x08a4  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
10:58:48.0985 0x08a4  FileInfo - ok
10:58:48.0995 0x08a4  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
10:58:49.0045 0x08a4  Filetrace - ok
10:58:49.0045 0x08a4  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
10:58:49.0065 0x08a4  flpydisk - ok
10:58:49.0085 0x08a4  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
10:58:49.0115 0x08a4  FltMgr - ok
10:58:49.0125 0x08a4  [ FDD776FAC4159A2983940D1E411FE9F3, 3B147B4D3C5CC67117D65152FA8BD3A603728C92B023AE45CD166E6FF3F474C5 ] fltsrv          C:\Windows\system32\DRIVERS\fltsrv.sys
10:58:49.0145 0x08a4  fltsrv - ok
10:58:49.0175 0x08a4  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
10:58:49.0245 0x08a4  FontCache - ok
10:58:49.0255 0x08a4  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
10:58:49.0275 0x08a4  FontCache3.0.0.0 - ok
10:58:49.0285 0x08a4  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
10:58:49.0305 0x08a4  FsDepends - ok
10:58:49.0305 0x08a4  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
10:58:49.0325 0x08a4  Fs_Rec - ok
10:58:49.0345 0x08a4  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
10:58:49.0365 0x08a4  fvevol - ok
10:58:49.0375 0x08a4  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
10:58:49.0395 0x08a4  gagp30kx - ok
10:58:49.0415 0x08a4  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
10:58:49.0485 0x08a4  gpsvc - ok
10:58:49.0495 0x08a4  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
10:58:49.0515 0x08a4  hcw85cir - ok
10:58:49.0535 0x08a4  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
10:58:49.0575 0x08a4  HdAudAddService - ok
10:58:49.0585 0x08a4  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
10:58:49.0595 0x08a4  HDAudBus - ok
10:58:49.0605 0x08a4  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
10:58:49.0625 0x08a4  HidBatt - ok
10:58:49.0635 0x08a4  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
10:58:49.0655 0x08a4  HidBth - ok
10:58:49.0675 0x08a4  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\drivers\hidir.sys
10:58:49.0695 0x08a4  HidIr - ok
10:58:49.0695 0x08a4  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
10:58:49.0745 0x08a4  hidserv - ok
10:58:49.0755 0x08a4  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
10:58:49.0775 0x08a4  HidUsb - ok
10:58:49.0785 0x08a4  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
10:58:49.0835 0x08a4  hkmsvc - ok
10:58:49.0845 0x08a4  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
10:58:49.0885 0x08a4  HomeGroupListener - ok
10:58:49.0895 0x08a4  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
10:58:49.0925 0x08a4  HomeGroupProvider - ok
10:58:49.0935 0x08a4  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
10:58:49.0955 0x08a4  HpSAMD - ok
10:58:49.0985 0x08a4  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
10:58:50.0035 0x08a4  HTTP - ok
10:58:50.0045 0x08a4  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
10:58:50.0055 0x08a4  hwpolicy - ok
10:58:50.0075 0x08a4  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
10:58:50.0095 0x08a4  i8042prt - ok
10:58:50.0115 0x08a4  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
10:58:50.0145 0x08a4  iaStorV - ok
10:58:50.0175 0x08a4  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD, 2B9512324DBA4A97F6AC34E8067EE08E3B6874CD60F6CB4209AFC22A34D2BE99 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
10:58:50.0225 0x08a4  idsvc - ok
10:58:50.0235 0x08a4  IEEtwCollectorService - ok
10:58:50.0245 0x08a4  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
10:58:50.0275 0x08a4  iirsp - ok
10:58:50.0305 0x08a4  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
10:58:50.0355 0x08a4  IKEEXT - ok
10:58:50.0365 0x08a4  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
10:58:50.0385 0x08a4  intelide - ok
10:58:50.0395 0x08a4  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\drivers\intelppm.sys
10:58:50.0415 0x08a4  intelppm - ok
10:58:50.0425 0x08a4  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
10:58:50.0475 0x08a4  IPBusEnum - ok
10:58:50.0485 0x08a4  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
10:58:50.0535 0x08a4  IpFilterDriver - ok
10:58:50.0555 0x08a4  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
10:58:50.0605 0x08a4  iphlpsvc - ok
10:58:50.0615 0x08a4  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
10:58:50.0635 0x08a4  IPMIDRV - ok
10:58:50.0645 0x08a4  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
10:58:50.0695 0x08a4  IPNAT - ok
10:58:50.0695 0x08a4  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
10:58:50.0725 0x08a4  IRENUM - ok
10:58:50.0725 0x08a4  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
10:58:50.0745 0x08a4  isapnp - ok
10:58:50.0765 0x08a4  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
10:58:50.0795 0x08a4  iScsiPrt - ok
10:58:50.0805 0x08a4  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
10:58:50.0825 0x08a4  kbdclass - ok
10:58:50.0825 0x08a4  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
10:58:50.0845 0x08a4  kbdhid - ok
10:58:50.0855 0x08a4  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso          C:\Windows\system32\lsass.exe
10:58:50.0865 0x08a4  KeyIso - ok
10:58:50.0875 0x08a4  [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
10:58:50.0905 0x08a4  KSecDD - ok
10:58:50.0915 0x08a4  [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
10:58:50.0935 0x08a4  KSecPkg - ok
10:58:50.0945 0x08a4  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
10:58:50.0985 0x08a4  ksthunk - ok
10:58:50.0995 0x08a4  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
10:58:51.0055 0x08a4  KtmRm - ok
10:58:51.0065 0x08a4  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
10:58:51.0125 0x08a4  LanmanServer - ok
10:58:51.0135 0x08a4  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
10:58:51.0175 0x08a4  LanmanWorkstation - ok
10:58:51.0205 0x08a4  [ 09ECAD3992668CA2EE298C3D3A87E617, 82FF3D871330432B25BF7C254EF3A50B3F3CAAC13CC674701769408E9A5FA70B ] lfsfilt         C:\Windows\system32\DRIVERS\lfsfilt.sys
10:58:51.0245 0x08a4  lfsfilt - ok
10:58:51.0255 0x08a4  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
10:58:51.0295 0x08a4  lltdio - ok
10:58:51.0315 0x08a4  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
10:58:51.0375 0x08a4  lltdsvc - ok
10:58:51.0375 0x08a4  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
10:58:51.0425 0x08a4  lmhosts - ok
10:58:51.0435 0x08a4  [ 7BFCB5E0823287B947817ECDAD520440, CF2A4FE97C655ED521784911CBC367907574760A53E3C665E49594B7D5FB6C60 ] lpx             C:\Windows\system32\DRIVERS\lpx6x.sys
10:58:51.0455 0x08a4  lpx - ok
10:58:51.0465 0x08a4  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
10:58:51.0485 0x08a4  LSI_FC - ok
10:58:51.0495 0x08a4  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
10:58:51.0515 0x08a4  LSI_SAS - ok
10:58:51.0535 0x08a4  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
10:58:51.0555 0x08a4  LSI_SAS2 - ok
10:58:51.0565 0x08a4  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
10:58:51.0585 0x08a4  LSI_SCSI - ok
10:58:51.0595 0x08a4  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
10:58:51.0645 0x08a4  luafv - ok
10:58:51.0655 0x08a4  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
10:58:51.0685 0x08a4  Mcx2Svc - ok
10:58:51.0685 0x08a4  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\drivers\megasas.sys
10:58:51.0705 0x08a4  megasas - ok
10:58:51.0725 0x08a4  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
10:58:51.0745 0x08a4  MegaSR - ok
10:58:51.0755 0x08a4  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
10:58:51.0805 0x08a4  MMCSS - ok
10:58:51.0805 0x08a4  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
10:58:51.0845 0x08a4  Modem - ok
10:58:51.0855 0x08a4  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
10:58:51.0875 0x08a4  monitor - ok
10:58:51.0875 0x08a4  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
10:58:51.0905 0x08a4  mouclass - ok
10:58:51.0905 0x08a4  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
10:58:51.0925 0x08a4  mouhid - ok
10:58:51.0935 0x08a4  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
10:58:51.0945 0x08a4  mountmgr - ok
10:58:51.0965 0x08a4  [ 26EA1DAD601EE3ACAC301D66F07BA219, C9594BB15D53D4AC2156CCCD2DB65B2C20620F1F60DA85F48D1586FC10028096 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
10:58:51.0985 0x08a4  MozillaMaintenance - ok
10:58:51.0995 0x08a4  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
10:58:52.0025 0x08a4  mpio - ok
10:58:52.0035 0x08a4  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
10:58:52.0075 0x08a4  mpsdrv - ok
10:58:52.0105 0x08a4  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
10:58:52.0175 0x08a4  MpsSvc - ok
10:58:52.0185 0x08a4  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
10:58:52.0215 0x08a4  MRxDAV - ok
10:58:52.0225 0x08a4  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
10:58:52.0255 0x08a4  mrxsmb - ok
10:58:52.0275 0x08a4  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
10:58:52.0295 0x08a4  mrxsmb10 - ok
10:58:52.0315 0x08a4  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
10:58:52.0335 0x08a4  mrxsmb20 - ok
10:58:52.0345 0x08a4  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
10:58:52.0365 0x08a4  msahci - ok
10:58:52.0375 0x08a4  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
10:58:52.0405 0x08a4  msdsm - ok
10:58:52.0415 0x08a4  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
10:58:52.0435 0x08a4  MSDTC - ok
10:58:52.0455 0x08a4  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
10:58:52.0495 0x08a4  Msfs - ok
10:58:52.0505 0x08a4  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
10:58:52.0545 0x08a4  mshidkmdf - ok
10:58:52.0555 0x08a4  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
10:58:52.0565 0x08a4  msisadrv - ok
10:58:52.0585 0x08a4  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
10:58:52.0637 0x08a4  MSiSCSI - ok
10:58:52.0647 0x08a4  msiserver - ok
10:58:52.0657 0x08a4  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
10:58:52.0687 0x08a4  MSKSSRV - ok
10:58:52.0697 0x08a4  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
10:58:52.0737 0x08a4  MSPCLOCK - ok
10:58:52.0747 0x08a4  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
10:58:52.0787 0x08a4  MSPQM - ok
10:58:52.0797 0x08a4  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
10:58:52.0827 0x08a4  MsRPC - ok
10:58:52.0847 0x08a4  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
10:58:52.0857 0x08a4  mssmbios - ok
10:58:52.0857 0x08a4  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
10:58:52.0907 0x08a4  MSTEE - ok
10:58:52.0917 0x08a4  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
10:58:52.0949 0x08a4  MTConfig - ok
10:58:52.0959 0x08a4  [ 19B006B181E3875FD254F7B67ACF1E7C, 1D68D19522E71F16B8B50F8CCFBC9D884CF2DAC40CC409BD5A40A4D4223ABC61 ] MTsensor        C:\Windows\system32\DRIVERS\ASACPI.sys
10:58:52.0979 0x08a4  MTsensor - ok
10:58:52.0989 0x08a4  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
10:58:53.0009 0x08a4  Mup - ok
10:58:53.0029 0x08a4  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
10:58:53.0079 0x08a4  napagent - ok
10:58:53.0089 0x08a4  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
10:58:53.0129 0x08a4  NativeWifiP - ok
10:58:53.0149 0x08a4  [ 4ED26F4A884C019F2362FEE2EA768BB8, 3BB6D1C08F22AE74E5CE2D0D57ADBDAF8998281E0BF8227F6A65F6B76D07F328 ] ndasbus         C:\Windows\system32\DRIVERS\ndasbus.sys
10:58:53.0179 0x08a4  ndasbus - ok
10:58:53.0209 0x08a4  [ 590C18776BCD2F13BC1DA53E478734EF, 8C453CFF2F72A4BCDEB9D30300F807A047ADD45DED826F449598A1ED73B4D1B1 ] ndasfat         C:\Windows\system32\DRIVERS\ndasfat.sys
10:58:53.0239 0x08a4  ndasfat - ok
10:58:53.0269 0x08a4  [ B7865562A5280C1BA66272FC61B8BDBF, 2BC4B406251564B8B80A38621D45881739581C01A005BEC5B7C1377AA26222B6 ] ndasfs          C:\Windows\system32\DRIVERS\ndasfs.sys
10:58:53.0309 0x08a4  ndasfs - ok
10:58:53.0339 0x08a4  [ DA1F20BAF3795C1F2D12162ECF08D848, 5003536EAD646313278832BE74AEE96D6CC4EE36B3D3B4E8E2A1377050B0BF93 ] ndasrofs        C:\Windows\system32\DRIVERS\ndasrofs.sys
10:58:53.0389 0x08a4  ndasrofs - ok
10:58:53.0409 0x08a4  [ 490792B4EA0DFFA9FE01C39C6CEF452F, 32FAEE3B2D9213605A5CCD78FCAED7DC641CBBC1CEBF681D95681E185FA328EC ] ndasscsi        C:\Windows\system32\DRIVERS\ndasscsi.sys
10:58:53.0429 0x08a4  ndasscsi - ok
10:58:53.0449 0x08a4  [ 383BCDC6EF438CC9DBB5718FE0EB500D, 83BC0EE1BE66471BAF93502EAD1B1D56258488E7A1483ED0BD499CAB5DAF20A4 ] ndassvc         C:\Program Files\NDAS\System\ndassvc.exe
10:58:53.0469 0x08a4  ndassvc - ok
10:58:53.0549 0x08a4  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
10:58:53.0609 0x08a4  NDIS - ok
10:58:53.0628 0x08a4  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
10:58:53.0711 0x08a4  NdisCap - ok
10:58:53.0721 0x08a4  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
10:58:53.0781 0x08a4  NdisTapi - ok
10:58:53.0801 0x08a4  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
10:58:53.0871 0x08a4  Ndisuio - ok
10:58:53.0881 0x08a4  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
10:58:53.0961 0x08a4  NdisWan - ok
10:58:53.0981 0x08a4  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
10:58:54.0041 0x08a4  NDProxy - ok
10:58:54.0061 0x08a4  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
10:58:54.0111 0x08a4  NetBIOS - ok
10:58:54.0121 0x08a4  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
10:58:54.0171 0x08a4  NetBT - ok
10:58:54.0181 0x08a4  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon        C:\Windows\system32\lsass.exe
10:58:54.0191 0x08a4  Netlogon - ok
10:58:54.0211 0x08a4  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
10:58:54.0251 0x08a4  Netman - ok
10:58:54.0261 0x08a4  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:58:54.0291 0x08a4  NetMsmqActivator - ok
10:58:54.0301 0x08a4  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:58:54.0321 0x08a4  NetPipeActivator - ok
10:58:54.0341 0x08a4  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
10:58:54.0391 0x08a4  netprofm - ok
10:58:54.0401 0x08a4  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:58:54.0411 0x08a4  NetTcpActivator - ok
10:58:54.0421 0x08a4  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:58:54.0441 0x08a4  NetTcpPortSharing - ok
10:58:54.0451 0x08a4  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
10:58:54.0471 0x08a4  nfrd960 - ok
10:58:54.0481 0x08a4  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\Windows\System32\nlasvc.dll
10:58:54.0511 0x08a4  NlaSvc - ok
10:58:54.0531 0x08a4  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
10:58:54.0571 0x08a4  Npfs - ok
10:58:54.0581 0x08a4  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
10:58:54.0621 0x08a4  nsi - ok
10:58:54.0631 0x08a4  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
10:58:54.0661 0x08a4  nsiproxy - ok
10:58:54.0721 0x08a4  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
10:58:54.0791 0x08a4  Ntfs - ok
10:58:54.0801 0x08a4  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
10:58:54.0841 0x08a4  Null - ok
10:58:54.0851 0x08a4  [ E9769D63F16D1BEC151C2668CD3AAD4F, F8B366AAED94861E146D3074EE69E08B8052151F9CF16FF01983804C0221B927 ] nvamacpi        C:\Windows\system32\DRIVERS\NVAMACPI.sys
10:58:54.0871 0x08a4  nvamacpi - ok
10:58:54.0881 0x08a4  [ E366A5681C50785D4ED04FCFD65C3415, 7FF7B4B8F09E773401AE879897E60BF494B57B9ACEE990204A4C98A3FB183A33 ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
10:58:54.0901 0x08a4  NVHDA - ok
10:58:55.0221 0x08a4  [ 757ACE4D4C9FF0571F86AA5D586B45E8, E7F23CC1DE26E2DAA690B78B05FC001EE0051F0ED9B9BCE9E7FA4E9684D4F3D4 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
10:58:55.0703 0x08a4  nvlddmkm - ok
10:58:55.0765 0x08a4  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
10:58:55.0795 0x08a4  nvraid - ok
10:58:55.0795 0x08a4  [ E58D81FB8616D0CB55C1E36AA0B213C9, D83F78615889A466ADE2BFEF7AB357C0D31B7FA9A1A52668DED32A51FEFA87B5 ] nvsmu           C:\Windows\system32\DRIVERS\nvsmu.sys
10:58:55.0815 0x08a4  nvsmu - ok
10:58:55.0825 0x08a4  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
10:58:55.0845 0x08a4  nvstor - ok
10:58:55.0875 0x08a4  [ 1C7CC708AC4A02A3BE8915539780534A, 0EBDE100880963BF1EC05002BA244CA7700693E958D1974CDD2AC3927D93224F ] nvsvc           C:\Windows\system32\nvvsvc.exe
10:58:55.0905 0x08a4  nvsvc - ok
10:58:55.0925 0x08a4  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
10:58:55.0945 0x08a4  nv_agp - ok
10:58:55.0955 0x08a4  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
10:58:55.0975 0x08a4  ohci1394 - ok
10:58:55.0985 0x08a4  [ 4965B005492CBA7719E82B71E3245495, 52AD72C05FACC1E0E416A1FA25F34FDD3CB274FAB973BEAAE911A2FACA42B650 ] ose64           C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:58:56.0005 0x08a4  ose64 - ok
10:58:56.0135 0x08a4  [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
10:58:56.0305 0x08a4  osppsvc - ok
10:58:56.0335 0x08a4  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
10:58:56.0375 0x08a4  p2pimsvc - ok
10:58:56.0395 0x08a4  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
10:58:56.0435 0x08a4  p2psvc - ok
10:58:56.0445 0x08a4  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\drivers\parport.sys
10:58:56.0465 0x08a4  Parport - ok
10:58:56.0475 0x08a4  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
10:58:56.0505 0x08a4  partmgr - ok
10:58:56.0515 0x08a4  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
10:58:56.0545 0x08a4  PcaSvc - ok
10:58:56.0565 0x08a4  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
10:58:56.0585 0x08a4  pci - ok
10:58:56.0595 0x08a4  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
10:58:56.0615 0x08a4  pciide - ok
10:58:56.0625 0x08a4  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
10:58:56.0655 0x08a4  pcmcia - ok
10:58:56.0655 0x08a4  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
10:58:56.0675 0x08a4  pcw - ok
10:58:56.0695 0x08a4  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
10:58:56.0765 0x08a4  PEAUTH - ok
10:58:56.0815 0x08a4  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
10:58:56.0895 0x08a4  PeerDistSvc - ok
10:58:56.0915 0x08a4  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
10:58:56.0935 0x08a4  PerfHost - ok
10:58:56.0985 0x08a4  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
10:58:57.0075 0x08a4  pla - ok
10:58:57.0095 0x08a4  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
10:58:57.0145 0x08a4  PlugPlay - ok
10:58:57.0145 0x08a4  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
10:58:57.0175 0x08a4  PNRPAutoReg - ok
10:58:57.0185 0x08a4  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
10:58:57.0215 0x08a4  PNRPsvc - ok
10:58:57.0225 0x08a4  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
10:58:57.0295 0x08a4  PolicyAgent - ok
10:58:57.0305 0x08a4  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
10:58:57.0355 0x08a4  Power - ok
10:58:57.0365 0x08a4  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
10:58:57.0405 0x08a4  PptpMiniport - ok
10:58:57.0415 0x08a4  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\drivers\processr.sys
10:58:57.0435 0x08a4  Processor - ok
10:58:57.0445 0x08a4  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\Windows\system32\profsvc.dll
10:58:57.0475 0x08a4  ProfSvc - ok
10:58:57.0485 0x08a4  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
10:58:57.0495 0x08a4  ProtectedStorage - ok
10:58:57.0505 0x08a4  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
10:58:57.0545 0x08a4  Psched - ok
10:58:57.0595 0x08a4  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
10:58:57.0665 0x08a4  ql2300 - ok
10:58:57.0675 0x08a4  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
10:58:57.0695 0x08a4  ql40xx - ok
10:58:57.0715 0x08a4  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
10:58:57.0755 0x08a4  QWAVE - ok
10:58:57.0785 0x08a4  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
10:58:57.0815 0x08a4  QWAVEdrv - ok
10:58:57.0845 0x08a4  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
10:58:57.0907 0x08a4  RasAcd - ok
10:58:57.0937 0x08a4  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
10:58:58.0019 0x08a4  RasAgileVpn - ok
10:58:58.0039 0x08a4  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
10:58:58.0119 0x08a4  RasAuto - ok
10:58:58.0159 0x08a4  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
10:58:58.0231 0x08a4  Rasl2tp - ok
10:58:58.0261 0x08a4  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
10:58:58.0341 0x08a4  RasMan - ok
10:58:58.0351 0x08a4  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
10:58:58.0401 0x08a4  RasPppoe - ok
10:58:58.0401 0x08a4  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
10:58:58.0451 0x08a4  RasSstp - ok
10:58:58.0461 0x08a4  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
10:58:58.0531 0x08a4  rdbss - ok
10:58:58.0541 0x08a4  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
10:58:58.0561 0x08a4  rdpbus - ok
10:58:58.0561 0x08a4  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
10:58:58.0601 0x08a4  RDPCDD - ok
10:58:58.0621 0x08a4  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
10:58:58.0641 0x08a4  RDPDR - ok
10:58:58.0651 0x08a4  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
10:58:58.0681 0x08a4  RDPENCDD - ok
10:58:58.0691 0x08a4  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
10:58:58.0731 0x08a4  RDPREFMP - ok
10:58:58.0741 0x08a4  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
10:58:58.0761 0x08a4  RdpVideoMiniport - ok
10:58:58.0771 0x08a4  [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
10:58:58.0801 0x08a4  RDPWD - ok
10:58:58.0821 0x08a4  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
10:58:58.0841 0x08a4  rdyboost - ok
10:58:58.0851 0x08a4  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
10:58:58.0901 0x08a4  RemoteAccess - ok
10:58:58.0921 0x08a4  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
10:58:58.0961 0x08a4  RemoteRegistry - ok
10:58:58.0971 0x08a4  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
10:58:59.0021 0x08a4  RpcEptMapper - ok
10:58:59.0021 0x08a4  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
10:58:59.0041 0x08a4  RpcLocator - ok
10:58:59.0061 0x08a4  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
10:58:59.0111 0x08a4  RpcSs - ok
10:58:59.0121 0x08a4  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
10:58:59.0161 0x08a4  rspndr - ok
10:58:59.0171 0x08a4  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
10:58:59.0191 0x08a4  s3cap - ok
10:58:59.0201 0x08a4  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs           C:\Windows\system32\lsass.exe
10:58:59.0211 0x08a4  SamSs - ok
10:58:59.0221 0x08a4  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
10:58:59.0241 0x08a4  sbp2port - ok
10:58:59.0251 0x08a4  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
10:58:59.0311 0x08a4  SCardSvr - ok
10:58:59.0321 0x08a4  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
10:58:59.0361 0x08a4  scfilter - ok
10:58:59.0401 0x08a4  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
10:58:59.0491 0x08a4  Schedule - ok
10:58:59.0501 0x08a4  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
10:58:59.0541 0x08a4  SCPolicySvc - ok
10:58:59.0551 0x08a4  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
10:58:59.0581 0x08a4  SDRSVC - ok
10:58:59.0591 0x08a4  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
10:58:59.0631 0x08a4  secdrv - ok
10:58:59.0641 0x08a4  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
10:58:59.0681 0x08a4  seclogon - ok
10:58:59.0691 0x08a4  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
10:58:59.0731 0x08a4  SENS - ok
10:58:59.0731 0x08a4  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
10:58:59.0761 0x08a4  SensrSvc - ok
10:58:59.0771 0x08a4  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
10:58:59.0791 0x08a4  Serenum - ok
10:58:59.0801 0x08a4  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
10:58:59.0821 0x08a4  Serial - ok
10:58:59.0831 0x08a4  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
10:58:59.0851 0x08a4  sermouse - ok
10:58:59.0871 0x08a4  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
10:58:59.0921 0x08a4  SessionEnv - ok
10:58:59.0921 0x08a4  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
10:58:59.0941 0x08a4  sffdisk - ok
10:58:59.0951 0x08a4  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
10:58:59.0971 0x08a4  sffp_mmc - ok
10:58:59.0981 0x08a4  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
10:59:00.0001 0x08a4  sffp_sd - ok
10:59:00.0011 0x08a4  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
10:59:00.0031 0x08a4  sfloppy - ok
10:59:00.0041 0x08a4  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
10:59:00.0111 0x08a4  SharedAccess - ok
10:59:00.0121 0x08a4  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
10:59:00.0181 0x08a4  ShellHWDetection - ok
10:59:00.0191 0x08a4  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
10:59:00.0211 0x08a4  SiSRaid2 - ok
10:59:00.0221 0x08a4  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
10:59:00.0241 0x08a4  SiSRaid4 - ok
10:59:00.0251 0x08a4  [ 050A4112B00BCA2E13314CDE48C1DEEE, 86C679CD494DEEB984372BF954EFBB8982AC7995FBF89FCF83BC228991D1B825 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
10:59:00.0291 0x08a4  SkypeUpdate - ok
10:59:00.0301 0x08a4  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
10:59:00.0351 0x08a4  Smb - ok
10:59:00.0371 0x08a4  [ FBE0201AB61E18934C812C34D31A4403, 549E51FC11CCA30B21970C90F4799D6CB94481CDC623B8C319F16DAEFC8A190B ] snapman         C:\Windows\system32\DRIVERS\snapman.sys
10:59:00.0401 0x08a4  snapman - ok
10:59:00.0401 0x08a4  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
10:59:00.0431 0x08a4  SNMPTRAP - ok
10:59:00.0431 0x08a4  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
10:59:00.0451 0x08a4  spldr - ok
10:59:00.0471 0x08a4  [ B96C17B5DC1424D56EEA3A99E97428CD, AF0A85066A7983878DC1C663811CE61C6CA1912DC956184F878B7B82DB93C651 ] Spooler         C:\Windows\System32\spoolsv.exe
10:59:00.0531 0x08a4  Spooler - ok
10:59:00.0621 0x08a4  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
10:59:00.0761 0x08a4  sppsvc - ok
10:59:00.0781 0x08a4  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
10:59:00.0821 0x08a4  sppuinotify - ok
10:59:00.0851 0x08a4  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
10:59:00.0891 0x08a4  srv - ok
10:59:00.0911 0x08a4  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
10:59:00.0951 0x08a4  srv2 - ok
10:59:00.0961 0x08a4  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
10:59:00.0991 0x08a4  srvnet - ok
10:59:01.0001 0x08a4  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
10:59:01.0051 0x08a4  SSDPSRV - ok
10:59:01.0061 0x08a4  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
10:59:01.0111 0x08a4  SstpSvc - ok
10:59:01.0111 0x08a4  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
10:59:01.0131 0x08a4  stexstor - ok
10:59:01.0141 0x08a4  [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
10:59:01.0161 0x08a4  StillCam - ok
10:59:01.0181 0x08a4  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
10:59:01.0231 0x08a4  stisvc - ok
10:59:01.0241 0x08a4  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
10:59:01.0261 0x08a4  storflt - ok
10:59:01.0271 0x08a4  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
10:59:01.0291 0x08a4  StorSvc - ok
10:59:01.0301 0x08a4  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
10:59:01.0321 0x08a4  storvsc - ok
10:59:01.0331 0x08a4  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
10:59:01.0341 0x08a4  swenum - ok
10:59:01.0361 0x08a4  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
10:59:01.0431 0x08a4  swprv - ok
10:59:01.0611 0x08a4  [ 0FE29D81F372CA2DCE9E49736A3BD3E6, 10ED93BEE7ECBD2AF5E7AB0197CC82A5424FD63A2ED90F0417B266AD06E5F32C ] syncagentsrv    C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
10:59:01.0823 0x08a4  syncagentsrv - ok
10:59:01.0883 0x08a4  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
10:59:01.0973 0x08a4  SysMain - ok
10:59:01.0993 0x08a4  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
10:59:02.0023 0x08a4  TabletInputService - ok
10:59:02.0043 0x08a4  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
10:59:02.0115 0x08a4  TapiSrv - ok
10:59:02.0125 0x08a4  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
10:59:02.0165 0x08a4  TBS - ok
10:59:02.0225 0x08a4  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
10:59:02.0315 0x08a4  Tcpip - ok
10:59:02.0365 0x08a4  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
10:59:02.0425 0x08a4  TCPIP6 - ok
10:59:02.0445 0x08a4  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
10:59:02.0455 0x08a4  tcpipreg - ok
10:59:02.0465 0x08a4  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
10:59:02.0485 0x08a4  TDPIPE - ok
10:59:02.0525 0x08a4  [ 07330E30921C70E9D9B416EE43A06349, 398500C12E685BCF732C7F80A2C0E95181E5377A0E6C14CF9A3EE8580083A556 ] tdrpman         C:\Windows\system32\DRIVERS\tdrpman.sys
10:59:02.0585 0x08a4  tdrpman - ok
10:59:02.0605 0x08a4  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
10:59:02.0625 0x08a4  TDTCP - ok
10:59:02.0635 0x08a4  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
10:59:02.0675 0x08a4  tdx - ok
10:59:02.0685 0x08a4  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
10:59:02.0705 0x08a4  TermDD - ok
10:59:02.0725 0x08a4  [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService     C:\Windows\System32\termsrv.dll
10:59:02.0795 0x08a4  TermService - ok
10:59:02.0805 0x08a4  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
10:59:02.0835 0x08a4  Themes - ok
10:59:02.0845 0x08a4  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
10:59:02.0885 0x08a4  THREADORDER - ok
10:59:02.0915 0x08a4  [ DE604462206F7D8C203F767F425FCA8D, 149FBF6367C45415B939A9B1A7A10DA7A5E19F28CE533BCBE2B20DA4B78F8645 ] tib             C:\Windows\system32\DRIVERS\tib.sys
10:59:02.0965 0x08a4  tib - ok
10:59:02.0985 0x08a4  [ 3C29FB9FC9B4C511AD69DC50257FEC75, 4906DADE076FD363C53044C805602EEA4D0EF6E92041C693E1BED2286614B36E ] tib_mounter     C:\Windows\system32\DRIVERS\tib_mounter.sys
10:59:03.0015 0x08a4  tib_mounter - ok
10:59:03.0025 0x08a4  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
10:59:03.0065 0x08a4  TrkWks - ok
10:59:03.0085 0x08a4  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
10:59:03.0125 0x08a4  TrustedInstaller - ok
10:59:03.0135 0x08a4  [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
10:59:03.0155 0x08a4  tssecsrv - ok
10:59:03.0155 0x08a4  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
10:59:03.0185 0x08a4  TsUsbFlt - ok
10:59:03.0185 0x08a4  [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
10:59:03.0215 0x08a4  TsUsbGD - ok
10:59:03.0225 0x08a4  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
10:59:03.0265 0x08a4  tunnel - ok
10:59:03.0275 0x08a4  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
10:59:03.0295 0x08a4  uagp35 - ok
10:59:03.0315 0x08a4  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
10:59:03.0365 0x08a4  udfs - ok
10:59:03.0375 0x08a4  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
10:59:03.0405 0x08a4  UI0Detect - ok
10:59:03.0405 0x08a4  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
10:59:03.0435 0x08a4  uliagpkx - ok
10:59:03.0435 0x08a4  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
10:59:03.0465 0x08a4  umbus - ok
10:59:03.0475 0x08a4  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\drivers\umpass.sys
10:59:03.0485 0x08a4  UmPass - ok
10:59:03.0505 0x08a4  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
10:59:03.0535 0x08a4  UmRdpService - ok
10:59:03.0545 0x08a4  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
10:59:03.0615 0x08a4  upnphost - ok
10:59:03.0625 0x08a4  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
10:59:03.0645 0x08a4  usbccgp - ok
10:59:03.0655 0x08a4  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
10:59:03.0685 0x08a4  usbcir - ok
10:59:03.0685 0x08a4  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
10:59:03.0715 0x08a4  usbehci - ok
10:59:03.0735 0x08a4  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
10:59:03.0775 0x08a4  usbhub - ok
10:59:03.0785 0x08a4  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
10:59:03.0795 0x08a4  usbohci - ok
10:59:03.0805 0x08a4  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
10:59:03.0825 0x08a4  usbprint - ok
10:59:03.0835 0x08a4  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
10:59:03.0865 0x08a4  usbscan - ok
10:59:03.0875 0x08a4  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
10:59:03.0895 0x08a4  USBSTOR - ok
10:59:03.0905 0x08a4  [ 81FB2216D3A60D1284455D511797DB3D, 121E52B18A1832E775EA0AE2E053BAA53E5A70E9754724B1449AE5992D63B13E ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
10:59:03.0925 0x08a4  usbuhci - ok
10:59:03.0935 0x08a4  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
10:59:03.0975 0x08a4  UxSms - ok
10:59:03.0985 0x08a4  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc        C:\Windows\system32\lsass.exe
10:59:03.0995 0x08a4  VaultSvc - ok
10:59:04.0005 0x08a4  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
10:59:04.0025 0x08a4  vdrvroot - ok
10:59:04.0045 0x08a4  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
10:59:04.0105 0x08a4  vds - ok
10:59:04.0115 0x08a4  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
10:59:04.0135 0x08a4  vga - ok
10:59:04.0145 0x08a4  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
10:59:04.0185 0x08a4  VgaSave - ok
10:59:04.0195 0x08a4  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
10:59:04.0225 0x08a4  vhdmp - ok
10:59:04.0235 0x08a4  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
10:59:04.0255 0x08a4  viaide - ok
10:59:04.0265 0x08a4  [ 35E8A18D1C558D5C2FF2FFED2FD396F6, 5516AC03964DD33CF239AB3FB1D41BAB7454DB35FB38C45907614C3DB8F23391 ] vididr          C:\Windows\system32\DRIVERS\vididr.sys
10:59:04.0285 0x08a4  vididr - ok
10:59:04.0295 0x08a4  [ 0DCD5C8F2E0B3650C4A29F6569C074FD, 8FB24D79ADE1541C5DD6241A3395EF2E6575A8376111294CD5C87ECA798EDCFD ] vidsflt         C:\Windows\system32\DRIVERS\vidsflt.sys
10:59:04.0325 0x08a4  vidsflt - ok
10:59:04.0335 0x08a4  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
10:59:04.0365 0x08a4  vmbus - ok
10:59:04.0365 0x08a4  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
10:59:04.0385 0x08a4  VMBusHID - ok
10:59:04.0395 0x08a4  vmci - ok
10:59:04.0405 0x08a4  VMnetAdapter - ok
10:59:04.0415 0x08a4  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
10:59:04.0435 0x08a4  volmgr - ok
10:59:04.0455 0x08a4  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
10:59:04.0475 0x08a4  volmgrx - ok
10:59:04.0485 0x08a4  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
10:59:04.0515 0x08a4  volsnap - ok
10:59:04.0535 0x08a4  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
10:59:04.0555 0x08a4  vsmraid - ok
10:59:04.0605 0x08a4  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
10:59:04.0695 0x08a4  VSS - ok
10:59:04.0705 0x08a4  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
10:59:04.0725 0x08a4  vwifibus - ok
10:59:04.0745 0x08a4  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
10:59:04.0805 0x08a4  W32Time - ok
10:59:04.0815 0x08a4  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
10:59:04.0835 0x08a4  WacomPen - ok
10:59:04.0845 0x08a4  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
10:59:04.0895 0x08a4  WANARP - ok
10:59:04.0895 0x08a4  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
10:59:04.0935 0x08a4  Wanarpv6 - ok
10:59:04.0985 0x08a4  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
10:59:05.0045 0x08a4  wbengine - ok
10:59:05.0065 0x08a4  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
10:59:05.0105 0x08a4  WbioSrvc - ok
10:59:05.0115 0x08a4  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
10:59:05.0155 0x08a4  wcncsvc - ok
10:59:05.0165 0x08a4  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
10:59:05.0195 0x08a4  WcsPlugInService - ok
10:59:05.0205 0x08a4  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
10:59:05.0225 0x08a4  Wd - ok
10:59:05.0255 0x08a4  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
10:59:05.0305 0x08a4  Wdf01000 - ok
10:59:05.0315 0x08a4  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
10:59:05.0345 0x08a4  WdiServiceHost - ok
10:59:05.0355 0x08a4  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
10:59:05.0375 0x08a4  WdiSystemHost - ok
10:59:05.0385 0x08a4  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
10:59:05.0415 0x08a4  WebClient - ok
10:59:05.0425 0x08a4  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
10:59:05.0485 0x08a4  Wecsvc - ok
10:59:05.0495 0x08a4  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
10:59:05.0545 0x08a4  wercplsupport - ok
10:59:05.0555 0x08a4  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
10:59:05.0605 0x08a4  WerSvc - ok
10:59:05.0605 0x08a4  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
10:59:05.0645 0x08a4  WfpLwf - ok
10:59:05.0655 0x08a4  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
10:59:05.0675 0x08a4  WIMMount - ok
10:59:05.0675 0x08a4  WinDefend - ok
10:59:05.0695 0x08a4  WinHttpAutoProxySvc - ok
10:59:05.0715 0x08a4  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
10:59:05.0765 0x08a4  Winmgmt - ok
10:59:05.0825 0x08a4  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll
10:59:05.0935 0x08a4  WinRM - ok
10:59:05.0975 0x08a4  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
10:59:06.0035 0x08a4  Wlansvc - ok
10:59:06.0045 0x08a4  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
10:59:06.0065 0x08a4  WmiAcpi - ok
10:59:06.0075 0x08a4  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
10:59:06.0115 0x08a4  wmiApSrv - ok
10:59:06.0115 0x08a4  WMPNetworkSvc - ok
10:59:06.0125 0x08a4  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
10:59:06.0155 0x08a4  WPCSvc - ok
10:59:06.0155 0x08a4  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
10:59:06.0185 0x08a4  WPDBusEnum - ok
10:59:06.0195 0x08a4  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
10:59:06.0235 0x08a4  ws2ifsl - ok
10:59:06.0245 0x08a4  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
10:59:06.0275 0x08a4  wscsvc - ok
10:59:06.0285 0x08a4  WSearch - ok
10:59:06.0365 0x08a4  [ D9EF901DCA379CFE914E9FA13B73B4C4, 3BE9693B7B2AFEE23D72AF5DA211379724D752F0EC18ACB7D3DE3DDFC5AE0004 ] wuauserv        C:\Windows\system32\wuaueng.dll
10:59:06.0445 0x08a4  wuauserv - ok
10:59:06.0455 0x08a4  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
10:59:06.0475 0x08a4  WudfPf - ok
10:59:06.0495 0x08a4  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
10:59:06.0515 0x08a4  WUDFRd - ok
10:59:06.0525 0x08a4  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
10:59:06.0545 0x08a4  wudfsvc - ok
10:59:06.0565 0x08a4  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
10:59:06.0595 0x08a4  WwanSvc - ok
10:59:06.0615 0x08a4  [ 64F88AF327AA74E03658AE32B48CCB8B, 52C8941D96F2EF89BBC4A4268DC59E5BC89AE2DAB199C13BBFF11C2606BE7FFA ] yukonw7         C:\Windows\system32\DRIVERS\yk62x64.sys
10:59:06.0645 0x08a4  yukonw7 - ok
10:59:06.0655 0x08a4  ================ Scan global ===============================
10:59:06.0665 0x08a4  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
10:59:06.0685 0x08a4  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
10:59:06.0705 0x08a4  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
10:59:06.0725 0x08a4  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
10:59:06.0735 0x08a4  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
10:59:06.0765 0x08a4  [ Global ] - ok
10:59:06.0765 0x08a4  ================ Scan MBR ==================================
10:59:06.0765 0x08a4  [ B1F7D7F6E4FBE98E578562A22A94D02C ] \Device\Harddisk1\DR1
10:59:06.0835 0x08a4  \Device\Harddisk1\DR1 - ok
10:59:06.0835 0x08a4  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
10:59:06.0955 0x08a4  \Device\Harddisk0\DR0 - ok
10:59:06.0965 0x08a4  [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk4\DR4
10:59:07.0597 0x08a4  \Device\Harddisk4\DR4 - ok
10:59:07.0607 0x08a4  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk3\DR3
10:59:07.0745 0x08a4  \Device\Harddisk3\DR3 - ok
10:59:07.0746 0x08a4  ================ Scan VBR ==================================
10:59:07.0761 0x08a4  [ 93416C4F4919DCB9E8913CB43345747D ] \Device\Harddisk1\DR1\Partition1
10:59:07.0764 0x08a4  \Device\Harddisk1\DR1\Partition1 - ok
10:59:07.0773 0x08a4  [ D0CC4508BEFD39D2D8A46C584275193C ] \Device\Harddisk1\DR1\Partition2
10:59:07.0783 0x08a4  \Device\Harddisk1\DR1\Partition2 - ok
10:59:07.0797 0x08a4  [ 74D544922BD41B44CA2250B54B02305F ] \Device\Harddisk0\DR0\Partition1
10:59:07.0799 0x08a4  \Device\Harddisk0\DR0\Partition1 - ok
10:59:07.0819 0x08a4  [ FFA8AA61B2BE1D13CA505F8D1868E787 ] \Device\Harddisk0\DR0\Partition2
10:59:07.0821 0x08a4  \Device\Harddisk0\DR0\Partition2 - ok
10:59:07.0833 0x08a4  [ E59F10CF213373CE82AAB8AF8798AEA9 ] \Device\Harddisk4\DR4\Partition1
10:59:07.0899 0x08a4  \Device\Harddisk4\DR4\Partition1 - ok
10:59:07.0909 0x08a4  [ 590B980FC59474AFD91E0B675883679B ] \Device\Harddisk4\DR4\Partition2
10:59:07.0969 0x08a4  \Device\Harddisk4\DR4\Partition2 - ok
10:59:07.0979 0x08a4  [ 5EDD9E19F1CCE88FC469123EDA982E2B ] \Device\Harddisk4\DR4\Partition3
10:59:08.0039 0x08a4  \Device\Harddisk4\DR4\Partition3 - ok
10:59:08.0039 0x08a4  [ 9719782EBCF70342075E483FE0235EB8 ] \Device\Harddisk3\DR3\Partition1
10:59:08.0049 0x08a4  \Device\Harddisk3\DR3\Partition1 - ok
10:59:08.0049 0x08a4  ================ Scan generic autorun ======================
10:59:08.0069 0x08a4  [ 1E9B225DE829A6F666A0BA9B8A7984BF, 89D1222D72E23D21E6388B068CE7C415A9857ABB37D7A3AAD549B949A87E61FC ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
10:59:08.0099 0x08a4  avgnt - ok
10:59:08.0109 0x08a4  [ E18DA87960DB27144D31D2E944BD55A2, 4891AC03D59431DE9E568AB99705E73647C8ADC020B398E394BBEE7119868CCB ] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
10:59:08.0119 0x08a4  Avira Systray - ok
10:59:08.0159 0x08a4  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
10:59:08.0239 0x08a4  Sidebar - ok
10:59:08.0249 0x08a4  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
10:59:08.0269 0x08a4  mctadmin - ok
10:59:08.0309 0x08a4  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
10:59:08.0359 0x08a4  Sidebar - ok
10:59:08.0369 0x08a4  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
10:59:08.0389 0x08a4  mctadmin - ok
10:59:08.0459 0x08a4  [ 22F7B9670AD770C7ED7F4738204C8E5C, 7B793AC094CB1B073419B5DAE09DFBB8EBED03D29301F490AA76EA0667613438 ] C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
10:59:08.0529 0x08a4  HP Officejet Pro 8600 (NET) - ok
10:59:08.0539 0x08a4  Waiting for KSN requests completion. In queue: 39
10:59:09.0539 0x08a4  Waiting for KSN requests completion. In queue: 39
10:59:10.0539 0x08a4  Waiting for KSN requests completion. In queue: 39
10:59:11.0619 0x08a4  AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 14.0.5.376 ), 0x40000 ( disabled : updated )
10:59:11.0639 0x08a4  Win FW state via NFP2: enabled
10:59:14.0319 0x08a4  ============================================================
10:59:14.0319 0x08a4  Scan finished
10:59:14.0319 0x08a4  ============================================================
10:59:14.0329 0x0ef8  Detected object count: 0
10:59:14.0329 0x0ef8  Actual detected object count: 0

Malwarebytes findet auch nichts.

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org

Database version: v2014.07.20.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17207
*****:: JOH3 [administrator]

20.07.2014 11:09:49
mbar-log-2014-07-20 (11-09-49).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 278485
Time elapsed: 8 minute(s), 1 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

schrauber · 20.07.2014, 17:28

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

werjo · 20.07.2014, 19:37

Hallo Schrauber,

hier der Logfile von Combofix:

Code:

ATTFilter

ComboFix 14-07-19.01 - ***** 20.07.2014  20:06:34.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3967.2455 [GMT 2:00]
ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\*****\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.DEU
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\Adobe\Acrobat\ActiveX\PDFShell.DEU
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\DAO\dao360.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\1.7\Microsoft.Ink.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\ConvertInkStore.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\FlickLearningWizard.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\InkWatson.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\IPSEventLogMsg.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\IpsMigrationPlugin.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\micaut.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\mip.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\TipBand.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\FlickLearningWizard.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\InkDiv.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\InkObj.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\InkWatson.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\InputPersonalization.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\IPSEventLogMsg.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\IpsPlugin.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\journal.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\micaut.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\Microsoft.Ink.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\mip.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\mraut.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\mshwgst.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\mshwLatin.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\penchs.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\pencht.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\penjpn.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\penkor.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\penusa.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\pipanel.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\pipanel.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\pipres.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\rtscom.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\ShapeCollector.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\skchobj.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\skchui.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\sr-Latn-CS\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\TabIpsps.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\tabskb.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\TabTip.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\TipBand.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\TipRes.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\tipresx.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\tipskins.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\tiptsf.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\tpcps.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\MSInfo\msinfo32.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\microsoft shared\VGX\VGX.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSDecWrp.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\de-DE\msader15.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msader15.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado15.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado20.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado21.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado25.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado26.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado27.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado28.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msado60.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msadomd.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msadomd28.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msador15.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msador28.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msadox.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msadox28.tlb
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msadrh15.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\ado\msjro.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\de-DE\wab32res.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\DirectDB.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\de-DE\msadcer.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\de-DE\msadcfr.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\de-DE\msadcor.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\de-DE\msaddsr.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\de-DE\msdaprsr.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\de-DE\msdaremr.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadce.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadcer.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadcf.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadcfr.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadco.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadcor.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadcs.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msadds.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msaddsr.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msdaprsr.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msdaprst.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msdarem.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msdaremr.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\msadc\msdfmap.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\de-DE\msdaorar.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdadc.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdaenum.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdaer.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdaora.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdaorar.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdaosp.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdaps.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdasc.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdasql.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdasqlr.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdatl3.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdatt.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msdaurl.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\msxactps.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\oledb32.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\oledb32r.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\sqloledb.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\sqloledb.rll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\sqlxmlx.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\Ole DB\sqlxmlx.rll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\wab32.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Common Files\System\wab32res.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\audiodepthconverter.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\de-DE\DVDMaker.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\de-DE\OmdProject.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\de-DE\WMM2CLIP.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\directshowtap.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\DVDMaker.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\fieldswitch.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\offset.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\OmdBase.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\OmdProject.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\Pipeline.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\PipeTran.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\rtstreamsink.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\rtstreamsource.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\soniccolorconverter.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\sonicsptransform.ax
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\DVD Maker\WMM2CLIP.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\D3DCompiler_47.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\DiagnosticsTap.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\F12.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\F12Resources.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\F12Tools.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\iedvtool.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\ieinstal.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\iexplore.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\jsdbgui.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\jsprofilerui.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\de-DE\networkinspection.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\DiagnosticsHub.DataWarehouse.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\DiagnosticsHub_is.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\DiagnosticsTap.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\ExtExport.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\F12.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\F12Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\F12Tools.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\iediagcmd.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\iedvtool.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\ieinstal.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\ielowutil.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\ieproxy.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\IEShims.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\iessetup.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\iexplore.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\jsdbgui.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\jsdebuggeride.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\JSProfilerCore.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\jsprofilerui.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\MemoryAnalyzer.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\msdbg2.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\networkinspection.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\pdm.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\pdmproxy100.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\perf_nt.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\perfcore.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\sqmapi.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\Timeline.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Internet Explorer\Timeline_is.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\de-DE\MpAsDesc.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\de-DE\MpEvMsg.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\de-DE\MsMpRes.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpAsDesc.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpClient.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpCmdRun.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpCommu.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpEvMsg.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpOAV.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpRTP.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MpSvc.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MSASCui.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MsMpCom.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MsMpLics.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Defender\MsMpRes.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\de-DE\JNTFiltr.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\de-DE\jnwdui.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\de-DE\jnwmon.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\de-DE\Journal.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\de-DE\MSPVWCTL.DLL.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\de-DE\NBMapTIP.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\de-DE\PDIALOG.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\InkSeg.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\JNTFiltr.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\JNWDRV.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\jnwdui.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\jnwmon.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\jnwppr.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\Journal.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\MSPVWCTL.DLL
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\NBDoc.DLL
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\NBMapTIP.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Journal\PDIALOG.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\de-DE\msoeres.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\de-DE\WinMail.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\msoe.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\MSOERES.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\oeimport.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\wab.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\wabfind.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\wabimp.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\wabmig.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Mail\WinMail.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\mpvis.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\setup_wm.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\wmlaunch.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\WMPDMC.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\WMPDMCCore.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\wmplayer.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\WMPMediaSharing.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\wmpnetwk.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\wmpnscfg.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\wmpnssci.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\wmpnssui.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\de-DE\WMPSideShowGadget.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\mpvis.DLL
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\setup_wm.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmlaunch.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmpconfig.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\WMPDMC.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\WMPDMCCore.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmpenc.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmplayer.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\WMPMediaSharing.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmpnetwk.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmpnscfg.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmpnssci.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\WMPNSSUI.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmprph.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmpshare.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\WMPSideShowGadget.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Media Player\wmssetup.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows NT\Accessories\de-DE\wordpad.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows NT\Accessories\wordpad.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows NT\Accessories\WordpadFilter.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows NT\TableTextService\de-DE\TableTextService.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows NT\TableTextService\TableTextService.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\ImagingDevices.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\ImagingEngine.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\PhotoAcq.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\PhotoBase.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Photo Viewer\PhotoViewer.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Portable Devices\sqmapi.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Sidebar\de-DE\sbdrop.dll.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Sidebar\de-DE\Sidebar.exe.mui
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Sidebar\sbdrop.dll
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Sidebar\sidebar.exe
g:\$recycle.bin\S-1-5-21-1404765255-3134804277-747363654-1000\$RT9FMN3\Windows Sidebar\wlsrvc.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-06-20 bis 2014-07-20  ))))))))))))))))))))))))))))))
.
.
2014-07-20 18:15 . 2014-07-20 18:15	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-07-20 09:09 . 2014-07-20 09:18	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-07-19 08:26 . 2014-07-19 08:27	--------	d-----w-	C:\FRST
2014-07-16 19:05 . 2014-07-20 09:09	128728	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-07-16 19:04 . 2014-07-20 09:04	92888	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-07-16 19:04 . 2014-07-16 19:04	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2014-07-16 19:04 . 2014-07-16 19:04	--------	d-----w-	c:\programdata\Malwarebytes
2014-07-16 19:04 . 2014-05-12 05:26	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-07-16 19:04 . 2014-05-12 05:25	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-07-11 15:51 . 2014-06-17 00:57	10779000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{81BB320C-4CEA-4AF6-A36B-11CFF115CB93}\mpengine.dll
2014-07-11 15:49 . 2014-06-19 00:24	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2014-07-08 08:42 . 2014-07-08 10:35	--------	d-----w-	c:\program files\CCleaner
2014-07-07 10:39 . 2014-06-24 18:47	141376	----a-w-	c:\windows\system32\drivers\avfwot.sys
2014-07-07 10:39 . 2014-06-24 18:47	114608	----a-w-	c:\windows\system32\drivers\avfwim.sys
2014-06-25 20:14 . 2014-07-20 18:17	--------	d-----w-	c:\windows\system32\wbem\repository
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-11 15:52 . 2014-03-14 20:32	96441528	----a-w-	c:\windows\system32\MRT.exe
2014-07-10 11:04 . 2014-03-14 20:07	42040	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-07-03 14:51 . 2014-03-14 20:07	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-06-24 18:47 . 2014-03-14 20:07	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-06-24 18:47 . 2014-03-14 20:07	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-05-31 11:19 . 2014-05-31 11:19	367200	----a-w-	c:\windows\system32\drivers\afcdp.sys
2014-05-31 11:19 . 2014-05-31 11:19	198432	----a-w-	c:\windows\system32\drivers\tib_mounter.sys
2014-05-31 11:19 . 2014-05-31 11:19	1464096	----a-w-	c:\windows\system32\drivers\tdrpman.sys
2014-05-31 11:19 . 2014-05-31 11:19	161568	----a-w-	c:\windows\system32\drivers\vididr.sys
2014-05-31 11:19 . 2014-05-31 11:19	1120032	----a-w-	c:\windows\system32\drivers\tib.sys
2014-05-31 11:19 . 2014-05-31 11:19	117024	----a-w-	c:\windows\system32\drivers\vidsflt.sys
2014-05-31 11:19 . 2014-05-31 11:19	269600	----a-w-	c:\windows\system32\drivers\snapman.sys
2014-05-31 11:19 . 2014-05-31 11:19	116000	----a-w-	c:\windows\system32\drivers\fltsrv.sys
2014-04-25 02:34 . 2014-06-20 07:47	801280	----a-w-	c:\windows\system32\usp10.dll
2014-04-25 02:06 . 2014-06-20 07:47	626688	----a-w-	c:\windows\SysWow64\usp10.dll
2012-01-25 07:47 . 2014-05-31 20:58	397312	----a-w-	c:\program files (x86)\Fat32Formatter.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	131248	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Officejet Pro 8600 (NET)"="c:\program files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-06-24 750160]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-07-07 189520]
.
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
eudora.exe - Verknüpfung.lnk - c:\program files (x86)\Eudora\eudora.exe [2014-3-15 11285504]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NDAS Geräte-Manager.lnk - c:\program files\NDAS\System\ndasmgmt.exe /startup [2010-1-13 353792]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x]
S0 ndasfs;ndasfs;c:\windows\system32\DRIVERS\ndasfs.sys;c:\windows\SYSNATIVE\DRIVERS\ndasfs.sys [x]
S0 nvamacpi;NVIDIA Away Mode System;c:\windows\system32\DRIVERS\NVAMACPI.sys;c:\windows\SYSNATIVE\DRIVERS\NVAMACPI.sys [x]
S0 tib;Acronis TIB Manager;c:\windows\system32\DRIVERS\tib.sys;c:\windows\SYSNATIVE\DRIVERS\tib.sys [x]
S0 tib_mounter;Acronis TIB Mounter;c:\windows\system32\DRIVERS\tib_mounter.sys;c:\windows\SYSNATIVE\DRIVERS\tib_mounter.sys [x]
S0 vididr;Acronis Virtual Disk;c:\windows\system32\DRIVERS\vididr.sys;c:\windows\SYSNATIVE\DRIVERS\vididr.sys [x]
S0 vidsflt;Acronis Disk Storage Filter;c:\windows\system32\DRIVERS\vidsflt.sys;c:\windows\SYSNATIVE\DRIVERS\vidsflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 ndasfat;NDAS FAT File System Service;c:\windows\system32\DRIVERS\ndasfat.sys;c:\windows\SYSNATIVE\DRIVERS\ndasfat.sys [x]
S1 ndasrofs;NDAS ROFS File System Service;c:\windows\system32\DRIVERS\ndasrofs.sys;c:\windows\SYSNATIVE\DRIVERS\ndasrofs.sys [x]
S2 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [x]
S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 syncagentsrv;Acronis Sync Agent Service;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54	164016	----a-w-	c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:Tabs
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\09661llj.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} - (no file)
ShellIconOverlayIdentifiers-{00F848DC-B1D4-4892-9C25-CAADC86A215D} - (no file)
ShellIconOverlayIdentifiers-{71573297-552E-46fc-BE3D-3DFAF88D47B7} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-07-20  20:28:42 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-07-20 18:28
.
Vor Suchlauf: 7 Verzeichnis(se), 140.728.852.480 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 140.550.082.560 Bytes frei
.
- - End Of File - - D725207B45ECD83E3C35D1676228CD4F
A36C5E4F47E84449FF07ED3517B43A31

Gruß Jo

schrauber · 21.07.2014, 10:51

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

werjo · 21.07.2014, 21:23

Hallo Schrauber,

heute geht mal wieder fast nichts. Excel ist hängengeblieben, Mbam kann ich nicht starten, der Firefox läuft aber. Im abgesicherten Modus habe ich MBAM und den AdwCleaner laufen lassen. Im abgesicherten Modus mit Netz lief MBam übrigens auch nicht. Hier die Logs:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.07.2014
Suchlauf-Zeit: 21:49:42
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.07.16.07
Rootkit Datenbank: v2014.07.14.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: *****

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 285696
Verstrichene Zeit: 5 Min, 52 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 0
(No malicious items detected)

Physische Sektoren: 0
(No malicious items detected)


(end)

Code:

ATTFilter

# AdwCleaner v3.216 - Bericht erstellt am 21/07/2014 um 21:36:44
# Aktualisiert 17/07/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : ***** - JOH3
# Gestartet von : C:\Users\*****\Downloads\Virensoftware\adwcleaner_3.216.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\*****\AppData\Roaming\OCS
Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\ntoq5srb.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17207


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\09661llj.default\prefs.js ]


[ Datei : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\ntoq5srb.default\prefs.js ]

Zeile gelöscht : user_pref("keyword.URL", "hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=");

*************************

AdwCleaner[R0].txt - [1387 octets] - [21/07/2014 21:34:51]
AdwCleaner[S0].txt - [1262 octets] - [21/07/2014 21:36:44]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1322 octets] ##########

Wenn ich JRT starte kommt der Command-Schirm, aber es passiert gar nichts. Ist das normal? Ich habe als Admin gestartet und eine Taste gedrückt. Im Taskmanager wird jrt angezeigt, aber ohne Prozessoraktivität.

Hier noch der neue FRST log:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-07-2014 01
Ran by ***** (administrator) on JOH3 on 21-07-2014 22:05:47
Running from C:\Users\*****\Downloads\Virensoftware
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Safe Mode (minimal)


==================== Processes (Whitelisted) =================



==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [189520 2014-07-07] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1404765255-3134804277-747363654-1000\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-1404765255-3134804277-747363654-1000\...\RunOnce: [Report] - C:\AdwCleaner\AdwCleaner[S0].txt [1384 2014-07-21] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NDAS Geräte-Manager.lnk
ShortcutTarget: NDAS Geräte-Manager.lnk -> C:\Program Files\NDAS\System\ndasmgmt.exe (XIMETA, Inc.)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eudora.exe - Verknüpfung.lnk
ShortcutTarget: eudora.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Eudora\eudora.exe (Qualcomm Incorporated)
ShellIconOverlayIdentifiers: AcronisSyncError -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} =>  No File
ShellIconOverlayIdentifiers: AcronisSyncInProgress -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} =>  No File
ShellIconOverlayIdentifiers: AcronisSyncOk -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} =>  No File
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x40D36F41BC3ACF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\09661llj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [812624 2014-07-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1030224 2014-07-10] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-07] (Avira Operations GmbH & Co. KG)
S2 ndassvc; C:\Program Files\NDAS\System\ndassvc.exe [331752 2010-01-13] (XIMETA, Inc.)

==================== Drivers (Whitelisted) ====================

S2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-24] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-06-24] (Avira Operations GmbH & Co. KG)
S2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-10] (Avira Operations GmbH & Co. KG)
R0 lfsfilt; C:\Windows\System32\DRIVERS\lfsfilt.sys [738792 2010-01-13] (XIMETA, Inc.)
R0 lpx; C:\Windows\System32\DRIVERS\lpx6x.sys [151528 2010-01-13] (XIMETA, Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-21] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 ndasbus; C:\Windows\System32\DRIVERS\ndasbus.sys [497640 2010-01-13] (XIMETA, Inc.)
R1 ndasfat; C:\Windows\System32\DRIVERS\ndasfat.sys [607720 2010-01-13] (Windows (R) Codename Longhorn DDK provider)
R0 ndasfs; C:\Windows\System32\DRIVERS\ndasfs.sys [746472 2010-01-13] (XIMETA, Inc.)
R1 ndasrofs; C:\Windows\System32\DRIVERS\ndasrofs.sys [1053160 2010-01-13] (XIMETA, Inc.)
S3 ndasscsi; C:\Windows\System32\DRIVERS\ndasscsi.sys [486888 2010-01-13] (XIMETA, Inc.)
R0 nvamacpi; C:\Windows\System32\DRIVERS\NVAMACPI.sys [28192 2009-06-05] (NVIDIA Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-05-31] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-05-31] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-05-31] (Acronis International GmbH)
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-21 21:34 - 2014-07-21 21:36 - 00000000 ____D () C:\AdwCleaner
2014-07-20 20:28 - 2014-07-20 20:28 - 00062675 _____ () C:\ComboFix.txt
2014-07-20 20:05 - 2014-07-20 20:29 - 00000000 ____D () C:\Qoobox
2014-07-20 20:05 - 2014-07-20 20:29 - 00000000 ____D () C:\ComboFix
2014-07-20 20:05 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-07-20 20:05 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-20 20:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-20 20:04 - 2014-07-20 20:26 - 00000000 ____D () C:\Windows\erdnt
2014-07-20 11:09 - 2014-07-20 11:18 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-07-19 11:22 - 2014-07-19 11:22 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-07-19 10:26 - 2014-07-21 22:05 - 00000000 ____D () C:\FRST
2014-07-19 10:22 - 2014-07-21 22:05 - 00000000 ____D () C:\Users\*****\Downloads\Virensoftware
2014-07-19 10:20 - 2014-07-19 10:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-07-18 21:45 - 2014-07-21 21:38 - 00002322 _____ () C:\Windows\PFRO.log
2014-07-18 21:45 - 2014-07-21 20:38 - 00000840 _____ () C:\Windows\setupact.log
2014-07-18 21:45 - 2014-07-20 22:16 - 00048190 _____ () C:\Windows\WindowsUpdate.log
2014-07-18 21:45 - 2014-07-18 21:45 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-16 21:05 - 2014-07-21 21:49 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-16 21:04 - 2014-07-20 11:04 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-16 21:04 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-16 21:03 - 2014-07-16 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-11 17:50 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-11 17:50 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-11 17:50 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 17:50 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-11 17:50 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 17:50 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-11 17:50 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-11 17:50 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 17:50 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-11 17:50 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-11 17:50 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-11 17:50 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-11 17:50 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 17:50 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-11 17:50 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-11 17:50 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 17:50 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-11 17:50 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-11 17:50 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-11 17:50 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-11 17:50 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-11 17:50 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 17:50 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-11 17:50 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-11 17:50 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-11 17:50 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 17:50 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-11 17:50 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-11 17:50 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-11 17:50 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-11 17:50 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-11 17:50 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-11 17:50 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-11 17:50 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-11 17:50 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-11 17:50 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 17:50 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-11 17:50 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-11 17:50 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-11 17:50 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-11 17:50 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 17:50 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-11 17:50 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-11 17:50 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-11 17:49 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 17:49 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 17:49 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-11 17:49 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 17:49 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-11 17:49 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-11 17:49 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-11 17:49 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 17:49 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 17:49 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-11 17:49 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 17:49 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-11 17:49 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-11 17:49 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-11 17:49 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 17:49 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 17:49 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-11 17:49 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-11 17:49 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-11 17:49 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-11 17:49 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 17:49 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-07-11 17:49 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-07-09 16:41 - 2014-07-09 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-08 18:06 - 2014-07-08 18:06 - 00000000 ____D () C:\Windows\pss
2014-07-08 12:35 - 2014-07-08 12:35 - 00002778 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 10:42 - 2014-07-08 12:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 10:42 - 2014-07-08 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-07 12:39 - 2014-06-24 20:47 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2014-07-07 12:39 - 2014-06-24 20:47 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2014-07-02 19:32 - 2014-07-02 20:35 - 01350074 _____ () C:\Users\*****\Documents\Fledermäuse.pptx

==================== One Month Modified Files and Folders =======

2014-07-21 22:05 - 2014-07-19 10:26 - 00000000 ____D () C:\FRST
2014-07-21 22:05 - 2014-07-19 10:22 - 00000000 ____D () C:\Users\*****\Downloads\Virensoftware
2014-07-21 21:49 - 2014-07-16 21:05 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-21 21:38 - 2014-07-18 21:45 - 00002322 _____ () C:\Windows\PFRO.log
2014-07-21 21:36 - 2014-07-21 21:34 - 00000000 ____D () C:\AdwCleaner
2014-07-21 20:43 - 2011-04-12 09:43 - 00989932 _____ () C:\Windows\system32\perfh007.dat
2014-07-21 20:43 - 2011-04-12 09:43 - 00239592 _____ () C:\Windows\system32\perfc007.dat
2014-07-21 20:43 - 2009-07-14 07:13 - 00006224 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-21 20:38 - 2014-07-18 21:45 - 00000840 _____ () C:\Windows\setupact.log
2014-07-21 20:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-20 22:16 - 2014-07-18 21:45 - 00048190 _____ () C:\Windows\WindowsUpdate.log
2014-07-20 20:38 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-20 20:38 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-20 20:29 - 2014-07-20 20:05 - 00000000 ____D () C:\Qoobox
2014-07-20 20:29 - 2014-07-20 20:05 - 00000000 ____D () C:\ComboFix
2014-07-20 20:28 - 2014-07-20 20:28 - 00062675 _____ () C:\ComboFix.txt
2014-07-20 20:26 - 2014-07-20 20:04 - 00000000 ____D () C:\Windows\erdnt
2014-07-20 20:18 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-20 18:51 - 2014-03-15 03:53 - 00000000 ____D () C:\KonrexSpTmp
2014-07-20 11:18 - 2014-07-20 11:09 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-07-20 11:04 - 2014-07-16 21:04 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-19 11:22 - 2014-07-19 11:22 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-07-19 10:20 - 2014-07-19 10:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-07-19 10:20 - 2014-03-02 14:24 - 00000000 ____D () C:\Users\*****
2014-07-18 21:45 - 2014-07-18 21:45 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-17 22:19 - 2014-03-16 17:51 - 00000000 ___RD () C:\Users\*****\Documents\Dropbox
2014-07-17 17:35 - 2014-05-16 06:57 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DropboxMaster
2014-07-17 17:35 - 2014-03-15 02:18 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-16 21:03 - 2014-07-16 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-16 19:31 - 2011-10-31 19:42 - 00002336 ____H () C:\Users\*****\Documents\Default.rdp
2014-07-15 17:58 - 2014-04-16 18:06 - 00108048 _____ () C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-15 17:58 - 2014-04-16 18:06 - 00108048 _____ () C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-15 17:58 - 2014-03-14 22:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-07-15 17:58 - 2014-03-14 22:03 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-07-15 17:58 - 2014-03-14 21:59 - 00000000 ____D () C:\ProgramData\Package Cache
2014-07-14 20:52 - 2014-03-16 17:51 - 00000000 ____D () C:\Users\*****\Documents\Briefkasten *****
2014-07-12 16:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-11 17:57 - 2009-07-14 06:45 - 00415856 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 17:53 - 2014-03-14 22:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 17:52 - 2014-03-14 22:32 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-11 17:51 - 2014-03-15 00:33 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-10 13:04 - 2014-03-14 22:07 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-09 22:51 - 2014-04-01 18:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-09 16:41 - 2014-07-09 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-08 18:06 - 2014-07-08 18:06 - 00000000 ____D () C:\Windows\pss
2014-07-08 12:55 - 2014-03-16 18:20 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-07-08 12:55 - 2014-03-16 18:10 - 00000000 ____D () C:\Users\*****\AppData\Local\MigWiz
2014-07-08 12:55 - 2014-03-02 13:07 - 00000000 ____D () C:\Windows\Panther
2014-07-08 12:35 - 2014-07-08 12:35 - 00002778 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 12:35 - 2014-07-08 10:42 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 10:45 - 2014-03-17 22:27 - 00000000 ____D () C:\Windows\Minidump
2014-07-08 10:42 - 2014-07-08 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-07 16:48 - 2014-03-15 02:33 - 00000000 ____D () C:\Program Files (x86)\Eudora
2014-07-07 12:39 - 2014-03-14 22:03 - 00000000 ____D () C:\ProgramData\Avira
2014-07-03 19:27 - 2014-05-30 15:40 - 00000000 ____D () C:\Users\*****\Documents\LUCA
2014-07-03 16:51 - 2014-03-14 22:07 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-07-02 20:35 - 2014-07-02 19:32 - 01350074 _____ () C:\Users\*****\Documents\Fledermäuse.pptx
2014-07-01 22:35 - 2014-03-16 17:53 - 00000000 ____D () C:\Users\*****\Documents\Finanzen
2014-06-30 20:22 - 2014-03-16 17:51 - 00000000 ____D () C:\Users\*****\Documents\Belgische Siedlung Banking
2014-06-25 22:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-06-24 20:47 - 2014-07-07 12:39 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2014-06-24 20:47 - 2014-07-07 12:39 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2014-06-24 20:47 - 2014-03-14 22:07 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-24 20:47 - 2014-03-14 22:07 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-06-21 13:33 - 2010-12-04 23:50 - 00108048 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-21 13:32 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-19 14:22

==================== End Of Log ============================

--- --- ---

Gruß Jo

schrauber · 22.07.2014, 11:15

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

werjo · 23.07.2014, 22:42

Hallo Schrauber,

der Eset-Scanner hat nun 25 Stunden gesucht und hängt seit 12 Stunden bei 58 Prozent. Es werden zip-Files auf meiner recht großen Netzplatte gescannt.
Ich hab erst einmal abgebrochen und lasse noch einmal ohne die Netzplatte suchen.

Hier aber das Logfile des abgebrochnenen Scans.

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=04d0e49f661ae9479641d1231db3937c
# engine=19295
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-07-23 05:19:30
# local_time=2014-07-23 07:19:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1802 16775165 100 97 90883 149404706 83683 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 379353 157765820 0 0
# scanned=198952
# found=14
# cleaned=0
# scan_time=3088
sh=7852C5F493F488BED909F5BFB45FBF71A9E9CA67 ft=1 fh=e2c3dc31affbe4f9 vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\*****\Downloads\Fat32Formatter 1.1.exe"
sh=30BC4F880B295212C1C77E0B3AE398CB48122408 ft=1 fh=c8e987e4eaaea57c vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\*****\Downloads\HDD Health - CHIP-Installer.exe"
sh=4921975356EA5EF8DB7AB792808A64D40EE0B8F0 ft=1 fh=e31907dbfa885ec8 vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\*****\Downloads\Unlocker-lnstall.exe"
sh=FF2D9CD879A9556B88640348CBB517352E2EC7AB ft=1 fh=f75a6abb90fb7270 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="E:\$RECYCLE.BIN\$RONGRJA\ex-dtaus-Downloader.exe"
sh=B1CE219B0CA6EBD5CC6246BBCBF517DEF348C6B9 ft=1 fh=c353f9ccd204e968 vn="Win32/StartPage.OIE Trojaner" ac=I fn="E:\$RECYCLE.BIN\$RONGRJA\PDFCreator-1_0_2_setup.exe"
sh=3B5EC3C4846A0ECAE5B2CD57D47BD6AE405821E0 ft=1 fh=760cfdeaf0dcb984 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="E:\$RECYCLE.BIN\$RONGRJA\Vollversion Ashampoo WinOptimizer 2014 - CHIP-Installer.exe"
sh=FF2D9CD879A9556B88640348CBB517352E2EC7AB ft=1 fh=f75a6abb90fb7270 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="G:\Setup\ex-dtaus-Downloader.exe"
sh=B1CE219B0CA6EBD5CC6246BBCBF517DEF348C6B9 ft=1 fh=c353f9ccd204e968 vn="Win32/StartPage.OIE Trojaner" ac=I fn="G:\Setup\PDFCreator-1_0_2_setup.exe"
sh=3B5EC3C4846A0ECAE5B2CD57D47BD6AE405821E0 ft=1 fh=760cfdeaf0dcb984 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="G:\Setup\Vollversion Ashampoo WinOptimizer 2014 - CHIP-Installer.exe"
sh=FF2D9CD879A9556B88640348CBB517352E2EC7AB ft=1 fh=f75a6abb90fb7270 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="H:\$RECYCLE.BIN\$RVYU05W\ex-dtaus-Downloader.exe"
sh=B1CE219B0CA6EBD5CC6246BBCBF517DEF348C6B9 ft=1 fh=c353f9ccd204e968 vn="Win32/StartPage.OIE Trojaner" ac=I fn="H:\$RECYCLE.BIN\$RVYU05W\PDFCreator-1_0_2_setup.exe"
sh=9EBBB1A6B7975D470DBFB080055F799AE6062421 ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="J:\JOH3\Backup Set 2014-03-20 192033\Backup Files 2014-03-20 192033\Backup files 34.zip"
sh=FEA288E2000A715067358378406E5D4D14CCB1C8 ft=0 fh=0000000000000000 vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="J:\JOH3\Backup Set 2014-03-20 192033\Backup Files 2014-05-08 214426\Backup files 1.zip"
sh=BC926AD1627BB69471B56E98409F23F53C9EA66F ft=0 fh=0000000000000000 vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="J:\JOH3\Backup Set 2014-06-01 190009\Backup Files 2014-06-01 190009\Backup files 54.zip"

Gruß Jo

Hallo Schrauber,

hier noch der Log von Securitycheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.85  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
  Adobe Flash Player 12.0.0.77 Flash Player out of Date!  
 Adobe Reader XI  
 Mozilla Firefox (30.0) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

und eine neur FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2014 01
Ran by ***** (administrator) on JOH3 on 23-07-2014 23:40:46
Running from C:\Users\*****\Downloads\Virensoftware
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(XIMETA, Inc.) C:\Program Files\NDAS\System\ndassvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(XIMETA, Inc.) C:\Program Files\NDAS\System\ndasmgmt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [189520 2014-07-07] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1404765255-3134804277-747363654-1000\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NDAS Geräte-Manager.lnk
ShortcutTarget: NDAS Geräte-Manager.lnk -> C:\Program Files\NDAS\System\ndasmgmt.exe (XIMETA, Inc.)
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eudora.exe - Verknüpfung.lnk
ShortcutTarget: eudora.exe - Verknüpfung.lnk -> C:\Program Files (x86)\Eudora\eudora.exe (Qualcomm Incorporated)
ShellIconOverlayIdentifiers: AcronisSyncError -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} =>  No File
ShellIconOverlayIdentifiers: AcronisSyncInProgress -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} =>  No File
ShellIconOverlayIdentifiers: AcronisSyncOk -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} =>  No File
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x40D36F41BC3ACF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\09661llj.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~3\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [812624 2014-07-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1030224 2014-07-10] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-07] (Avira Operations GmbH & Co. KG)
R2 ndassvc; C:\Program Files\NDAS\System\ndassvc.exe [331752 2010-01-13] (XIMETA, Inc.)

==================== Drivers (Whitelisted) ====================

R2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-10] (Avira Operations GmbH & Co. KG)
R0 lfsfilt; C:\Windows\System32\DRIVERS\lfsfilt.sys [738792 2010-01-13] (XIMETA, Inc.)
R0 lpx; C:\Windows\System32\DRIVERS\lpx6x.sys [151528 2010-01-13] (XIMETA, Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-21] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R3 ndasbus; C:\Windows\System32\DRIVERS\ndasbus.sys [497640 2010-01-13] (XIMETA, Inc.)
R1 ndasfat; C:\Windows\System32\DRIVERS\ndasfat.sys [607720 2010-01-13] (Windows (R) Codename Longhorn DDK provider)
R0 ndasfs; C:\Windows\System32\DRIVERS\ndasfs.sys [746472 2010-01-13] (XIMETA, Inc.)
R1 ndasrofs; C:\Windows\System32\DRIVERS\ndasrofs.sys [1053160 2010-01-13] (XIMETA, Inc.)
S3 ndasscsi; C:\Windows\System32\DRIVERS\ndasscsi.sys [486888 2010-01-13] (XIMETA, Inc.)
R0 nvamacpi; C:\Windows\System32\DRIVERS\NVAMACPI.sys [28192 2009-06-05] (NVIDIA Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-05-31] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-05-31] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-05-31] (Acronis International GmbH)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-23 23:32 - 2014-07-23 23:32 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-21 21:34 - 2014-07-21 21:36 - 00000000 ____D () C:\AdwCleaner
2014-07-20 20:28 - 2014-07-20 20:28 - 00062675 _____ () C:\ComboFix.txt
2014-07-20 20:05 - 2014-07-20 20:29 - 00000000 ____D () C:\Qoobox
2014-07-20 20:05 - 2014-07-20 20:29 - 00000000 ____D () C:\ComboFix
2014-07-20 20:05 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-07-20 20:05 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-07-20 20:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-07-20 20:05 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-07-20 20:04 - 2014-07-20 20:26 - 00000000 ____D () C:\Windows\erdnt
2014-07-20 11:09 - 2014-07-20 11:18 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-07-19 11:22 - 2014-07-19 11:22 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-07-19 10:26 - 2014-07-23 23:40 - 00000000 ____D () C:\FRST
2014-07-19 10:22 - 2014-07-23 23:40 - 00000000 ____D () C:\Users\*****\Downloads\Virensoftware
2014-07-19 10:20 - 2014-07-19 10:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-07-18 21:45 - 2014-07-23 23:33 - 00080391 _____ () C:\Windows\WindowsUpdate.log
2014-07-18 21:45 - 2014-07-23 23:28 - 00001008 _____ () C:\Windows\setupact.log
2014-07-18 21:45 - 2014-07-21 21:38 - 00002322 _____ () C:\Windows\PFRO.log
2014-07-18 21:45 - 2014-07-18 21:45 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-16 21:05 - 2014-07-21 21:49 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-16 21:04 - 2014-07-20 11:04 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-07-16 21:04 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-07-16 21:03 - 2014-07-16 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-11 17:50 - 2014-06-20 22:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-07-11 17:50 - 2014-06-20 21:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-11 17:50 - 2014-06-19 03:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-11 17:50 - 2014-06-19 03:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-11 17:50 - 2014-06-19 02:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-11 17:50 - 2014-06-19 02:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-11 17:50 - 2014-06-19 02:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-11 17:50 - 2014-06-19 02:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-11 17:50 - 2014-06-19 02:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-11 17:50 - 2014-06-19 02:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-11 17:50 - 2014-06-19 02:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-11 17:50 - 2014-06-19 02:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-11 17:50 - 2014-06-19 02:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-11 17:50 - 2014-06-19 01:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-11 17:50 - 2014-06-19 01:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-11 17:50 - 2014-06-19 01:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-11 17:50 - 2014-06-19 01:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-11 17:50 - 2014-06-19 01:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-11 17:50 - 2014-06-19 01:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-11 17:50 - 2014-06-19 01:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-11 17:50 - 2014-06-19 01:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-11 17:50 - 2014-06-19 01:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-11 17:50 - 2014-06-19 01:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-11 17:50 - 2014-06-19 01:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-11 17:50 - 2014-06-19 01:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-11 17:50 - 2014-06-19 01:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-11 17:50 - 2014-06-19 01:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-11 17:50 - 2014-06-19 01:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-11 17:50 - 2014-06-19 01:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-11 17:50 - 2014-06-19 01:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-11 17:50 - 2014-06-19 01:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-11 17:50 - 2014-06-19 01:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-11 17:50 - 2014-06-19 00:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-11 17:50 - 2014-06-19 00:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-11 17:50 - 2014-06-19 00:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-11 17:50 - 2014-06-19 00:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-11 17:50 - 2014-06-19 00:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-11 17:50 - 2014-06-19 00:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-11 17:50 - 2014-06-19 00:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-11 17:50 - 2014-06-19 00:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-11 17:50 - 2014-06-19 00:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-11 17:50 - 2014-06-19 00:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-11 17:50 - 2014-06-19 00:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-11 17:50 - 2014-06-19 00:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-11 17:49 - 2014-06-19 03:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-11 17:49 - 2014-06-19 02:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-11 17:49 - 2014-06-19 02:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-11 17:49 - 2014-06-19 02:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-11 17:49 - 2014-06-19 02:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-11 17:49 - 2014-06-19 02:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-11 17:49 - 2014-06-19 01:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-11 17:49 - 2014-06-19 01:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-11 17:49 - 2014-06-19 01:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-11 17:49 - 2014-06-19 01:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-11 17:49 - 2014-06-19 00:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-11 17:49 - 2014-06-19 00:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-11 17:49 - 2014-06-18 04:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-07-11 17:49 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-11 17:49 - 2014-06-18 03:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-07-11 17:49 - 2014-06-06 12:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-07-11 17:49 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-11 17:49 - 2014-06-05 16:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-07-11 17:49 - 2014-06-05 16:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-11 17:49 - 2014-06-05 16:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-11 17:49 - 2014-05-30 08:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-07-11 17:49 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-07-11 17:49 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-07-09 16:41 - 2014-07-09 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-08 18:06 - 2014-07-08 18:06 - 00000000 ____D () C:\Windows\pss
2014-07-08 12:35 - 2014-07-08 12:35 - 00002778 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 10:42 - 2014-07-08 12:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 10:42 - 2014-07-08 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-07 12:39 - 2014-06-24 20:47 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2014-07-07 12:39 - 2014-06-24 20:47 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2014-07-02 19:32 - 2014-07-02 20:35 - 01350074 _____ () C:\Users\*****\Documents\Fledermäuse.pptx

==================== One Month Modified Files and Folders =======

2014-07-23 23:40 - 2014-07-19 10:26 - 00000000 ____D () C:\FRST
2014-07-23 23:40 - 2014-07-19 10:22 - 00000000 ____D () C:\Users\*****\Downloads\Virensoftware
2014-07-23 23:36 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-23 23:36 - 2009-07-14 06:45 - 00020304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-23 23:33 - 2014-07-18 21:45 - 00080391 _____ () C:\Windows\WindowsUpdate.log
2014-07-23 23:33 - 2011-04-12 09:43 - 01062642 _____ () C:\Windows\system32\perfh007.dat
2014-07-23 23:33 - 2011-04-12 09:43 - 00262182 _____ () C:\Windows\system32\perfc007.dat
2014-07-23 23:33 - 2009-07-14 07:13 - 00006224 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-23 23:32 - 2014-07-23 23:32 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-23 23:28 - 2014-07-18 21:45 - 00001008 _____ () C:\Windows\setupact.log
2014-07-23 23:28 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-21 21:49 - 2014-07-16 21:05 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-07-21 21:38 - 2014-07-18 21:45 - 00002322 _____ () C:\Windows\PFRO.log
2014-07-21 21:36 - 2014-07-21 21:34 - 00000000 ____D () C:\AdwCleaner
2014-07-20 20:29 - 2014-07-20 20:05 - 00000000 ____D () C:\Qoobox
2014-07-20 20:29 - 2014-07-20 20:05 - 00000000 ____D () C:\ComboFix
2014-07-20 20:28 - 2014-07-20 20:28 - 00062675 _____ () C:\ComboFix.txt
2014-07-20 20:26 - 2014-07-20 20:04 - 00000000 ____D () C:\Windows\erdnt
2014-07-20 20:18 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-07-20 18:51 - 2014-03-15 03:53 - 00000000 ____D () C:\KonrexSpTmp
2014-07-20 11:18 - 2014-07-20 11:09 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-07-20 11:04 - 2014-07-16 21:04 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-07-19 11:22 - 2014-07-19 11:22 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-07-19 10:20 - 2014-07-19 10:20 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-07-19 10:20 - 2014-03-02 14:24 - 00000000 ____D () C:\Users\*****
2014-07-18 21:45 - 2014-07-18 21:45 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-17 22:19 - 2014-03-16 17:51 - 00000000 ___RD () C:\Users\*****\Documents\Dropbox
2014-07-17 17:35 - 2014-05-16 06:57 - 00000000 ____D () C:\Users\*****\AppData\Roaming\DropboxMaster
2014-07-17 17:35 - 2014-03-15 02:18 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-07-16 21:04 - 2014-07-16 21:04 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-07-16 21:03 - 2014-07-16 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.2.1012.exe
2014-07-16 19:31 - 2011-10-31 19:42 - 00002336 ____H () C:\Users\*****\Documents\Default.rdp
2014-07-15 17:58 - 2014-04-16 18:06 - 00108048 _____ () C:\Users\Default\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-15 17:58 - 2014-04-16 18:06 - 00108048 _____ () C:\Users\Default User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-07-15 17:58 - 2014-03-14 22:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-07-15 17:58 - 2014-03-14 22:03 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-07-15 17:58 - 2014-03-14 21:59 - 00000000 ____D () C:\ProgramData\Package Cache
2014-07-14 20:52 - 2014-03-16 17:51 - 00000000 ____D () C:\Users\*****\Documents\Briefkasten *****
2014-07-12 16:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-11 17:57 - 2009-07-14 06:45 - 00415856 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-11 17:53 - 2014-03-14 22:32 - 00000000 ____D () C:\Windows\system32\MRT
2014-07-11 17:52 - 2014-03-14 22:32 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-07-11 17:51 - 2014-03-15 00:33 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-07-10 13:04 - 2014-03-14 22:07 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-09 22:51 - 2014-04-01 18:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-09 16:41 - 2014-07-09 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-08 18:06 - 2014-07-08 18:06 - 00000000 ____D () C:\Windows\pss
2014-07-08 12:55 - 2014-03-16 18:20 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-07-08 12:55 - 2014-03-16 18:10 - 00000000 ____D () C:\Users\*****\AppData\Local\MigWiz
2014-07-08 12:55 - 2014-03-02 13:07 - 00000000 ____D () C:\Windows\Panther
2014-07-08 12:35 - 2014-07-08 12:35 - 00002778 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-07-08 12:35 - 2014-07-08 10:42 - 00000000 ____D () C:\Program Files\CCleaner
2014-07-08 10:45 - 2014-03-17 22:27 - 00000000 ____D () C:\Windows\Minidump
2014-07-08 10:42 - 2014-07-08 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-07-07 16:48 - 2014-03-15 02:33 - 00000000 ____D () C:\Program Files (x86)\Eudora
2014-07-07 12:39 - 2014-03-14 22:03 - 00000000 ____D () C:\ProgramData\Avira
2014-07-03 19:27 - 2014-05-30 15:40 - 00000000 ____D () C:\Users\*****\Documents\LUCA
2014-07-03 16:51 - 2014-03-14 22:07 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-07-02 20:35 - 2014-07-02 19:32 - 01350074 _____ () C:\Users\*****\Documents\Fledermäuse.pptx
2014-07-01 22:35 - 2014-03-16 17:53 - 00000000 ____D () C:\Users\*****\Documents\Finanzen
2014-06-30 20:22 - 2014-03-16 17:51 - 00000000 ____D () C:\Users\*****\Documents\Belgische Siedlung Banking
2014-06-25 22:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-06-24 20:47 - 2014-07-07 12:39 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2014-06-24 20:47 - 2014-07-07 12:39 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2014-06-24 20:47 - 2014-03-14 22:07 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-24 20:47 - 2014-03-14 22:07 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-19 14:22

==================== End Of Log ============================

--- --- ---

--- --- ---

Gruß Jo

schrauber · 24.07.2014, 19:09

Wie du im Log von ESET siehst sind die externen Platten zugemüllt.

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

werjo · 29.07.2014, 20:33

Hallo schrauber,

bis jetzt ist kein Hänger mehr aufgetaucht und der Rechner läuft stabil. Da ich die Probleme in großen Abständen hatte, möchte ich mich nicht zu früh freuen.
Aber schon einmal herzlichen Dank für die Hilfe!

schrauber · 30.07.2014, 14:17

Gern Geschehen

30.07.2014, 14:17	#12
schrauber /// the machine /// TB-Ausbilder	Win7-64 Rechner läuft einmal wöchentlich extrem verlangsamt und hängt sich auf Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Win7-64 Rechner läuft einmal wöchentlich extrem verlangsamt und hängt sich auf

Log-Analyse und Auswertung: Win7-64 Rechner läuft einmal wöchentlich extrem verlangsamt und hängt sich auf