| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.12.2014, 03:52
| #1 |
| |  Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" Ich habe seit neustem die Meldung "Ihr Computer wird in unter einer Minute heruntergefahren" Leider habe ich auch nur den Windows Defender installiert gehabt... vielleicht war das ein Fehler. Ich habe auch keine Keygens oder gecrackte Software auf dem Computer außer towelroot. Und das ist schon lange her. Das Einfallstor könnte ein vor kurzem installiertes Java plugin für Firefox sein  ????Habe es wieder rausgeschmissen aber wohl zu spät. Hier die Logs. bei GMER gab es Probleme weil es nicht auf NTusers.dat und auf den C:\Windows\System32\Config\System hat zugreifen können. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 02
Ran by AR (administrator) on ONYX on 08-12-2014 02:50:55
Running from C:\Users\AR\Downloads
Loaded Profiles: UpdatusUser & AR (Available profiles: UpdatusUser & AR)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
(Embarcadero Technologies, Inc.) C:\Delphi\InterBaseXE3\bin\ibguard.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Embarcadero Technologies, Inc.) C:\Delphi\InterBaseXE3\bin\ibserver.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QuickAccess.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Spotify Ltd) C:\Users\AR\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Dropbox, Inc.) C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
() C:\Android-SDK\adt-bundle-windows-x86_64-20140702\sdk\platform-tools\adb.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13647576 2013-08-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2773232 2014-09-16] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [133760 2013-12-24] ( (Atheros Communications))
HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Run: [Spotify Web Helper] => C:\Users\AR\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-11] (Spotify Ltd)
HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [468192 2014-10-15] (Sony)
HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\MountPoints2: {b635b6dc-40df-11e4-825f-202564942c7c} - "G:\Startme.exe"
HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\MountPoints2: {f42be8b0-cace-11e3-8252-806e6f6e6963} - "D:\wubi.exe"
Startup: C:\Users\AR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=ACJB
HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
URLSearchHook: [S-1-5-21-1591653119-3682044142-3444803271-1001] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002 -> DefaultScope {43A9E85B-6778-4F9C-94DA-3471D0EC462D} URL =
SearchScopes: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002 -> {43A9E85B-6778-4F9C-94DA-3471D0EC462D} URL =
SearchScopes: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: PDF Architect Helper -> {691B33B0-B86E-47F3-81C7-56E4FE3B929C} -> C:\Program Files (x86)\PDF Architect 2\creator-ie-helper.dll (pdfforge GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files (x86)\PDF Architect 2\creator-ie-plugin.dll (pdfforge GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default
FF DefaultSearchEngine: Startpage HTTPS - Deutsch
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Homepage: https://startpage.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH)
FF Plugin HKU\S-1-5-21-1591653119-3682044142-3444803271-1002: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC)
FF SearchPlugin: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\searchplugins\startpage-https---deutsch.xml
FF Extension: FoxVox - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\foxvox@wordit.com [2014-09-28]
FF Extension: HTTPS-Everywhere - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\https-everywhere@eff.org [2014-10-16]
FF Extension: ProxTube - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\ich@maltegoetz.de.xpi [2014-11-29]
FF Extension: Lightbeam - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2014-09-20]
FF Extension: Adblock Plus - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-17]
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_2_conv@pdfarchitect.org] - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension
FF Extension: PDF Architect 2 Creator - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension [2014-12-02]
FF HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-21]
CHR Extension: (Google Docs) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-21]
CHR Extension: (Google Drive) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-21]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-21]
CHR Extension: (YouTube) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-21]
CHR Extension: (Google-Suche) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-21]
CHR Extension: (Google Tabellen) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-21]
CHR Extension: (Google Wallet) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-21]
CHR Extension: (Google Mail) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-21]
CHR HKLM-x32\...\Chrome\Extension: [ihenkjeihefokohmemphikjnjbmegdik] - "C:\Program Files (x86)\Sony\Media Go\MediaGoDetector.crx" [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [318592 2013-12-24] (Windows (R) Win 7 DDK provider)
R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [3058944 2014-08-06] (Acer Incorporated)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2577640 2013-12-04] (Acer Incorporated)
R2 IBG_gds_db; C:\Delphi\InterBaseXE3\bin\ibguard.exe [636744 2014-03-24] (Embarcadero Technologies, Inc.)
R3 IBS_gds_db; C:\Delphi\InterBaseXE3\bin\ibserver.exe [5487944 2014-03-24] (Embarcadero Technologies, Inc.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [459496 2013-11-23] (Acer Incorporate)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-07] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-07] (McAfee, Inc.)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [457768 2013-08-02] (Acer Incorporate)
R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [448040 2013-08-02] (Acer Incorporate)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\siteadvisor\mcsacore.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881472 2013-12-12] (Qualcomm Atheros Communications, Inc.)
S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-12-24] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-08-07] (McAfee, Inc.)
R2 Ext2Fsd; C:\Windows\system32\Drivers\Ext2Fsd.sys [771224 2014-08-26] (www.ext2fsd.com)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-07] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-07] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69264 2013-08-07] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-07] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-07] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-07] (McAfee, Inc.)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-01] (Synaptics Incorporated)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-08 02:50 - 2014-12-08 02:51 - 00019672 _____ () C:\Users\AR\Downloads\FRST.txt
2014-12-08 02:50 - 2014-12-08 02:50 - 00000000 ____D () C:\FRST
2014-12-08 02:48 - 2014-12-08 02:49 - 02119680 _____ (Farbar) C:\Users\AR\Downloads\FRST64.exe
2014-12-08 02:46 - 2014-12-08 02:46 - 00000466 _____ () C:\Users\AR\Downloads\defogger_disable.log
2014-12-08 02:46 - 2014-12-08 02:46 - 00000000 _____ () C:\Users\AR\defogger_reenable
2014-12-08 02:45 - 2014-12-08 02:45 - 00050477 _____ () C:\Users\AR\Downloads\Defogger.exe
2014-12-07 23:55 - 2014-12-07 23:55 - 03640880 _____ () C:\Users\AR\Downloads\avg_remover_zbot.exe
2014-12-07 23:31 - 2014-12-07 23:31 - 00000000 ____D () C:\Users\AR\AppData\Local\Intel_Corporation
2014-12-07 23:28 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-12-07 23:28 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-12-07 22:27 - 2014-12-07 23:33 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-12-07 22:27 - 2014-12-07 22:27 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-12-07 22:27 - 2014-12-07 22:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-12-07 22:27 - 2014-12-07 22:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-12-07 22:21 - 2014-12-07 22:25 - 31036328 _____ (Oracle Corporation) C:\Users\AR\Downloads\jre-7u72-windows-x64.exe
2014-12-04 23:22 - 2014-12-05 01:42 - 177856928 _____ (Oracle Corporation) C:\Users\AR\Downloads\jdk-8u25-windows-x64.exe
2014-12-04 20:44 - 2014-12-04 20:44 - 00000911 _____ () C:\Users\AR\Desktop\eclipse - Verknüpfung.lnk
2014-12-02 14:36 - 2014-12-02 14:36 - 00000000 ____D () C:\Users\AR\AppData\Roaming\PDF Architect 2
2014-12-02 14:34 - 2014-12-02 14:34 - 00000000 ____D () C:\Users\AR\AppData\Local\PDFCreator
2014-12-02 14:30 - 2014-12-02 14:30 - 00000993 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk
2014-12-02 14:29 - 2014-12-02 14:30 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2
2014-12-02 14:29 - 2014-12-02 14:29 - 00000000 ____D () C:\Users\AR\Documents\PDF Architect 2
2014-12-02 14:29 - 2014-12-02 14:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2014-12-02 14:27 - 2014-12-02 14:31 - 00000000 ____D () C:\Program Files\PDFCreator
2014-12-02 14:27 - 2014-12-02 14:27 - 00113848 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-12-02 14:27 - 2014-12-02 14:27 - 00000852 _____ () C:\Users\Public\Desktop\PDFCreator.lnk
2014-12-02 14:27 - 2014-12-02 14:27 - 00000000 ____D () C:\Users\AR\AppData\Roaming\pdfforge
2014-12-02 14:27 - 2014-12-02 14:27 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-12-02 14:27 - 2014-12-02 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-12-02 14:25 - 2014-12-02 14:26 - 27276128 _____ (pdfforge ) C:\Users\AR\Downloads\PDFCreator-2_0_0-setup.exe
2014-12-02 14:05 - 2014-12-02 14:05 - 00065345 _____ () C:\Users\AR\Downloads\jarfix.exe
2014-12-02 02:10 - 2014-12-02 02:10 - 00000000 ____D () C:\Users\AR\Desktop\Tor Browser
2014-12-02 02:06 - 2014-12-02 02:08 - 34288786 _____ () C:\Users\AR\Downloads\torbrowser-install-4.0.1_en-US.exe
2014-12-01 22:49 - 2014-12-01 22:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-29 17:51 - 2014-11-29 17:51 - 00077799 _____ () C:\Users\AR\Downloads\proxtube_gesperrte_youtube_videos_schauen-2.0.0.1-fx.zip
2014-11-29 11:50 - 2014-12-07 22:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2014-11-29 11:50 - 2014-12-07 22:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-29 11:50 - 2014-11-29 13:11 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-29 11:50 - 2014-11-29 11:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-11-29 11:50 - 2014-11-29 11:50 - 00000000 ____D () C:\Program Files (x86)\Java
2014-11-29 11:47 - 2014-11-29 11:47 - 00638888 _____ (Oracle Corporation) C:\Users\AR\Downloads\jxpiinstall.exe
2014-11-29 11:43 - 2014-11-29 12:01 - 370763706 _____ () C:\Users\AR\Downloads\adt-bundle-windows-x86_64-20140702.zip
2014-11-27 21:13 - 2014-11-27 21:13 - 07693351 _____ () C:\Users\AR\Downloads\hibiscus.zip
2014-11-25 22:11 - 2014-11-25 22:11 - 00000000 ____D () C:\ProgramData\Samsung
2014-11-25 22:11 - 2014-11-25 22:11 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate
2014-11-25 20:20 - 2014-11-25 20:35 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-25 20:20 - 2014-11-25 20:20 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-11-25 20:20 - 2014-11-25 20:20 - 00002003 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-11-25 20:20 - 2014-11-25 20:20 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-11-25 19:28 - 2014-11-25 19:28 - 00001156 _____ () C:\Users\AR\Desktop\Helden-Software.lnk
2014-11-24 23:01 - 2014-11-25 01:32 - 00000000 ____D () C:\Users\AR\Documents\Beruflich
2014-11-23 00:17 - 2014-11-23 00:17 - 00001317 _____ () C:\Users\AR\Bildbestellung.html
2014-11-21 21:22 - 2014-11-27 21:25 - 00002159 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-21 21:22 - 2014-11-21 21:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-21 21:19 - 2014-12-08 02:24 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-21 21:19 - 2014-12-07 22:57 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-21 21:19 - 2014-11-21 21:22 - 00000000 ____D () C:\Users\AR\AppData\Local\Google
2014-11-21 21:19 - 2014-11-21 21:22 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-21 21:19 - 2014-11-21 21:19 - 00880784 _____ (Google Inc.) C:\Users\AR\Downloads\ChromeSetup.exe
2014-11-21 21:19 - 2014-11-21 21:19 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-21 21:19 - 2014-11-21 21:19 - 00003848 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-18 21:42 - 2014-11-10 00:19 - 00991232 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-18 21:42 - 2014-11-10 00:19 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-18 21:42 - 2014-11-10 00:18 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-18 21:42 - 2014-11-10 00:18 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-14 21:05 - 2014-11-14 21:05 - 00000000 __SHD () C:\Users\AR\AppData\Local\EmieBrowserModeList
2014-11-12 20:30 - 2014-11-20 21:51 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-11 22:22 - 2014-10-10 02:58 - 00177472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-11 22:22 - 2014-10-10 02:58 - 00027456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-11-11 22:22 - 2014-10-10 02:44 - 00563976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-11-11 22:22 - 2014-10-08 08:37 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-11 22:22 - 2014-10-08 08:37 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-11 22:22 - 2014-10-08 08:34 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-11-11 22:22 - 2014-10-08 08:24 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\rfxvmt.dll
2014-11-11 22:22 - 2014-10-08 07:56 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-11-11 22:22 - 2014-10-08 07:51 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-11 22:22 - 2014-10-08 07:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-11 22:22 - 2014-10-08 07:18 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2014-11-11 22:22 - 2014-10-08 07:17 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-11 22:22 - 2014-10-08 06:23 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-11-11 22:22 - 2014-09-27 08:13 - 00104336 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll
2014-11-11 22:22 - 2014-09-27 06:24 - 00088800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll
2014-11-11 22:22 - 2014-09-27 04:38 - 00426496 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-11 22:22 - 2014-09-27 04:30 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2014-11-11 22:22 - 2014-09-27 04:17 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-11 22:21 - 2014-10-18 10:55 - 00055776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-11-11 22:21 - 2014-10-18 09:09 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-11-11 22:21 - 2014-10-18 09:09 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-11-11 22:21 - 2014-10-18 08:25 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-11-11 22:21 - 2014-10-18 07:50 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wuaext.dll
2014-11-11 22:21 - 2014-10-18 07:38 - 03557376 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-11-11 22:21 - 2014-10-18 07:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-11-11 22:21 - 2014-10-18 07:26 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-11-11 22:21 - 2014-10-18 07:23 - 00407552 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-11-11 22:21 - 2014-10-18 07:23 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-11-11 22:21 - 2014-10-18 07:21 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-11-11 22:21 - 2014-10-18 07:20 - 01714176 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-11-11 22:21 - 2014-10-18 07:14 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-11-11 22:21 - 2014-10-18 07:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-11-11 22:21 - 2014-10-18 07:12 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-11-11 22:21 - 2014-10-18 07:11 - 00723968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-11-11 22:20 - 2014-10-31 06:28 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-11 22:20 - 2014-10-31 04:42 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-11 22:20 - 2014-09-22 05:38 - 01519488 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-11-11 22:20 - 2014-09-22 04:06 - 00258368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys
2014-11-11 22:20 - 2014-09-22 04:06 - 00114496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys
2014-11-11 22:20 - 2014-09-22 03:49 - 00035320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys
2014-11-11 22:20 - 2014-09-19 01:16 - 01346048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-11-11 22:20 - 2014-09-02 23:08 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\winshfhc.dll
2014-11-11 22:20 - 2014-09-02 23:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winshfhc.dll
2014-11-11 22:19 - 2014-10-31 06:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-11-11 22:19 - 2014-10-31 06:12 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-11-11 22:19 - 2014-10-31 06:10 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-11-11 22:19 - 2014-10-31 06:09 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-11-11 22:19 - 2014-10-31 06:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-11-11 22:19 - 2014-10-31 06:06 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-11 22:19 - 2014-10-31 06:06 - 00237568 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-11-11 22:19 - 2014-10-31 06:06 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-11 22:19 - 2014-10-31 06:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-11 22:19 - 2014-10-31 06:05 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-11 22:19 - 2014-10-31 06:05 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-11-11 22:19 - 2014-10-31 06:04 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-11 22:19 - 2014-10-31 05:57 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-11 22:19 - 2014-10-31 05:56 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-11 22:19 - 2014-10-31 05:54 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-11-11 22:19 - 2014-10-31 05:53 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-11 22:19 - 2014-10-31 05:52 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2014-11-11 22:19 - 2014-10-31 05:51 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-11-11 22:19 - 2014-10-31 05:51 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-11 22:19 - 2014-10-31 05:51 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-11 22:19 - 2014-10-31 05:50 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-11 22:19 - 2014-10-31 05:50 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-11 22:19 - 2014-10-31 05:40 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-11-11 22:19 - 2014-10-31 05:38 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-11 22:19 - 2014-10-31 05:30 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-11 22:19 - 2014-10-31 05:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-11-11 22:19 - 2014-10-31 05:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-11-11 22:19 - 2014-10-31 05:28 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-11-11 22:19 - 2014-10-31 05:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-11 22:19 - 2014-10-31 05:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-11 22:19 - 2014-10-31 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-11-11 22:19 - 2014-10-31 05:23 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-11-11 22:19 - 2014-10-31 05:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-11 22:19 - 2014-10-31 05:19 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-11-11 22:19 - 2014-10-31 05:15 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2014-11-11 22:19 - 2014-10-31 05:08 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-11-11 22:19 - 2014-10-31 05:06 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-11 22:19 - 2014-10-31 05:05 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-11 22:19 - 2014-10-31 05:05 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-11 22:19 - 2014-10-31 05:03 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-11 22:19 - 2014-10-31 04:59 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-11 22:19 - 2014-10-31 04:45 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-11 22:19 - 2014-10-31 04:44 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-11-11 22:19 - 2014-10-31 04:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-11-11 22:19 - 2014-10-31 04:32 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-11 22:19 - 2014-10-31 04:28 - 00137728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-11-11 22:19 - 2014-10-31 04:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-11-11 22:19 - 2014-10-31 04:27 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-11-11 22:19 - 2014-10-31 04:26 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-11-11 22:19 - 2014-10-31 04:25 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-11-11 22:19 - 2014-10-31 04:24 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-11 22:19 - 2014-10-31 04:24 - 00235520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-11-11 22:19 - 2014-10-31 04:24 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-11 22:19 - 2014-10-31 04:23 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-11-11 22:19 - 2014-10-31 04:23 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-11 22:19 - 2014-10-31 04:22 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-11 22:19 - 2014-10-31 04:20 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-11 22:19 - 2014-10-31 04:18 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-11 22:19 - 2014-10-31 04:16 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-11 22:19 - 2014-10-31 04:15 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-11 22:19 - 2014-10-31 04:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-11-11 22:19 - 2014-10-31 04:13 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-11 22:19 - 2014-10-31 04:13 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2014-11-11 22:19 - 2014-10-31 04:12 - 00661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-11-11 22:19 - 2014-10-31 04:12 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-11 22:19 - 2014-10-31 04:11 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-11 22:19 - 2014-10-31 04:03 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-11-11 22:19 - 2014-10-31 04:02 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-11 22:19 - 2014-10-31 03:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-11 22:19 - 2014-10-31 03:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-11-11 22:19 - 2014-10-31 03:56 - 00090624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-11-11 22:19 - 2014-10-31 03:56 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-11-11 22:19 - 2014-10-31 03:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-11 22:19 - 2014-10-31 03:53 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-11-11 22:19 - 2014-10-31 03:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-11 22:19 - 2014-10-31 03:51 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-11-11 22:19 - 2014-10-31 03:50 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-11 22:19 - 2014-10-31 03:48 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-11-11 22:19 - 2014-10-31 03:46 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-11 22:19 - 2014-10-31 03:46 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2014-11-11 22:19 - 2014-10-31 03:42 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-11-11 22:19 - 2014-10-31 03:40 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-11 22:19 - 2014-10-31 03:40 - 00325632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-11 22:19 - 2014-10-31 03:39 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-11 22:19 - 2014-10-31 03:30 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-11 22:19 - 2014-10-31 03:26 - 01042944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-11-11 22:19 - 2014-10-31 03:24 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-11-11 22:19 - 2014-10-31 03:17 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-11 22:19 - 2014-10-31 03:13 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-11 22:19 - 2014-10-31 03:11 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-11 22:19 - 2014-10-07 07:28 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-11 22:19 - 2014-10-07 07:27 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-11 22:19 - 2014-10-07 07:27 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-11 22:19 - 2014-10-07 07:27 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-11-11 22:19 - 2014-10-07 07:27 - 00108432 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-11 22:19 - 2014-10-07 04:34 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-11 22:19 - 2014-10-07 04:34 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-11 22:19 - 2014-10-07 04:33 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-11 22:19 - 2014-10-07 04:30 - 04182016 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-11 22:19 - 2014-10-07 02:54 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2014-11-11 22:19 - 2014-10-07 02:46 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-11 22:19 - 2014-08-31 01:15 - 21197152 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-11-11 22:19 - 2014-08-30 23:59 - 18723112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-11-11 22:19 - 2014-08-28 03:55 - 07484224 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-11-11 22:19 - 2014-08-23 05:50 - 02714112 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2014-11-11 22:18 - 2014-10-13 03:33 - 00116032 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-11-11 22:18 - 2014-10-11 01:58 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-11 22:18 - 2014-10-11 01:53 - 03607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-11 22:18 - 2014-10-08 08:30 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-11-11 22:18 - 2014-10-08 08:09 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-11-11 22:18 - 2014-10-08 07:27 - 00325120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-11-11 22:18 - 2014-10-08 06:32 - 02773504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-11-11 22:18 - 2014-10-08 06:19 - 02459136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-11-11 22:18 - 2014-09-10 07:25 - 00474432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-11-11 22:18 - 2014-09-08 04:07 - 02497344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-11-11 22:18 - 2014-09-08 04:07 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-11-11 22:18 - 2014-09-07 23:08 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml
2014-11-11 22:18 - 2014-09-04 23:30 - 00822272 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-11-11 22:18 - 2014-09-04 23:21 - 01053184 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-11-11 22:18 - 2014-09-04 04:05 - 00836176 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2014-11-11 22:18 - 2014-09-04 03:22 - 00670384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2014-11-11 22:18 - 2014-09-04 02:01 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2014-11-11 22:18 - 2014-09-04 01:32 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2014-11-11 22:18 - 2014-08-31 01:17 - 00148800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2014-11-11 22:18 - 2014-08-30 23:05 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll
2014-11-11 22:18 - 2014-08-30 22:58 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll
2014-11-11 22:18 - 2014-08-30 22:04 - 00941568 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll
2014-11-11 22:18 - 2014-08-30 21:53 - 00239104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll
2014-11-11 22:18 - 2014-08-30 21:17 - 00799744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll
2014-11-11 22:18 - 2014-08-28 01:21 - 02480128 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-11-11 22:18 - 2014-08-28 01:06 - 02030592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-11-11 22:18 - 2014-08-23 06:14 - 13424128 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-11-11 22:18 - 2014-08-23 06:04 - 11820544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-11-11 22:18 - 2014-08-02 01:51 - 00545792 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2014-11-11 22:18 - 2014-08-02 01:35 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2014-11-11 22:17 - 2014-10-23 06:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-11 22:17 - 2014-10-23 06:05 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-11 22:17 - 2014-10-17 08:01 - 00789184 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-11 22:17 - 2014-10-17 07:58 - 00602768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-11 22:17 - 2014-08-23 06:18 - 02149376 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-11 22:17 - 2014-08-23 06:03 - 01346048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-08 02:48 - 2014-09-12 21:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-08 02:46 - 2014-09-12 18:35 - 00000000 ____D () C:\Users\AR
2014-12-08 02:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2014-12-08 01:05 - 2014-09-12 19:22 - 00000000 ____D () C:\Users\AR\AppData\Roaming\ClassicShell
2014-12-07 23:40 - 2014-09-12 18:41 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1591653119-3682044142-3444803271-1002
2014-12-07 23:37 - 2014-04-23 11:20 - 01940561 _____ () C:\Windows\WindowsUpdate.log
2014-12-07 23:36 - 2014-09-18 22:41 - 00000000 ____D () C:\Users\AR\.android
2014-12-07 23:32 - 2014-09-12 17:46 - 00000000 ____D () C:\Program Files\Java
2014-12-07 23:12 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-12-07 22:59 - 2014-04-23 21:02 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2014-12-07 22:59 - 2014-04-23 21:02 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2014-12-07 22:59 - 2014-01-27 12:17 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-07 22:56 - 2014-09-14 10:36 - 00000000 ___RD () C:\Users\AR\Dropbox
2014-12-07 22:56 - 2014-09-14 10:32 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Dropbox
2014-12-07 22:55 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-07 22:54 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-12-07 22:08 - 2014-09-12 18:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-07 22:08 - 2014-01-27 12:15 - 00079770 _____ () C:\Windows\PFRO.log
2014-12-07 22:05 - 2014-09-12 17:13 - 00000000 ____D () C:\Android-SDK
2014-12-02 14:38 - 2014-11-05 18:56 - 00003028 _____ () C:\Users\AR\.heldEinstellungen4_1.xml
2014-12-02 14:38 - 2014-09-12 20:13 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Spotify
2014-12-02 14:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-12-02 14:06 - 2014-11-05 18:56 - 00000285 _____ () C:\Users\AR\.dsa4.properties
2014-12-02 14:06 - 2014-11-05 18:56 - 00000000 ____D () C:\Users\AR\helden
2014-12-02 13:55 - 2014-11-03 20:54 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-12-02 13:55 - 2014-11-03 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-12-02 13:30 - 2014-09-12 20:13 - 00000000 ____D () C:\Users\AR\AppData\Local\Spotify
2014-12-02 13:26 - 2014-09-20 17:36 - 00002006 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-12-02 13:26 - 2014-09-20 17:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-12-02 13:26 - 2014-04-23 11:40 - 00275362 _____ () C:\Windows\DPINST.LOG
2014-12-02 13:25 - 2014-04-23 11:10 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-11-25 21:49 - 2014-09-12 21:17 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-25 20:34 - 2014-09-12 21:03 - 00000000 ____D () C:\Users\AR\AppData\Local\Adobe
2014-11-25 20:34 - 2014-09-12 18:36 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Adobe
2014-11-25 19:34 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-21 22:12 - 2014-11-02 21:51 - 1024789391 _____ () C:\Users\AR\Rosas 2014.cpr
2014-11-20 21:51 - 2013-08-22 16:38 - 00714208 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-15 04:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2014-11-14 18:56 - 2014-09-14 10:36 - 00001058 _____ () C:\Users\AR\Desktop\Dropbox.lnk
2014-11-14 18:56 - 2014-09-14 10:34 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-12 20:29 - 2013-08-22 15:44 - 00413408 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel
2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-11-11 22:28 - 2014-09-13 03:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-11 22:24 - 2014-09-13 03:33 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-09 11:22 - 2013-08-22 15:46 - 00028037 _____ () C:\Windows\setupact.log
Some content of TEMP:
====================
C:\Users\AR\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpowyf9b.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-29 08:59
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 02
Ran by AR at 2014-12-08 02:51:48
Running from C:\Users\AR\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8102 - Acer Incorporated)
Acer Power Management (HKLM\...\{E438A632-CADC-49E4-9492-C9F50F9AE37F}) (Version: 7.01.8100 - Acer Incorporated)
Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.00.3000 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8101 - Acer Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
ALDI NORD Bestellsoftware 4.14.5 (HKLM-x32\...\ALDI NORD Bestellsoftware) (Version: 4.14.5 - ORWO Net)
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.01.2012.1 - Acer Incorporated)
BDE_ENT (x32 Version: 5.1.1 - Borland Software Corp.) Hidden
Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
CodeSite Express 5.1.5 (HKLM-x32\...\CodeSite Express 5.1.5) (Version: 5.1.3 - Raize Software, Inc.)
CollabNet Subversion Client 1.7.5 (HKLM-x32\...\CollabNet Subversion Client) (Version: 1.7.5 - CollabNet)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3323.57 - CyberLink Corp.)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Dropbox (HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
Embarcadero Delphi and C++Builder XE6 Help System (HKLM-x32\...\Embarcadero Delphi and C++Builder XE6 Help System) (Version: 14.0 - Embarcadero Technologies, Inc.)
Embarcadero Delphi and C++Builder XE6 Help System (x32 Version: 14.0 - Embarcadero Technologies, Inc.) Hidden
Embarcadero InterBase XE3 [instance = gds_db] (HKLM-x32\...\Embarcadero InterBase XE3 [instance = gds_db]) (Version: Embarcadero InterBase XE3 - Embarcadero Technologies, Inc.)
Embarcadero RAD Studio XE6 (HKLM-x32\...\Embarcadero RAD Studio XE6) (Version: 14.0 - Embarcadero Technologies, Inc.)
Embarcadero RAD Studio XE6 (x32 Version: 14.0 - Embarcadero Technologies, Inc.) Hidden
Ext2Fsd 0.53 (HKLM\...\Ext2Fsd_is1) (Version: 0.53 - Matt Wu)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Java 7 Update 72 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417072FF}) (Version: 7.0.720 - Oracle)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java SE Development Kit 7 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170250}) (Version: 1.7.0.250 - Oracle)
Java SE Development Kit 8 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180250}) (Version: 8.0.250.18 - Oracle Corporation)
LibreOffice 4.3 Help Pack (German) (HKLM-x32\...\{1560A369-7C63-4D4E-AA09-494C4BD47256}) (Version: 4.3.1.2 - The Document Foundation)
LibreOffice 4.3.1.2 (HKLM-x32\...\{303C2B0D-03AF-4C25-A443-E62DE8AA36A8}) (Version: 4.3.1.2 - The Document Foundation)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.8100 - Acer Incorporated)
Media Go (HKLM-x32\...\{AF06B8FA-B916-4001-AE51-6645488DEF09}) (Version: 2.8.303 - Sony)
Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.12.102.06300 (HKLM-x32\...\{6E69B344-A081-487D-775B-F55A04DAF2E5}) (Version: 2.12.102.06300 - Sony)
Microsoft Document Explorer 2008 (HKLM-x32\...\Microsoft Document Explorer 2008) (Version: - Microsoft Corporation)
Microsoft Document Explorer 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Document Explorer 2008 Language Pack - DEU) (Version: - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (HKLM-x32\...\Microsoft Visual J# 2.0 Redistributable Package) (Version: - Microsoft Corporation)
Mozilla Firefox 34.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
NVIDIA Grafiktreiber 332.35 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.35 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0927 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0927 - NVIDIA Corporation)
NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.02.2009 - Acer)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.51.17865 - pdfforge GmbH)
PDF Architect 2 Create Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 Edit Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 View Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.314 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.23 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.28145 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7027 - Realtek Semiconductor Corp.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Sony PC Companion 2.10.236 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.236 - Sony)
Spotify (HKLM-x32\...\Spotify) (Version: 0.9.1.57.ge7405149 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
Sublime Text Build 3065 (HKLM\...\Sublime Text 3_is1) (Version: - Sublime HQ Pty Ltd)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.19.0 - Synaptics Incorporated)
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
18-11-2014 21:23:18 Windows Update
25-11-2014 18:33:12 Windows Update
02-12-2014 13:29:04 Installed PDF Architect 2 View Module
07-12-2014 21:27:19 Installed Java 7 Update 72 (64-bit)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {09BBE309-F7D4-4DDA-997C-377D9A0058ED} - System32\Tasks\Dolby Selector => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-07-08] (Dolby Laboratories Inc.)
Task: {0DA88302-9E2A-4B45-A851-029D5AB58837} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2013-09-12] (Acer Incorporated)
Task: {396B0A30-671D-4DF8-93D9-4F4BB8DB27D3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-25] (Adobe Systems Incorporated)
Task: {87E7DC97-3275-4272-937F-6DDCD180A4B6} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2013-08-02] (Acer Incorporate)
Task: {BB1639FD-70AA-4BEE-82EB-16CBA38DBD93} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-21] (Google Inc.)
Task: {C0C4EF5B-BCCD-4E2C-AEE5-7797DD622E97} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2013-11-23] (Acer Incorporate)
Task: {C5B121ED-B7DE-4F63-BD31-0460430134EF} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-07-08] ()
Task: {C80BD694-C3E3-4954-B2D5-D7F6B6F861BA} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2013-12-04] (Acer Incorporated)
Task: {D1067FC8-9BC6-446E-B3B9-16E6F9554E1B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-11-11] (Microsoft Corporation)
Task: {D1A4DE76-801D-4394-8767-DC1D4FB3BEEC} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {FAA83357-8061-4A40-A094-1E6D2DF3BB09} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-21] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-04-23 11:44 - 2014-01-08 01:48 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-09-22 11:49 - 2014-09-22 11:49 - 00034304 _____ () C:\Windows\System32\ssj2mlm.dll
2013-12-24 01:22 - 2013-12-24 01:22 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-12-24 01:20 - 2013-12-24 01:20 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-12-24 01:26 - 2013-12-24 01:26 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-07-08 17:53 - 2013-07-08 17:53 - 00052096 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2014-09-20 17:36 - 2014-06-23 08:07 - 00113376 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
2014-06-21 18:13 - 2014-12-04 20:39 - 00908800 _____ () C:\Android-SDK\adt-bundle-windows-x86_64-20140702\sdk\platform-tools\adb.exe
2014-09-20 17:36 - 2012-04-30 10:57 - 00039936 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
2014-09-20 17:36 - 2013-09-13 10:02 - 00208896 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 13:54 - 2011-07-07 13:54 - 00233984 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
2014-09-20 17:36 - 2013-05-20 11:58 - 00620718 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
2014-09-20 17:36 - 2010-01-11 15:44 - 00053248 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll
2014-09-22 16:05 - 2014-09-22 16:05 - 00645632 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
2014-12-07 22:56 - 2014-12-07 22:56 - 00043008 _____ () c:\users\ar\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpowyf9b.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\AR\AppData\Roaming\Dropbox\bin\libcef.dll
2014-04-23 11:38 - 2013-09-04 00:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-12-01 22:50 - 2014-12-01 22:50 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1591653119-3682044142-3444803271-500 - Administrator - Disabled)
AR (S-1-5-21-1591653119-3682044142-3444803271-1002 - Administrator - Enabled) => C:\Users\AR
Gast (S-1-5-21-1591653119-3682044142-3444803271-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-1591653119-3682044142-3444803271-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/02/2014 09:12:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm ALDI NORD Bestellsoftware.exe, Version 4.14.5.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 570
Startzeit: 01cff6d53ad08795
Endzeit: 15
Anwendungspfad: C:\Program Files (x86)\ALDI NORD Bestellsoftware\ALDI NORD Bestellsoftware.exe
Berichts-ID: 873e76e4-62cc-11e4-8265-202564942c7c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (10/10/2014 06:42:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 32.0.3.5379, Zeitstempel: 0x54224e6b
Name des fehlerhaften Moduls: mozalloc.dll, Version: 32.0.3.5379, Zeitstempel: 0x54221b67
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x264c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
Error: (10/09/2014 11:00:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: emulator-arm.exe, Version: 0.0.0.0, Zeitstempel: 0x52697a53
Name des fehlerhaften Moduls: emulator-arm.exe, Version: 0.0.0.0, Zeitstempel: 0x52697a53
Ausnahmecode: 0x40000015
Fehleroffset: 0x0011887e
ID des fehlerhaften Prozesses: 0x14fc
Startzeit der fehlerhaften Anwendung: 0xemulator-arm.exe0
Pfad der fehlerhaften Anwendung: emulator-arm.exe1
Pfad des fehlerhaften Moduls: emulator-arm.exe2
Berichtskennung: emulator-arm.exe3
Vollständiger Name des fehlerhaften Pakets: emulator-arm.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: emulator-arm.exe5
Error: (09/14/2014 08:33:32 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.3.9600.16441 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1608
Startzeit: 01cfcfedc496d256
Endzeit: 0
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: 51d68a00-3be1-11e4-825c-202564942c7c
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (09/13/2014 09:58:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: BackgroundAgent.exe, Version: 1.0.1.5, Zeitstempel: 0x53e1eb8b
Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.8387, Zeitstempel: 0x51ea24a5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00056b1d
ID des fehlerhaften Prozesses: 0x135c
Startzeit der fehlerhaften Anwendung: 0xBackgroundAgent.exe0
Pfad der fehlerhaften Anwendung: BackgroundAgent.exe1
Pfad des fehlerhaften Moduls: BackgroundAgent.exe2
Berichtskennung: BackgroundAgent.exe3
Vollständiger Name des fehlerhaften Pakets: BackgroundAgent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: BackgroundAgent.exe5
Error: (09/13/2014 09:58:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AcerPortal.exe, Version: 3.0.1.2011, Zeitstempel: 0x53f5fe69
Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.8387, Zeitstempel: 0x51ea24a5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00056b1d
ID des fehlerhaften Prozesses: 0xbb4
Startzeit der fehlerhaften Anwendung: 0xAcerPortal.exe0
Pfad der fehlerhaften Anwendung: AcerPortal.exe1
Pfad des fehlerhaften Moduls: AcerPortal.exe2
Berichtskennung: AcerPortal.exe3
Vollständiger Name des fehlerhaften Pakets: AcerPortal.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AcerPortal.exe5
Error: (09/12/2014 07:29:24 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0xC004E028
Befehlszeilenargumente:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c7c00280-b24d-4e82-89ca-4f1288eb1d9e;NotificationInterval=1440;Trigger=UserLogon;SessionId=1
Error: (09/12/2014 06:49:40 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Fehler bei der Lizenzaktivierung (slui.exe). Fehlercode:
hr=0x80072EE7
Befehlszeilenargumente:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c7c00280-b24d-4e82-89ca-4f1288eb1d9e;NotificationInterval=1440;Trigger=NetworkAvailable
Error: (09/12/2014 06:49:40 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0x80072EE7
SKU-ID=c7c00280-b24d-4e82-89ca-4f1288eb1d9e
Error: (09/12/2014 06:49:40 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Lizenzerwerb-Fehlerdetails.
hr=0x80072EE7
System errors:
=============
Error: (12/08/2014 00:51:42 AM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "Acer" wurde eine Beschädigung erkannt.
Die Masterdateitabelle (MFT) beinhaltet einen beschädigten Dateidatensatz. Die Dateireferenznummer ist 0x300000004277a. Der Name der Datei ist "<Dateiname kann nicht bestimmt werden>".
Error: (12/08/2014 00:51:10 AM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "Acer" wurde eine Beschädigung erkannt.
In einer Indexstruktur des Dateisystems wurde eine Beschädigung gefunden. Die Dateireferenznummer ist 0x100000000212a. Der Name der Datei ist "\Windows\System32\config". Das Attribut des beschädigten Indexes ist ":$I30:$INDEX_ALLOCATION".
Error: (12/08/2014 00:51:09 AM) (Source: Ntfs) (EventID: 55) (User: NT-AUTORITÄT)
Description: In der Dateisystemstruktur auf Volume "Acer" wurde eine Beschädigung erkannt.
Die Masterdateitabelle (MFT) beinhaltet einen beschädigten Dateidatensatz. Die Dateireferenznummer ist 0x2000000059548. Der Name der Datei ist "<Dateiname kann nicht bestimmt werden>".
Error: (12/07/2014 11:13:56 PM) (Source: DCOM) (EventID: 10010) (User: ONYX)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (12/07/2014 11:13:26 PM) (Source: DCOM) (EventID: 10010) (User: ONYX)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (12/07/2014 10:55:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/07/2014 10:54:09 PM) (Source: DCOM) (EventID: 10010) (User: ONYX)
Description: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
Error: (12/07/2014 10:09:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (12/06/2014 04:18:01 PM) (Source: DCOM) (EventID: 10010) (User: ONYX)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (12/06/2014 04:17:31 PM) (Source: DCOM) (EventID: 10010) (User: ONYX)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Microsoft Office Sessions:
=========================
Error: (11/02/2014 09:12:15 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ALDI NORD Bestellsoftware.exe4.14.5.057001cff6d53ad0879515C:\Program Files (x86)\ALDI NORD Bestellsoftware\ALDI NORD Bestellsoftware.exe873e76e4-62cc-11e4-8265-202564942c7c
Error: (10/10/2014 06:42:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe32.0.3.537954224e6bmozalloc.dll32.0.3.537954221b67800000030000141b264c01cfe4ae6af1e1fbC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlldc38ead7-50a4-11e4-8262-202564942c7c
Error: (10/09/2014 11:00:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: emulator-arm.exe0.0.0.052697a53emulator-arm.exe0.0.0.052697a53400000150011887e14fc01cfe3a7bdda656cC:\Android-SDK\adt-bundle-windows-x86-20131030\sdk\tools\emulator-arm.exeC:\Android-SDK\adt-bundle-windows-x86-20131030\sdk\tools\emulator-arm.exe15b629c8-4f9b-11e4-8262-202564942c7c
Error: (09/14/2014 08:33:32 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.3.9600.16441160801cfcfedc496d2560C:\Windows\Explorer.EXE51d68a00-3be1-11e4-825c-202564942c7c
Error: (09/13/2014 09:58:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: BackgroundAgent.exe1.0.1.553e1eb8bMSVCR90.dll9.0.30729.838751ea24a5c000000500056b1d135c01cfcf90f931ea9bC:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exeC:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.8387_none_5094ca96bcb6b2bb\MSVCR90.dllc58d1875-3b88-11e4-825c-202564942c7c
Error: (09/13/2014 09:58:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: AcerPortal.exe3.0.1.201153f5fe69MSVCR90.dll9.0.30729.838751ea24a5c000000500056b1dbb401cfcf91356ec387C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exeC:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.8387_none_5094ca96bcb6b2bb\MSVCR90.dllbebbdb21-3b88-11e4-825c-202564942c7c
Error: (09/12/2014 07:29:24 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0xC004E028RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c7c00280-b24d-4e82-89ca-4f1288eb1d9e;NotificationInterval=1440;Trigger=UserLogon;SessionId=1
Error: (09/12/2014 06:49:40 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: hr=0x80072EE7RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=c7c00280-b24d-4e82-89ca-4f1288eb1d9e;NotificationInterval=1440;Trigger=NetworkAvailable
Error: (09/12/2014 06:49:40 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: hr=0x80072EE7c7c00280-b24d-4e82-89ca-4f1288eb1d9e
Error: (09/12/2014 06:49:40 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: hr=0x80072EE700010001(0x00000000, 19:49:40:645 - https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=DM)
00020001(0x00000000, 19:49:40:645)
00030001(0x00000000, 19:49:40:645 - https://activation-v2.sls.microsoft.com)
00030002(0x00000000, 19:49:40:645 - 0)
00040001(0x00000000, 19:49:40:645 - https://activation-v2.sls.microsoft.com)
00040002(0x00000000, 19:49:40:645 - 1, <NULL>, <NULL>, <NULL>)
00050002(0x80072F94, 19:49:40:645 - 0, 1)
00040006(0x00000001, 19:49:40:645 - 0, https://activation-v2.sls.microsoft.com, <N/A>, <N/A>)
00020005(0x00000000, 19:49:40:645 - 0)
00020008(0x80072EE7, 19:49:40:661 - SOAPAction: "hxxp://microsoft.com/SL/ProductActivationService/IssueToken"
Content-Type: text/xml; charset=utf-8
, <soap:Envelope xmlns:soap="hxxp://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="hxxp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="hxxp://www.w3.org/2001/XMLSchema" xmlns:soapenc="hxxp://schemas.xmlsoap.org/soap/encoding/"><soap:Body><RequestSecurityToken xmlns="hxxp://schemas.xmlsoap.org/ws/2004/04/security/trust"><TokenType>ProductActivation</TokenType><RequestType>hxxp://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue</RequestType><UseKey><Values xmlns:q1="hxxp://schemas.xmlsoap.org/ws/2004/04/security/trust" soapenc:arrayType="q1:TokenEntry[1]"><TokenEntry><Name>PublishLicense</Name><Value>mryXnVn3jmN0sTM576jlaw4ao0al57a/OG5hv0qMBSwkPDUwdo0rpA23zARq/rDO5SSDJ9fdaJQt6UbGamAWZDyRuSRhVKLcb8bx2CP0oid+KLMr4MWpuyEa5fM8a1VzStfEpejwHdTct+EK83cDN3xvMeN3T0RmSw/FYIsTTJBZJrudImtgBK2NYi3CDfonXXT3oFPh2tx6QuLcYTHyX1cX/R5fD7VjsPEZPes/e9FERK5M2f2pdQBEqOQT98JZDKH12SRwsOsJHBPsKUBDj6Bmq46WgeUepLnvGlST8nCXr1t6RSVtvM6gjVGxnYVejoyG8FGjaOz9biRc9A2ukbwlmiBx9A0pdXRn+BphFXI1QvXk0tokXkJAl3FEEw9uy6COWsQe9+1pcSi7NzNjUaT6BOkxyfdlGHeWoaivVKGeEbLu0ypuHNhk+YBSCDMMxKZGTAuFqSo1wtL601O3NsmZriXDTXAe8yJnoaN0jWVYt/Z0XXCa3WmrqKgH/e3WSGs734fQnt0ax6bVa8pE4cvUqPWMaMTVJqtfirLIEd40fqJzo+0bVPl1Le7V1Xc48XJZYf++pLBrUOkUe8TbhxTvPaeGiXnPu7aVJr4cazhw5Z8B37eotpFcJlPBE5gBovI2L1uMMjHpyE0JX5EZL/mIDt6/kyVsyvjzvoSOXZqIE+MF7tjbwb5MudyZn2vxZ7rXI8EeEMZUEuEwqdLP+hinC+2UBuyQnYIlj0b18JvaWgL2MK7fPRUGZKSoupuy406u/X15B+G8GU+snTlZlfZK2dcxXhduvuLpjfEEwu1dEe4McCDjPol3V0zM6QS5Hr+t5MUpi7Wx4tC7OJ2isTHPts1MOiZRuah+Q4PGiRcw23v5Ps88nNA7Uzn6Qb8PHRgWNmyvkQN9g6hhR2VbquzxOJEowLyLopRTwv7y/eshzadMDgZ1HO+VzmMiwJoHt/a8YWGn/lGWSpbxCNTnmZy/vvhwlvLCFsth2RxVUA53/X2R52Zvyz7PMjc/47uiuMTMuEKfdS/qtOvkHoUtrgxF00J0AMTw6kv/U+nZprCijfMnUXTZ8IG0aP4M0JMFQ3Ojo1KTezunjBsrrUG9Wt5FccKxG123o8lNG9onNUVtMTYo4PMqZEMszCP2D+DHCla1r5gFH1gfHH59OMbCJk1akRykNvDJ6opFzlP4MHsBQe56Vipq01s2Rj6nEwskVAny3XuI+dyKZANwzst08HJePaj1HWaLtVzxbTnM3M+Ve2P3c25xBQvkibiPafPlGla/4dz11QWzgSgRcIDPtJqKbSR4tAEEfrTGPMKi8BfcvVOkb82bskdU2gMTjNbCAx+xtzuPtkz6kmM63QZUvMiEr8Gao1W7pbo5BJbNwbxR3sPID90ieTNHtAyPOQW5jj8deWIdlGeKMC/26KFs+A0aNs/dJTl5OzhIpOELc1NcYGL3DyYoYVdny9J+M44hXYV5DGG8pV1aHfIzQ65BOKUVkLIu8XNtxEM4SVygm7gzInfXlhDjGqd6S2ucJDBqjdc/6wNnQtSagY8HpqLNXDHaMMeh6o+h5an0Avg1E2egSTtD0K2M7MGCvFgVn8k9mv5a7lQ2iHFpe0xy48p4zN6telVZhM3blHuAk22/WK8d3h8OClvwlB9oFiY99C7cmgAF20yftgz+Kl9+xiXUcUQw9qRiUr++aYelq8dT7CAAPdu2CNPvCNlpI8NKOIiIsfcen3+VMASCnzrAxGjtDq/SVgXWfqc5RFmrUs3mxh66aw2WyVVHFy7h8CyT3F+jcZb5d0xPZXhM3ODZ+NKOmykq3GmAtBA2SArxf/fTD50seseJk2flD1gSIB3fYXKtPMbw3iVsOGvUu94BNfCrLOFkJ1NN0nfGxuF5K3Y7/u2wgrA6OLs5TExcDBk3ua4f6dAn4wSv7ySWoe8yiOTcAgxEbE4V2nSdVMFJzg4IDE0TsLAjwPvUp6iI9mdKJ5j9tZ7YG1t6umIrNf82K2yrTLDcwF7/1XUyDcAyXZbhKx+4RF9YIeEGXC0JgF++p8dIHQDcfPyq9OJiURjvWDzWs99RdpYzIy037r2JIVImgb9Twd/dCAT/FRABqY5stiVTOqSvjPtLlr9FbMKGaa/SfL1VsuyxzkB8mqjmYj555EemBVHZatB1WmMgy/u3OWNiFFtWdvpplA4K6MHdslWwU/P1zcyaJ17OmdP6JrefwU43XzuNdjS7XaR5nmzpTyijTSiri+AulViTwIqNaiGlk0WktC9gd4N+AlvbtSuS+dY36Wj19wGqnXrT5rPXwZhxTZ2hYw3BQ5QrosTfvzHBvqf1f47egnrY5DYqonI84stEcLTWIwBPfwwBrY5T2fkie3Fn9KbeLbaFWgVy5UNc6Q2KY5Z8v58g5LCEBqIGXM0MYlOjj3OtkBEs2BZcGjYGAWTjfudVkCKXUoVHN6HKOsNXVvjJvBMvAd4Z2d/WMOri0+Ouxx+JqRN86khuPEXRUjuW1is/rjny1WNPRx9FleslMV23tGp3/NM6jeaUeA3Ovp19EO8VPYq8rp1PEhqSODOMQsjJX52YRhWQkLS6if6VvOH4nFwoUVOjMFJ3PbvZB/3ZnYYud0lu0BqwMwDvA4UTXnl4tkpRJZzOI6erVQRe32q/XulN3aeA0AtB7wkQlCKkRQYClZyWDNUhfbXW+QTYVXe70BMGbpV907oGEAW3Tw1CLNvAHRiFVl57GEWfANsCU1o7LWn8atRByFMVZvndWZ+wkoNdAIqLhkof2yjY34pnlJg1SJJoRbubNDdLDsbxnv4qytRpQDURBrcnoJ8TvC6XVcLkW3YbBn6jOtUbTZkgKa/FkuVKAaZt4+OpeXb+RTu5LlUAESwMZ/onYR0ngvW+QlH1Xdax5RStF+A7WxeHXXitaqUXyAXwxQnwOWGl4NDgvpuE19FDEYV78P0He2/q/yR8donc94ATGVTZkYAbpTQr7ijAxxILUIsc2zijHmhkgsEgRtM26wSiyuoIJlkRSB0W3jYY+Q0zyl/CASI71GSr5i5FN/LpOCdWc5LK8EXi1isuMs3KivRhP6mnAWuEkTSn+HKXXaVAc3Xgnrw4zaA17udP9sc94jE2rXrOKX07pQyGOEik4QT/3IuNqNJX/OdXSqiBPPxY9JE3/apJ/PvBIeFn6+KU5TKgNVS6KM5TmnFFZA6qZ7kf0CcYwvoK7m7EebBH3PpURxHZ1rUB/xx1F3DAIRHYhSRuPYy0mPGBoYULXxzs2+MCBl7x5o82SkHPDJ1HCBFZ+nx3YUIsOjz0U8O2YZ0cezPJ/UPvyDY+GpNZFqY4Vaj2mzlcooxSDzqT0M2+woAD3R7Uh0mdVS+IqB1TdZ7HRNnMNGkQvi4asVHJFE0YxQhl3bpP8DI1hoC3chgIx4tyk1Wvj+sqq9oOEPqirAFH0Vmnw9H/XS278qNWcM3NCf2kqxtMpjayoSq57TIlpaOvxT5byUH0fdEW9Sd3cVB7hv/5v+GEAnSnwl8Q0veKRo28O8I0dLngEC3b/fvBzzUIbYsA0yHkbju/0H2m4cDP1l4mxuWHzHII6RubohwQn/eYEYVMEd3TfwRvHo7smftWsezNtRVEjOIiqQuRNvKXmX8dZtOM0xY5I1hONO2QLJme06T3rwXj7uJmAukQIRCVzjtFhjevUjNS7kIZimZApOAxcfrtQjljGbeVXTgJ3Cyek2CJmnu6oY7DG7lIVYmDlVulbFAWqwHCq43C9iJfosmL3Ruh0vk7Ytv1PAYZGwBQjjelgXt84JXobLtwY/mW6dhv9xMlfV55t/pXha07i2x5D8bHdV71qzXXdQmsB6MMAvhLFOg0S273GGX5DzpxekNf4bAmvIPpv0jnqTs43tjNA3M4hmrSguUKAIt6kz1bkc3imubZh+Ph5eTKsVFHlexXBhThx8pzG7dRCZ0E3GjKsdfzRH/Bh820T2NSps4cF8fLq7atvy1wgeDlI3pqJQuvsQ5vIO4zn3iIoDmOyz4eEg8ps4Pkfz7yex+4xAlFMbc25wHJ9iGTMzs3heSXMsUF4Y4DyExHXy0SgpxCvhEoYRJQsDtiACPLs2MbCrEtfSFpQNsY21U/Hs0RUAZfI9tqLK8QW3RSwq2qCn63HbMO8LtA8gVYQrOB2IOkXRskaHHsCr23T7XNV7FZuqlzTXHI3e0pOqHUESUFw6tpEaX69P0SDMcSPMb73AZhA5o97TwgbQ38W0j2Efiim7PLk+1F7J2ZmQFFfKaKCgWm7tFKCK5T8Zf+GXAQSNd8WhG1bJSf5qjjS0fbbDtt0vcyOpCzbR0G0dflLR1o8rbLaPRGHsTPyD9oxcYC92PqcYmzUOUc88B1fqNnGCoS+fqr1ExUsvKb3fpvAaB6PV9bx1l6ltUMzbQzgngRaGdE4KX9g7tiVTsn/8EEEPqs4sGCz3Cs8fzB+lJknOzZkc4LqPWUF9FsU5puDFePDNobIY28r6OwcHvG3xNLhlvehZW5HtkiZPXnHyNwwV9RUyMhekA/3++xeC8SKWmunIB6a16HQUe5APyNojEfQWApRmZEcWIqaQlsqXdby7GM7WQ+c4oXBTbcTP0DdL407zd+gfYDfWOmo7ys8qFGjqEwx1h/TeeHneHn1dfQ5dhnWcAAkURiTq+5sGbEW6DrUQk1KBDqgx4wobQT0Qx72OobtmEl/p79GaMZUVg+5Ja3q3G725VVsUonDI6JWo6SBWYFBJoFom5zlbGPax3pa+iSb0cQjCY/AucQP9d//VIZoqr3QudM28zWqCRbODckUk1q+CMAiX+wqLgfIEYDEP0HhHX0Xf57xWP6yT1/1SCy/Yu5XGiFq6A7NvrYbZINQ/IZMOM2Icav+RGdEII4fJV2tMnKTMsYt/Mj0XROMjM3t0Uyh7R/X+CDr/f87LjBLm1+rf+G7B9MzToFxRppj6ts1yM5yBp+wMNGlXqmuhwEYtBpO1uaNKsB+qfXinrlbTAimbbmgydrOMDx2ebK2+H62Eh7GHklcHqf4lq6E3LK792NYYHW9rvrStSFJMfmZmnv9Dq7IkyYde1fFSMdzQwSYtqCTFCaxaHxdws5QSrMtTxVT1KBj6ZKD2R1hRzEkzFLbjMSIwqCY0/d0deGMHahDW9SLk+qIZ7/oi5LB0myIOvGWxOIMr0hxIU1sMLSptslHn0IPeWEye9fR1UHLKBdhDSV070G+/BeCfjtv31ZtWtknS6BDE/XBY8rZi1jCoRQpyLMR/ZcHNyRH3wfNgGW74pcCZm0DelNST6oE1phK/KLcXjlaH43796f/SDgs65ULkYmnHEKlHEfY3j3/K0V2CqDy7UT9Gf/tQfbIj4gLuYzRJhtC6Y7MexLXVtU2XFy+1WY4IBIXBBn3LpDFEyPfsR1RiCJvP8OJwRH1qpLz9DfRX/nfLQjibFss6LhXQi7wKEk+hOeYuaWy8Guuh+c6dgYFWVyxwd+BT8jEP+5LQ6ib9pfhFKaSuVHlEMYAYg6EuS/s1dQhJB/OlK8yxNIurKFlX68zYivIeSgtiizv6d7lyqnnfDcXjduq0gCofV/QFuJe/MVj+rKJ2pUM01k7SzODN/VtLw8RfvXTmpFNzHfzLtf24dPPxlTB2YvTRpNTzO5+eKJ8aFHs632s5v2vnYV/jEjcesfQN3NJeAnsmGMgHK8xtReh0PuduApMC0EYmB5mpwkYukiHkfWEPB8QUFS3T4W2zQpjzugxMdywzg6d/lCHEbF2yAG9mcfvsYpVZNX2Qjcr54LrBPujerssHTFgWF4MI5Imri+LK721CHSrkTbgTX9pcc5lPt7ZtPAmNJ18al7uimwey50i5YhxLckQCE/BYtfRog2COB58sx8xigBhDkCxS1SvnygfCU6+R/gtoarEGEBOuGse9WuCpKuXnCGUSbh9xqrksresu+e2/FrDEm/zcMA+/NZ1H7OeumGdqtZpgSbZhH+GsFcueJRRYTwZsk2I7SFb5P0d/z1TCYEnTPOVRERZkJ+ldqf4hwjrui0hVBHSNdmPBMuMJfH7btDtcfhXp3wqc+vFzCcwNC1MfwP0wZj+a/X715WL08p+1ZyEjeu+NEqnpGz18I4bu6kEK9Emz1tHnlr8kYHbDYbE0J2f5ZjzclnrSBGCw3dk+KrlRD/++y87OSIE7Fz5njxXPyyIFW7jh3fSEaxuw2oLpkxdiw1DF5b+qviqpNPNhPFLVDRObmvJP/71kh9O+c1yCl2SkHlv4R5j5jO60fzMmTWQaYwqr9PmMMzP9WnGtLGMT8uQrBryHEU0urhyaD6XLv+x0d+8EkkeW1Lg2Gcn7P7fijStIElhlvLPvowAexCCtSWSyIOcgHhG/xCXlEMdk9gqqOg56It3/lqcZOdIHsz+iOsR+usOhHgewjmgSylUQqwMZTHuDbO32cUwIyCvlvi5UKy1ExJbLBEJQRcdN126ifd5i6D/1VGfNFzW8b0TrHLkEVipx29PH39JTNyr8tWYQF1a3+7LywUioD5iH4nXl+WI3WZuiRCV7repik6MSuniMwVQ4VzQRMy9BrTpbfy0SjLHnQc3o71qjU++KBc8qOx4YQp7XIeyHuWSqcdG6FErGQZJFLortYtcwproK7biUEqu+sfCOswtYxzoMteem5Nm4mJvLYFjyj/Z+XIJXGcqHuqGdfw0ySuvtxUAtXONgvxiEBEmfH1OjHIkq9TPm7F/5OTCmlZYa6Kd/051ELQ+mXqdS7llmh/Q77vH9oFvvl7TStfdYdC4wPgUdgv8Ea2naod+xC2taCsqpKZdSuxq45z54sRbsJjmKTpZK2alj7v87cdxCJel7wlsO79H1bABvJNIO5Cu3I8FagCZQ4K5VLVTwSEQs2seTJkvaNg29NlMDwI4YQXLXN/6xYwgZfObNNqXiLm32MQH8nAVvy+HzhG4+Pl+Rm5nSHiAIl6UkXZeaxSbSekGiOni/HvMbPx0R6HnpJb9vAYTXu1eVSw50ep9GNUjCrLYfJDty7S6fSR/2wpboLcLSY9xRraHKFNcDR/4V5unJmGZDm/l3A5K0uTt0CaAxZMIzY5WAV8zjn5XJ8QWdtJb0tM5BMpRpqWiZ31XTv48EyiAh6RaAaP+xXW9hmAgWMH7FA+FnjX0lDmhZDG/LWfqxC8IJ6roj9NMuEd+iGBTrcRxwSSjwlbn69jXyhHfA4/2FrLhoyp5Fe8+YRkUN+BO2n8wmobZaebnf+mcRkyhlLboE6mtb0EXjm/9qS1qDv3eaN6KzDPEbT350oB0+O9yZD1ii3NBWfupmMG5l105fRLm5XOcIlKcT+5ln4pSt/b3lJTA+83ZJRi0M4DMSB6FwWS6I3g2E7jBnLEHoS6nHWKq+musW9sF6XOzkWW6+1yXiqZPaBAFnP/uP47KsY7ZPtYNwf+1QJb1huETqk83Kc3YcfXfD0jYJJlROH5nbDI29bc0UAs3pUfmP3YSRP/3Y3KTiNwRz1wxqr5cW8WRTp1OWNFzzOBBGYrzzkVFnhxZByvUwJ182p0dHpgPG9lTRqZb/tSA9huxbTnQXGJCCXPPt/hy3qVW6nwq53GHrXcO2XURIsuWFHE36YdHYOiKEPZvn05M+INkgiyZcxUkiegKVDtR3nsybuxU5yV0HKzSJvHVwE0XI9Kbtvct7lwbD7kxQgxQfRShEJlpg+2Z2QZrGkd5DCM3Mm/S5sj/AAciZBExQ3Zd2IBIJ6L55WqUX/U8hSrNoK58ab6ZlFmAA1TK6R3Gjulmx2wzZzkG5MrdRs3/f1CTCIbXvmWkbr0bdDH6lipdDOFv06Q3JMQfvbkHllB8qWMt+h1e2m3q6SdxIBbEzbbWtZrdsW5HnWD3F6KatRafcrC+uYW82jk4qSmLJ4i9jD+6f3shaU1YLIPh0VhTFEbdBlG53ok92qIu5ZjOZED405HoEQr2bCwMs9r55M40A2YGJlNVGvo2qeh3PbS7/rY5xzyy1OB10woYdcPM9nCu3TMOIhIL+TEOvtZtrf4FA+xrlOcxUl8K/pdmoGRKeMYcL4PDVcBsTkvn6RfJ8Ry/qPxv0JZp/hY6JVa++i/eKXbUYqpIo1427tBbbEpGT3bKaTrq1V4glBCpvt4n2D4q4q8Plqky1Id3UeXI4DfROnee85ndrqQfOft01R40kpVdPW10Z8qQM3lyFXtmrbp0Do0pO5by+U9ymPCY/FRhhSChGz1DOgEbxW+zAHTj0ppILZRyiGyHbQVVB+ZVhfnMPzQjkgc7b22bcH7tsjRAB18GSImAFjkgvK4P3A0tQW3TnPwP/O6U/B5ZFNC/FJ53TeRlcfxrKCiKZVa7E4XrLtmbuNFk/PffqBxvJIwNlchSHaBVoUNwkUOwIfAFI/Qw0tIoZnbmljBgiPToGGEROvkg0L0rP3hJpH6mGPEzndWY3qFKDrtz7olkSY740WUuaVVhpJ1/LiEC4f6Vy92rIU/l0WdiBrk/yl5w2303/IBrjMbMfcRC7MMqKwAVSTyBvzBKR/LcEA7ao8vjQldRfntBS/87STxlpoNA33h1s9RLHk9cEX7k8uYWYiUvV1PRkftvXAC4lvGRyVv2WjpvMKooA0gHu+/ejDMHktXmBXWUy1Rs5RdRDVBeqnpS4FEpaXDprUzKOIIRfICD/A/8IAubQyK7JODXlJEAxeH3oFaV7l3nz51xz2eDJ8ktIYzPG3DdWPIJk/CuAwHYNvcVJm2hHDrzMqW0xfOp4SpFG+GyvObrvlppsHIsLub6VvsXNwYJwDpd0yM0kGlCdv43cQpqbpdT9thYh0t5XGIIAFY9+20U2ZuAeEggWr7PAxAKxE8/iqGsAU2xp/As0pJgGo3KRaBsCE1D6pik8t/3x9+JrekYKBsu44LoH3xcslP/976HolFMoKb+jp/wBoZLORCiZrmqTdzSnvziS3IDcJ9GNFU0fg/hOLhDdgKYUKuAEQvZ3fFXlbAXmqxkD6tApY1Q+4mldO+fBXLrEgEOOjU/tVfbsr0bZO8m7H6++06wK/zIi7XVeJLa/lZHHTv2PFjuVvBRFvRpoDJD8Y9DM8Ef+SIkQanuxhTqJjToTTo+3SL/VTd05xKeeBkYz3++Kv8X1CbOtRKnFq1o7OAI2vtNy3W/xo4LHrHcDLXIqtWuL9SFylTySxTgg5X7KxAPyI+/K20a+B1bXHXdS2Qao0g/wrVunShXqfgUWuZz0/TKczWwCa3lPWvoTtct+d+EaMVlElPPMSX8H7gNmBcGEbmHxFY2VbJMQF7NC8bTl9qCXd9j9RpTTRSP25jgesfcjHMR+YLetUy4BzVgAHmNqDrL4rJXNZRchGKU8e+13BSSCKNeoXBDB6zVvpdEgmqPm/UzjOxwzhnmKIJkT2SESZaYIXXLtKeHo7MUbw2MSgylY/gVyJRc3BZwFnJZXeBC3oB6oJmh+kDLXvH2aqQAPkZ5oOJc3gyT1nnFkkPZT1bVL6z04Bsb/Zf5OEBtaLnCsDqnKAwFlp4ltO9pFxiYcA1xLje/8CH9Y07qCpB7WWx+2KENtTzLOih5AVX+v1quW5ftGDYQp/RvtV3x3atZRH9PhhJEBvBPFf4+EvLqLCuu/K1nt47dkS/FrHUY32WDa/yBH/35rbiEXxuH3l3e7CPedop8aORnw+ruhFn+RECkLRv4uTge7Xl/momd3byF+v6Meatq9MrfrIMScg4STTWerIfEDV040w2vdSBTZhDYLzpcS2LQ1NpkcOVAP/Lj6nTDBtxAV1apSIpwRsc3xFnyUQc0XtzZoflIMlJDHj9Ma30vNIpmai1/JQFH5lhHLdwzyg+n8vRPteAmKMrCRpvSaCurV7shRkFNkQQA6Vu+H+KGmoed9/GF0KtU2aISv0jWq2IyWiuDgQ9xXcb3eEAjYMTOEDik1+TUDd5qGgFCWI5S41Irs96gcgmKtPxYoJZlxQbTi4szeY4wNsOT5WYvV7scxDvoqyz6kVrr+KSvb53l9fE4jDun3I5oy4URTFppsv2VS4/HUgMZ5BwOPcZLTifvp5naUnSqtxWTYcf1EmtqlaVWCzxtxfL+nQl2QcGWbB5upsOtSX91dV3WLVNhaj/XVf2mHnMQmAw/xkqQbnsVRzGOodqXE7IJjDHWodocDPw4sdPpKHb2FMzQIBX3xCxQXslpHp0cNUEZ2meVad7y21qnS4agtJVTgN5BQ2jk5bEJdpiTxyfxhTfKFjoAHk3kqXyktQSGgYoQdE09zUk4F/O+F/nW78glSpZFF7uMcuxwxjnYs0uK1cWOGQaEaOphLM2QxG+X1zYTcYI9QGHO3SMBptFmGM3ii83VVADoJ3ha6HSfG33vl5ChGX1qsoFDn6ijmW7xkpYKlv7x4YhlrVbEEauHQ97+Rxxv55bq4nYuyAWLuYpVknq8UDerfIqAZK/4QE6Zz/mcrWn06X3OTeGbtSKaZ+ZeI5yDMQ2T/7mw6U5W+RT7w9lFWo0CJwABPKBsjWqouw9jSn4kvxgZlfyy+EyZczRAdAdISjHz2PdxVMHwAT0Vc4I5npGE+p08PTrcRxUaAGY2jNqV0tyep7QmfgWczYngAGItHD1ICy3S5nl3OH9Vs0mZLsb/yN9bBUUyHcWTvcdnFgWkF7mFnzTkSzcFVRd3God74h82+WoaIFKXng2bu0xkK18AHzg3WB/jyoA5iXLvqH4EjY8C5I6bz7T19NvO6i8fjPMxDo+wsULo2Rr0MIEA02imyS+SmfBzeX/z+L0R8yZn0n/PbPcSK0e61AMP07KWIQZ7JE06c2GK20voGDm9mbw6W0xZvI/XPMNov8FFzCCqrairGZH3clw4AmTbEA9Qcz4+4vz9rz9R9if9vN5Mh0jBY+tHGeSA5UldkiSGWrZUy1WyH9o6mEATMS2JZHA1+na3Q4xIQnO1sMLl1XitL21GBC16Ixlx7qnyXalnCtPpKCQwSi18oBeJn8AMOga/unyRWcO1N3UjfpQ82+Kuj+nVQ8zeRMCfnqyoB0VKwxb8gLWZ7WNDEEALTo83vROc/+FEF+MsyZIVYmU9aaTedERMPV1TsKJ1a8+L9r+Lv1GnhtV3IUY+xMRUTqhNDVvUlfN1Gm57R8ihtH9RoFr+RJUIlPZJnrK5B+bjfYa7CcM5DJ4Jj0ccM0ZuY8N9apmhbz5kpSOPnMzQWtj5N+2X+7Dv2DkiECqCl0qQO9ofAieyWHXnwWvXAFYeUYQQgszHGBH8eVweIqvrVymRMoAsLjrNaCsLUYUYPWR9k+pQfBNTHVrXPGC4QhX680kAzwa+3YO0yp4RE7mOoG0srR13zzH5c6yeWokjf9cTNPnC1Oc/WRjaHGc831ZiQs/bAb21ZEP6XULa2/B6Oj7nZq7WZkDyg/XdQHDGFpJJ/BIPXQ1HBV7do/I0EL2NaZCPnagNBwMIswvRyVzwflCFlzt7OG1dPJbV5jqKJW9G+kiBrAW9l9k9X6nd2N1euZwHeqwM7MIdXStMsdv4dS4X3d9m/n3Iua61YrA7yRGvHyLFc01WGTjWvw6C6+lUf1BLz9oejU1BRotpPGCSplAR6uVW0R36u69eXCL5fAFH70FtP9vS9dNJRhnd4eeAWFGZGRzy5V5rhpyPXfBZFsxNzCD6lYQasjbT2Df2o1imfDr1M/pWjfAbKEBLEh+O3CERTjNUyAJpN02W9MNi1kfgju8t8fn/XVmtEMTuNI3fNqLSY+NhicKtLQgHllOpePWP1EYdcjAKHUlFDErXdbbySP25ttZy0iOaDB7mGLVXEEWupBs8lrDG6KRATFeuiY7xFjNDnYG0+ICNc4/ByoSOtT7Ma8481MlGKpEBBA/JKbquDJdfyzMI1kmE1B6O0SSoLT7DYUcYjlzbW+NYemrxFLUupZMjXCaBF1s4rjsHle1s3W6ioR8qWlPOwXZTukSBSYWJZT0rabo9V8n4t1RUFYTBOuSdUSfbADJ+KdrZ24t8/RQXm5/auli0PwKU2CowJZ+cvNmjADHiok/M0+44kc8DOEXyHFwjS5bVCN37gROiT3VzY353NMTPpJIEn7gsyBXVl8wRXhtjYbW5syw9W4DrLeGX/N8nlfhwStRhp+CFl3gr9inYCmhI77YmiezT65Rae8KtiZ3SVaVDKuaUeylX9C4RqBbrcwv3tUaJClleels4DMIUchKxmxa37uFPbXrNIuWVnOON5pAf81iVrz2oFCykIAeye2QUvGqTCwngQMSB2fD/AxyFpfWtL+HJSadm05I2UWu0aO7qJ3/Bn5Xk/ZBjiq10I/LuVudAHKs6qJ2gpLZkEYuSGkC7MVxSKxYkCHC35ZSEgLwPADlCmrjVnMtZzyBbEB9mQAzMOg52Qloefpl1p6JsMfvJO3eWkVDXJmIh6lV8E195R1FFSvm+EQFEb7QZt19OwTGN+DdFpapQ3vKnFTfJeVgQ+0d5uniPvKE+ynSPTe5G4VPIPzJdTFnZWdyJwg14WDT3uWdkJvkKWWK6CRGDR4wGMR51hTLmjohv+x/kC16yApgz0d0uVLS0NwIwTxdAUVzj3il5m6lTD4PO4n1vqSexQ16iLO3ZvWIguAMn2nlq8Ir6niUgF5Nn7Z9lUTyTOCcVIi15p7tHJAaxPeIV2pszZnLaSmeGTi+Vnh1wsDzS5MmcghMC0zYK+Fip9nYVk/p55n79oN372hySh0piwonAFShPtFCEj+kfxmUaxtstjCR+tXFFGBq/jNJRG/LL18XjU4wFI3y8CGBrcn0yt60IT35srYDTQXtNCySWDOOCbuKJPlUhmAYdwWc3lSUKcY8igvT4fntjOP0IcNUg23dKnxXGeRvNrKRO0oHKlFJXNFBCr6idVhBBjZhCAwyF9JinOp2672LKQb7+J8pEA4jxVgEaJnGUPVf00wYRXrVSkEeVGJVuwikby6vM5+muuAdAQMYXHVy7tC/4BFHH2ITSJ6L2qVcSqeFXAJuAglMLTpl5v3Uk9BCvAKKyCEedQHmGduDJnZ08MB3hR7GN1i2ycGtj5K6+U9umIsYyYEacOUUifjo0S6M4XhM6CsT3USpgA3HpoMiYMf+uCyt/os3oYMHuxYCd3nAW6bvWpxW1J1p/kgCCvh+92Y1lHxYR1b9ETQJ/FHyu/zu4VGRq1B5sEKF7KWTpD2tremIIYECesfvGATrGucDFq2w12cywgmdn4qRjnwIkJgDiRIE4sfNmw4f99LHiUPL83CtrJvZzo5qsE59RoUUaUj3mmR/V8CIJHj+JG4WdGt81KzSHZiAVyYVDF7Epuu78yJGoLi0G0Iip2KFeuXAb4HOitJ7X7GqnkrF5S5PrsZV93ZgA1jLcc0alDE3hJghc8uPDRnaLebmuCtp3nddjecWui62tMR/Urr24rEqvqlO/0NoL2SRNbK+jfoV7xv4B/BB40N33qwjaB5VZ0XfNmfqKBkvzQ40ylgnsuDV6TNFiCmJFsK5vuvKyN5ARE2+AMiHlQEJPlzffFhkDcxSwicCrBppiaYypgkMBjpQh0wbQ0MuL/8RtoV6A9yJtyT+Lb9v2FFjjyoKyCfyWfLj8zlhwPRGc+3iWsvzUKYwTZrTyHceir6YHLeO5awCoeYJmmpjinijbZH4Yn0u/V//vvGWWtTXzfK0sq+ycyCnUO4fKt5UEE20yJLY0RZiG1xGD/ICK/XDZXYLvffGO88tbi02Vo5IVUIQXp7C7n3HE0vDb9ctWGrOwDaaOUniN3LolykgqZAvife7a/62D188pl63Q73OiT0BamZaQy1Eo6/++7Vkw8tM+Xngsa8DtF8GFhbvPde4C+jAseJURwMclt0LFj80yah87F2z/4Q3c7q3+kAOBDaLkn43q2yZ88hPeuu6pGDDHrAykoQZSn1NtLMBH4C4MAAYUqWk4PDobZfGn7OxDHWRfZ/OOZWRTU7Endb9P+lFE6rDflrEjsAbs4hjuHrpVvA93pYBIgnrSXn8y4D43N7eTz/y+4WidhTrV123dYOzCV5Sapra8pwHwLpZUTVVpw2gt52xZH3VfHLtd2glzyJkE/UcKijkO+scA/CGiHE4RpHzII3S8i9t+kqB6t7dbwMJdPvEnrZWRwjAKixSEcza62bdgGOU1dVQrXLXmTGzL0oecwA2QIEoWKvCTHN+Ln2QLUt03XIvHjRkHMIilTgUc/QokdiyxW+FM/PyGGMLWPUl2Hiq2y0Z6zkcKPpPZGwnxckQuVb4KxeN6hxb+Ddot4kFhBwawnzsMz97FUwejqolKPjjnW8gcJXS9o+ZC2tM08kaOX69G22TNVV2NrjA6WKXYss75nX6LcRJvbJnn/eSsqgsCWcOuN0PQihX0aSCI+l1Uuq6zRv1e26ePOyiwVvC+27rnG+vrDxGnuh3Dm7bN8q0QXeRAegoJcA1ETior6ukGEAg+nkHcet8EjrTmFgISQBFh3HqzhLCoPdV2XndiuRlAYMNa/+gl8iDFbCG4LnUQ6AedYWOVNq6hzK4wSyOhj6yKDaMpzW51dXHMzdsBY7I1H4znv2vHM7V8ccuaghKxRMX2gYG0EkiTiW31iz1rhAKFAntA/Hg7FI4MxyPcA==</Value></TokenEntry></Values></UseKey><Claims><Values xmlns:q1="hxxp://schemas.xmlsoap.org/ws/2004/04/security/trust" soapenc:arrayType="q1:TokenEntry[17]"><TokenEntry><Name>SessionKey</Name><Value>Fi1eWAuOESyfzkDE3pO0zYKFlVvQFM+Avr0PIG/37F5w+6S2O7ksE0snsXyk0KJExS4qq92m1k+lUumOCJEVQVTz7ArR634pFre+4RJTZE/iKjKWvUQ7mISkxwicxgVdsFJsrDgBKzirj/w0FF/EyUxfzt9JvO4tPSukgBClEuDhnKyeLn7XtTjtYmi6+Q2UJMJQrboPZZHCmbRLn+Tg0zjQ34ihu5lHqVCp9iFZC50bz5C1i0+mtPlLOoSKqhy5Kn9/hL5uY2PObayPFffWdAXqH92+1QtczMhSnFpBY1BaTqEM8GBDHFY+vYYIzOP0hs3xV5bMm/DUwKdWR+XWUg==</Value></TokenEntry><TokenEntry><Name>BindingType</Name><Value>w8fBV8XA5AhwstZCtm+/m79VEtVEpRbflo6emx/2ibg=</Value></TokenEntry><TokenEntry><Name>Binding</Name><Value>IiSvZ0pLPn3LDYMF8MLQR+YYOzUsa0gGVuij+8yfpIJt9UTI902uDW7Zr6C3XfHUMZbKcEwJw82xMm8GQ52Q7c9XO4YzZBO47/mDIRAK2XI=</Value></TokenEntry><TokenEntry><Name>ProductKey</Name><Value>BKNhiDD9K1aAZ2An/VDgFWRu1JPARxV0GnPYTQwCm20=</Value></TokenEntry><TokenEntry><Name>ProductKeyType</Name><Value>w8fBV8XA5AhwstZCtm+/mwmBby2BYVQriwSLhDG7ykQ=</Value></TokenEntry><TokenEntry><Name>ProductKeyActConfigId</Name><Value>9hI1BOU+d0cj+qK4e60nRCZpp4XNkWLgS0TKsUm2Xvve57p8vNktbf72JiwWKTIPvq4NpL3Z8DPXHDO28+6VcLLqTjQsyO6+9Gi52KkdcSU=</Value></TokenEntry><TokenEntry><Name>SppSvcVersion</Name><Value>DLF8sG/j88CqDeSvXrMwwg==</Value></TokenEntry><TokenEntry><Name>otherInfoPublic.licenseCategory</Name><Value>YeAIfYytxbnzK1FJAtIv7EI3MRBoUweH3pGKupgv6vI=</Value></TokenEntry><TokenEntry><Name>otherInfoPrivate.licenseCategory</Name><Value>YeAIfYytxbnzK1FJAtIv7Id6zzj86kTPQ6KxDelLUB4=</Value></TokenEntry><TokenEntry><Name>otherInfoPublic.sysprepAction</Name><Value>e7gLGDctJ9nZy/omr6mDVg==</Value></TokenEntry><TokenEntry><Name>otherInfoPrivate.sysprepAction</Name><Value>e7gLGDctJ9nZy/omr6mDVg==</Value></TokenEntry><TokenEntry><Name>ClientInformation</Name><Value>rHj3fUtajWe060z/MJr85vaBeyGqt7O8wJCpLf9N41eRIu+0O3w1pncfucf+0blf0a4jXE7ta4r8ynmZlAuvOw==</Value></TokenEntry><TokenEntry><Name>ReferralInformation</Name><Value>3h+/wKgeUJQD+gM0a08INuqA/1vqPNn0Ib1HD59dRGldJ5rvYdMB/vSiEfDKvdiwtXwzPB+W1xYRIFuIoyFGAA==</Value></TokenEntry><TokenEntry><Name>ClientSystemTime</Name><Value>fN2zZfNLcwNi8nY17M/IoAKRe1VAbPQdy+33niC5A08=</Value></TokenEntry><TokenEntry><Name>ClientSystemTimeUtc</Name><Value>fN2zZfNLcwNi8nY17M/IoAKRe1VAbPQdy+33niC5A08=</Value></TokenEntry><TokenEntry><Name>otherInfoPublic.secureStoreId</Name><Value>eI6AxO2rAy2vlkVnJdiM0j1/ECR5ICoGAqkA/3v6CmF2L0YchRqBci58azlIWnV0</Value></TokenEntry><TokenEntry><Name>otherInfoPrivate.secureStoreId</Name><Value>eI6AxO2rAy2vlkVnJdiM0j1/ECR5ICoGAqkA/3v6CmF2L0YchRqBci58azlIWnV0</Value></TokenEntry></Values></Claims></RequestSecurityToken></soap:Body></soap:Envelope>)
00010002(0x80072EE7, 19:49:40:661 - <NULL>)
00010003(0x80072EE7, 19:49:40:661)
CodeIntegrity Errors:
===================================
Date: 2014-12-07 23:15:05.556
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:23.194
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:23.132
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:22.741
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:22.663
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:14.100
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:14.006
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:11.990
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:11.896
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:10.318
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4702MQ CPU @ 2.20GHz
Percentage of memory in use: 38%
Total physical RAM: 8072.27 MB
Available physical RAM: 4931.82 MB
Total Pagefile: 9352.27 MB
Available Pagefile: 6027.86 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:912.7 GB) (Free:824.41 GB) NTFS
Drive d: (Lubuntu 14.04.1) (CDROM) (Total:0.68 GB) (Free:0 GB) CDFS
Drive e: (ACER) (Fixed) (Total:143.04 GB) (Free:10.77 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (DATA) (Fixed) (Total:99.85 GB) (Free:54.05 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 767E32CA)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=143 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=99.8 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=43.2 GB) - (Type=05)
========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 0F6CD540)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-08 03:18:44
Windows 6.2.9200 x64 \Device\Harddisk1\DR1 -> \Device\00000037 WDC_WD10JPVX-22JC3T0 rev.01.01A01 931,51GB
Running: gm.exe; Driver: C:\Users\AR\AppData\Local\Temp\ugldapog.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960001c0200 15 bytes [00, 28, F6, 01, 80, 1C, 6C, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 16 fffff960001c0210 11 bytes [00, 0E, FC, FF, 00, 05, C4, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [756:780] fffff9600095db90
---- Processes - GMER 2.1 ----
Process C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe [4616] (FILE NOT FOUND) 0000000000400000
Library C:\Users\AR\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe [4616](2014-11-13 06:49:58) 0000000003d90000
Library c:\users\ar\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpowyf9b.dll (*** suspicious ***) @ C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe [4616](2014-12-07 21:56:28) 00000000041f0000
Library C:\Users\AR\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe [4616](2013-08-23 19:01:44) 000000006c3a0000
Library C:\Users\AR\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe [4616] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 000000006a6d0000
Library C:\Program Files\WindowsApps\Microsoft.SkypeApp_3.1.0.1005_x86__kzf8qxf38zg5c\Microsoft.PerfTrack.dll (*** suspicious ***) @ C:\Windows\syswow64\wwahost.exe [3304] (Microsoft.PerfTrack.dll/Microsoft Corporation)(2014-04-23 10:27:04) 000000006ee30000
Library C:\Program Files\WindowsApps\Microsoft.SkypeApp_3.1.0.1005_x86__kzf8qxf38zg5c\LibWrap.dll (*** suspicious ***) @ C:\Windows\syswow64\wwahost.exe [3304] (Microsoft Skype/Microsoft Corporation)(2014-09-12 19:09:36) 0000000064d30000
Library C:\Program Files\WindowsApps\Microsoft.SkypeApp_3.1.0.1005_x86__kzf8qxf38zg5c\MicrosoftAdvertising.dll (*** suspicious ***) @ C:\Windows\syswow64\wwahost.exe [3304] (Microsoft Advertising Native SDK for Windows 8/Microsoft Corporation)(2014-04-23 10:27:04) 0000000062d90000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk1\DR1 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 02:46 on 08/12/2014 (AR)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
|
|
08.12.2014, 08:46
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" hi,
__________________Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ |
|
08.12.2014, 19:57
| #3 |
| | Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" Das utility meint nichts gefunden zu haben.
__________________Code:
ATTFilter 19:51:36.0795 0x132c TDSS rootkit removing tool 3.0.0.41 Oct 28 2014 17:58:34
19:51:36.0795 0x132c UEFI system
19:51:45.0435 0x132c ============================================================
19:51:45.0435 0x132c Current date / time: 2014/12/08 19:51:45.0435
19:51:45.0435 0x132c SystemInfo:
19:51:45.0435 0x132c
19:51:45.0435 0x132c OS Version: 6.3.9600 ServicePack: 0.0
19:51:45.0435 0x132c Product type: Workstation
19:51:45.0435 0x132c ComputerName: ONYX
19:51:45.0435 0x132c UserName: AR
19:51:45.0435 0x132c Windows directory: C:\Windows
19:51:45.0435 0x132c System windows directory: C:\Windows
19:51:45.0436 0x132c Running under WOW64
19:51:45.0436 0x132c Processor architecture: Intel x64
19:51:45.0436 0x132c Number of processors: 8
19:51:45.0436 0x132c Page size: 0x1000
19:51:45.0436 0x132c Boot type: Normal boot
19:51:45.0436 0x132c ============================================================
19:51:45.0832 0x132c KLMD registered as C:\Windows\system32\drivers\82017717.sys
19:51:46.0601 0x132c System UUID: {97DB47B9-4962-A956-92F0-E6275CFA04CF}
19:51:48.0176 0x132c Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 ( 298.09 Gb ), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
19:51:48.0200 0x132c Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
19:51:48.0216 0x132c ============================================================
19:51:48.0216 0x132c \Device\Harddisk0\DR0:
19:51:48.0216 0x132c MBR partitions:
19:51:48.0216 0x132c \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1800800, BlocksNum 0x11E16800
19:51:48.0217 0x132c \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x13617000, BlocksNum 0xC7B197A
19:51:48.0217 0x132c \Device\Harddisk1\DR1:
19:51:48.0218 0x132c GPT partitions:
19:51:48.0219 0x132c \Device\Harddisk1\DR1\Partition1: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {266CD519-B56A-4C4F-B67C-7FEA5034B77C}, Name: Basic data partition, StartLBA 0x800, BlocksNum 0xC8000
19:51:48.0219 0x132c \Device\Harddisk1\DR1\Partition2: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {5110B831-1136-4D80-AB72-FD0935322E72}, Name: EFI system partition, StartLBA 0xC8800, BlocksNum 0x96000
19:51:48.0219 0x132c \Device\Harddisk1\DR1\Partition3: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {845DAA28-46BB-4318-8E7B-586B72FAAD6B}, Name: Microsoft reserved partition, StartLBA 0x15E800, BlocksNum 0x40000
19:51:48.0219 0x132c \Device\Harddisk1\DR1\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {D0F972A2-099B-4FEA-B826-4D3FD29D830B}, Name: Basic data partition, StartLBA 0x19E800, BlocksNum 0x72167800
19:51:48.0219 0x132c \Device\Harddisk1\DR1\Partition5: GPT, TypeGUID: {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}, UniqueGUID: {7B2A502D-9213-42E4-9A6A-2B39457372F4}, Name: Basic data partition, StartLBA 0x72306000, BlocksNum 0x2400800
19:51:48.0219 0x132c MBR partitions:
19:51:48.0219 0x132c ============================================================
19:51:48.0245 0x132c C: <-> \Device\Harddisk1\DR1\Partition4
19:51:48.0295 0x132c E: <-> \Device\Harddisk0\DR0\Partition1
19:51:48.0373 0x132c F: <-> \Device\Harddisk0\DR0\Partition2
19:51:48.0373 0x132c ============================================================
19:51:48.0373 0x132c Initialize success
19:51:48.0373 0x132c ============================================================
19:53:14.0156 0x10b0 ============================================================
19:53:14.0156 0x10b0 Scan started
19:53:14.0156 0x10b0 Mode: Manual; SigCheck; TDLFS;
19:53:14.0156 0x10b0 ============================================================
19:53:14.0156 0x10b0 KSN ping started
19:53:16.0515 0x10b0 KSN ping finished: true
19:53:17.0687 0x10b0 ================ Scan system memory ========================
19:53:17.0687 0x10b0 System memory - ok
19:53:17.0687 0x10b0 ================ Scan services =============================
19:53:17.0843 0x10b0 [ E1832BD9FD7E0FC2DC9FA5935DE3E8C1, 41FF7418887AFC8B9C96EF21C5950DD342CC9E3C0D87AFD60A05B988C1D6CC23 ] 1394ohci C:\Windows\System32\drivers\1394ohci.sys
19:53:17.0906 0x10b0 1394ohci - ok
19:53:17.0953 0x10b0 [ AD508A1A46EC21B740AB31C28EFDFDB1, 9B1046CF0B80723149BD359B55CC0B8B3ABBEAA9038469F542A4C345C503FB02 ] 3ware C:\Windows\system32\drivers\3ware.sys
19:53:17.0968 0x10b0 3ware - ok
19:53:18.0015 0x10b0 [ 9539F7917B4B6D92C90F0FAA6B86C605, B4C284E8EECC2E7025053A3320EFDC9F47BCA9828853AD2A805DB826CA4AC27E ] ACPI C:\Windows\system32\drivers\ACPI.sys
19:53:18.0046 0x10b0 ACPI - ok
19:53:18.0062 0x10b0 [ AC8279D229398BCF05C3154ADCA86813, 083E86CBE53244D24C334DB1511C77025133AE7875191845764B890A8CA5AFA9 ] acpiex C:\Windows\system32\Drivers\acpiex.sys
19:53:18.0078 0x10b0 acpiex - ok
19:53:18.0078 0x10b0 [ A8970D9BF23CD309E0403978A1B58F3F, 9946C8477104EEC7DB197E2222F9905307F101C398CCED4B5FD0F86A5622C791 ] acpipagr C:\Windows\System32\drivers\acpipagr.sys
19:53:18.0093 0x10b0 acpipagr - ok
19:53:18.0093 0x10b0 [ 111A89C99C5B4F1A7BCE5F643DD86F65, 41A2E49FF443927D05F7EF638518108227852984E68D4663C8761178C0B84A45 ] AcpiPmi C:\Windows\System32\drivers\acpipmi.sys
19:53:18.0124 0x10b0 AcpiPmi - ok
19:53:18.0140 0x10b0 [ 5758387D68A20AE7D3245011B07E36E7, 77832E200E8B0D259552F6F60FE454A887E3EBBB9EA2F3590E6645289A04E293 ] acpitime C:\Windows\System32\drivers\acpitime.sys
19:53:18.0156 0x10b0 acpitime - ok
19:53:18.0218 0x10b0 [ C5679E5186B2FC95BC76A8A9870D5456, 70AC61850B811A0A902532F098AE1D5DF4622455E56C78B89D4ABDBE4A061A48 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
19:53:18.0234 0x10b0 AdobeARMservice - ok
19:53:18.0343 0x10b0 [ F79623288F2A357AB20288B5DC4F452A, AA6F70A4C12E390E08074D6FD0EA0D1856D8274DA833E56A8811BF820A2D41D4 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
19:53:18.0374 0x10b0 AdobeFlashPlayerUpdateSvc - ok
19:53:18.0437 0x10b0 [ 7C1FDF1B48298CBA7CE4BDD4978951AD, 80F4D536E1231B30E836F72ADC8814AE6AA9FEC573FB5F3F965FAC8ABCCAF0F8 ] ADP80XX C:\Windows\system32\drivers\ADP80XX.SYS
19:53:18.0484 0x10b0 ADP80XX - ok
19:53:18.0499 0x10b0 [ 0F17D49BE041B7EFF1D33BF1414E7AC6, F8B536B60903814DF88DAF535753288537EF0993E42AA4E734EDA8D68B24C7AB ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
19:53:18.0562 0x10b0 AeLookupSvc - ok
19:53:18.0593 0x10b0 [ 374E27295F0A9DCAA8FC96370F9BEEA5, 51C394E0C2322D7D093941A1B8766171B5D1F47DF2FE0834209492891EA7D999 ] AFD C:\Windows\system32\drivers\afd.sys
19:53:18.0671 0x10b0 AFD - ok
19:53:18.0718 0x10b0 [ 7DFAEBA9AD62D20102B576D5CAC45EC8, 9FA5207335303D1E8E9A3C9E1FB82C09AD21B04382F69D777A67E48EE91D2093 ] agp440 C:\Windows\system32\drivers\agp440.sys
19:53:18.0734 0x10b0 agp440 - ok
19:53:18.0749 0x10b0 [ 8E8E34B7BA059050EED827410D0697A2, 85B6684709F24729A6497563812A90A54068AC2DD9EEA03037CB1EEF5C85AAA9 ] ahcache C:\Windows\system32\DRIVERS\ahcache.sys
19:53:18.0796 0x10b0 ahcache - ok
19:53:18.0828 0x10b0 [ A91D8E1E433EFB32551BCE69037E1CE7, 41DFDD5B56918D19D09DFB3E4B07460AA85647A8647ABBBB906158D8D6653290 ] ALG C:\Windows\System32\alg.exe
19:53:18.0874 0x10b0 ALG - ok
19:53:18.0906 0x10b0 [ 7589DE749DB6F71A68489DCE04158729, 5F35EDD50737985595C9D6703237CA2ADE49AA5443331020899698EB5114A0FB ] AmdK8 C:\Windows\System32\drivers\amdk8.sys
19:53:18.0937 0x10b0 AmdK8 - ok
19:53:18.0953 0x10b0 [ B46D2D89AFF8A9490FA8C98C7A5616E3, BE0765B5423B690E0F097FECD9717FAA95BFDFFDC6CF1B93DE5A19A1B7797879 ] AmdPPM C:\Windows\System32\drivers\amdppm.sys
19:53:18.0984 0x10b0 AmdPPM - ok
19:53:18.0999 0x10b0 [ D2BF2F94A47D332814910FD47C6BBCD2, FE273D77D119D958676E1197D9EA7B008E3B05C6192B1962A81D4223ED204C35 ] amdsata C:\Windows\system32\drivers\amdsata.sys
19:53:19.0015 0x10b0 amdsata - ok
19:53:19.0031 0x10b0 [ A8E04943C7BBA7219AA50400272C3C6E, 794C0BD12DF0392654E9A37AE4A24B5BE2D83F1F24F74DD48A1A0BF3AB8B1FF8 ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
19:53:19.0046 0x10b0 amdsbs - ok
19:53:19.0046 0x10b0 [ CEA5F4F27CFC08E3A44D576811B35F50, 89DF64B81BD109BAABAE93A4603C1617241219F38DDAF325EFE6BD35FF6FD717 ] amdxata C:\Windows\system32\drivers\amdxata.sys
19:53:19.0046 0x10b0 amdxata - ok
19:53:19.0062 0x10b0 [ 04951A9A937CBE28A2D3FEEA360B6D1F, D8AAF000BE4FE4B203DC2EB2A64F780A542E5238CE3F9952FD03277379B11529 ] AppID C:\Windows\system32\drivers\appid.sys
19:53:19.0093 0x10b0 AppID - ok
19:53:19.0109 0x10b0 [ C0DC3F58214A227980AEB091CFD2F973, 0C3E8453C9F65ADA3E74C38C0E3AC3E0CBFD807B827097046265B38839E151E3 ] AppIDSvc C:\Windows\System32\appidsvc.dll
19:53:19.0140 0x10b0 AppIDSvc - ok
19:53:19.0156 0x10b0 [ 034ED41F13D9C1845C1E081F05B640DB, E4E17BA0B22C464DE60A6BF68D4D035D1B838DE4F0361029DED1AE00503E135C ] Appinfo C:\Windows\System32\appinfo.dll
19:53:19.0203 0x10b0 Appinfo - ok
19:53:19.0234 0x10b0 [ CB12C47647D8BDAFAA94C0856B14128B, 5590C98095357C92563EF94800107D3611AA6ECA1A70BE463C03B279E618A6C4 ] AppReadiness C:\Windows\system32\AppReadiness.dll
19:53:19.0296 0x10b0 AppReadiness - ok
19:53:19.0375 0x10b0 [ F7529BD3FFAC9C33D15F6DE3B7353B03, 8EF0A84C9687A246B60939A326E498121039E9CC617A7ABBA933EDD327F3467E ] AppXSvc C:\Windows\system32\appxdeploymentserver.dll
19:53:19.0437 0x10b0 AppXSvc - ok
19:53:19.0468 0x10b0 [ 65045784366F7EC5FB4E71BCF923187B, 53C215C64FF12E44B097F7CB88E8482438CE0ACBD3C68D8FD38BA0D0D8747FAA ] arcsas C:\Windows\system32\drivers\arcsas.sys
19:53:19.0484 0x10b0 arcsas - ok
19:53:19.0484 0x10b0 [ 74B14192CF79A72F7536B27CB8814FBD, 0CF6BBB63FFE0C12777664D80B2797923844C8392D0FD81D7962EE5EE2C3C3D9 ] atapi C:\Windows\system32\drivers\atapi.sys
19:53:19.0484 0x10b0 atapi - ok
19:53:19.0515 0x10b0 [ 8302D313DCC5536FE6BFB85165D9BB1E, CD9101D9CFE34F0D6CF5A6AD5C997CC5D32CCF5135B78604D0C3CD7252117C2D ] AthBTPort C:\Windows\system32\DRIVERS\btath_flt.sys
19:53:19.0531 0x10b0 AthBTPort - ok
19:53:19.0578 0x10b0 [ A8F6E223B0E460988004556A62233EC5, 59DF8AE71EAF7C0B8F890E8B597A573079D414914E56CCC07B4716A420F66D20 ] AtherosSvc C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe
19:53:19.0593 0x10b0 AtherosSvc - ok
19:53:19.0687 0x10b0 [ FF3A0F772EB85E20E3F9865716B7AAA2, 5F13DE17A621326088D3DD964C1F9A6653B9E5F39C38CA8BADB6137AAD03B7A5 ] athr C:\Windows\system32\DRIVERS\athwbx.sys
19:53:19.0859 0x10b0 athr - ok
19:53:19.0890 0x10b0 [ 7F70B1044272982AAEA7C16E83424770, A7694D38DF5A0E1040688017DB811EF0788874FE505ADD572DE4D4647073DC12 ] AudioEndpointBuilder C:\Windows\System32\AudioEndpointBuilder.dll
19:53:19.0968 0x10b0 AudioEndpointBuilder - ok
19:53:20.0031 0x10b0 [ C0484CA5C7F87E38909746B63C7FC868, 65159639E2300AEA886184E9D47D449350DAF69A8AA2F9DBD6BD8A474BA73177 ] Audiosrv C:\Windows\System32\Audiosrv.dll
19:53:20.0078 0x10b0 Audiosrv - ok
19:53:20.0093 0x10b0 [ 96E8CAF20FC4B6C31CAD7816A801EB78, E4870DB8FFBDCFEE98449338D0BDBF2DD0B5FEC75514E41C11A882BE6EB16833 ] AxInstSV C:\Windows\System32\AxInstSV.dll
19:53:20.0125 0x10b0 AxInstSV - ok
19:53:20.0156 0x10b0 [ A4A73F631FE2AA2826FBE4A399B04DEF, 973AACE8DC8DA669D0DF20F17EFDEEABB90AA046AC980948D16A62D39A606A79 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
19:53:20.0187 0x10b0 b06bdrv - ok
19:53:20.0203 0x10b0 [ 8CC7F7E4AFCBA605921B137ED7992C68, 71406E6D6E9964740A6D90B05329D5492BB90AF40E0630CF2FBF4BA4BA14F2DD ] BasicDisplay C:\Windows\System32\drivers\BasicDisplay.sys
19:53:20.0218 0x10b0 BasicDisplay - ok
19:53:20.0250 0x10b0 [ 38A82F4EE8C416A6744B6D30381ED768, 9EAAE5F43BA09359130AC04B1DCA0F5D4DF32ED89C02DC5CEB640918948847F7 ] BasicRender C:\Windows\System32\drivers\BasicRender.sys
19:53:20.0281 0x10b0 BasicRender - ok
19:53:20.0500 0x10b0 [ 9A4EF701A4FC835F7DDD8956D930010F, 28A555B98098ECE47912C40A74CA92AFA76F51A711F2DEFF1A498FF212505F23 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl63a.sys
19:53:20.0765 0x10b0 BCM43XX - ok
19:53:20.0781 0x10b0 [ C1ABB0F7E3BEA48A0417BDF6FF14AB21, 1CAC63A1A0FB9855A27EE977794576A860F6650C9EF7667FFB27F2A2FF721857 ] bcmfn2 C:\Windows\System32\drivers\bcmfn2.sys
19:53:20.0796 0x10b0 bcmfn2 - ok
19:53:20.0828 0x10b0 [ E07C80468D0C599BFF01D9D4EC7AEDC3, F675F455924DEC3FF69AD816DFEB6E74C804AEC3D3BFF7515953DB9D79C9B2D0 ] BDESVC C:\Windows\System32\bdesvc.dll
19:53:20.0875 0x10b0 BDESVC - ok
19:53:20.0906 0x10b0 [ EC19013E4CF87609534165DF897274D6, 8ED45537CF2D58D759A587CCBFDADD5580C7447B0C3B172CF19ECC7585E073FC ] Beep C:\Windows\system32\drivers\Beep.sys
19:53:20.0953 0x10b0 Beep - ok
19:53:21.0000 0x10b0 [ 20FB137ADDE1255F15F265A7BD9579BE, 87B4D5C91EFEAD987AAC3491A4360F82824C46AFF958B6F4CAED7C12224EF159 ] BFE C:\Windows\System32\bfe.dll
19:53:21.0078 0x10b0 BFE - ok
19:53:21.0109 0x10b0 [ 15225081966C785A9192782401643FD4, E2BA0C8D044556FDD9DD7A25F7F71553DE7A2924E78F9284413C2AC46F0BF4EB ] BITS C:\Windows\System32\qmgr.dll
19:53:21.0203 0x10b0 BITS - ok
19:53:21.0218 0x10b0 [ 6B4FFFDDC618FCF64473CAA86E305697, 29EA66071D5822920F5C50533673ADAB5204F8B25C11027AD27450D881F1142D ] bowser C:\Windows\system32\DRIVERS\bowser.sys
19:53:21.0250 0x10b0 bowser - ok
19:53:21.0281 0x10b0 [ E325BCD68EC0CF2E2EDD0AB7CC17C698, 4DEDEF91F6BD1CC8DBE118AC28CA6BD874449A053B9CDE9FFEB1C7B98501D938 ] BrokerInfrastructure C:\Windows\System32\bisrv.dll
19:53:21.0328 0x10b0 BrokerInfrastructure - ok
19:53:21.0359 0x10b0 [ 041A999E4FF9A7CDBE67357751881FB8, 356C52637EA715D6FA2B65BD311C9BF1635A582023434902EC2DE4A2448961F8 ] Browser C:\Windows\System32\browser.dll
19:53:21.0406 0x10b0 Browser - ok
19:53:21.0437 0x10b0 [ 15BE0FCECAE5BC00FB3D339D3D1CF4E4, 7F77C73404044270AA0A4C9D6BD838564B5356ACA935982390A6EA11FA653AE0 ] BTATH_A2DP C:\Windows\system32\drivers\btath_a2dp.sys
19:53:21.0437 0x10b0 BTATH_A2DP - ok
19:53:21.0468 0x10b0 [ 1FFA5E05F2DE32D9E65CFDA4B33D50FD, 9EC578F563A90C60F893817548195781893405AC8ED7F87C3B5F94F9842161A5 ] btath_avdt C:\Windows\system32\drivers\btath_avdt.sys
19:53:21.0468 0x10b0 btath_avdt - ok
19:53:21.0484 0x10b0 [ C6978F7EBA6F37D626482AC6B9390630, B4BF939AB9962A61DE9518604C20347DC2A6FCDCEB3D8AEF295AF12E6F2CDCF3 ] BTATH_BUS C:\Windows\System32\drivers\btath_bus.sys
19:53:21.0500 0x10b0 BTATH_BUS - ok
19:53:21.0515 0x10b0 [ 4AF7C20F94DAC343C01ED671C82DCB99, 2AABD85D9D76461DE883E0F13F61C391BA81E6198FF88268B319474E25A196C8 ] BTATH_HCRP C:\Windows\System32\drivers\btath_hcrp.sys
19:53:21.0515 0x10b0 BTATH_HCRP - ok
19:53:21.0531 0x10b0 [ 785C38070043BEEE9E9D591DE4067244, 1C8D15B8A9E80A2799E7094C4AE111FEA9FBC6EAA4A61B13EFE59314C9794949 ] BTATH_LWFLT C:\Windows\system32\DRIVERS\btath_lwflt.sys
19:53:21.0531 0x10b0 BTATH_LWFLT - ok
19:53:21.0546 0x10b0 [ 859A116D748FBA603AF94C251DC5CF97, D64061721BE01F86386C4B0168B166C6AD076630B2229036E1D368D877389D46 ] BTATH_RCP C:\Windows\System32\drivers\btath_rcp.sys
19:53:21.0562 0x10b0 BTATH_RCP - ok
19:53:21.0578 0x10b0 [ 58DBB1384F26562111048036E7787F04, 3804BE214113B1759301E359049C0BCE5EB268AB1E028AF5089DAB5116937EF7 ] BtFilter C:\Windows\system32\DRIVERS\btfilter.sys
19:53:21.0609 0x10b0 BtFilter - ok
19:53:21.0625 0x10b0 [ A8F23D453A424FF4DE04989C4727ECC7, AE4A9081395C7379F1C947EF8243F7609F90C843E086B8E77E1A2C06E36D4381 ] BthAvrcpTg C:\Windows\System32\drivers\BthAvrcpTg.sys
19:53:21.0671 0x10b0 BthAvrcpTg - ok
19:53:21.0734 0x10b0 [ 131F1C8573E7BFB41C54FBF5309CCD94, DAFE51E3BADBD82A33B580F212B2D6520A120877C23F6D675521FEA2F4BA5A1F ] BthEnum C:\Windows\System32\drivers\BthEnum.sys
19:53:21.0781 0x10b0 BthEnum - ok
19:53:21.0796 0x10b0 [ 746B9F94214915AECDE4B7FEA5FF9664, EA2877D49DB4B7B9CE61653D63E8776DFF1CBCCAB12C14DB1D20DA44B8F06357 ] BthHFEnum C:\Windows\System32\drivers\bthhfenum.sys
19:53:21.0843 0x10b0 BthHFEnum - ok
19:53:21.0843 0x10b0 [ 71FE2A48E4C93DDB9798C024880B6C07, 8E93DE29C61A5FA64216231228CB3C4A1A693FE87CAA2C070BCAD7BE2D8ED000 ] bthhfhid C:\Windows\System32\drivers\BthHFHid.sys
19:53:21.0859 0x10b0 bthhfhid - ok
19:53:21.0890 0x10b0 [ D30C67473A2E229662D21F27EAA9AAA5, D009C4836B0DFE963D8E3DEEDE611068838F2BBCAB146E6D70692FAB838E11F1 ] BthLEEnum C:\Windows\System32\drivers\BthLEEnum.sys
19:53:21.0937 0x10b0 BthLEEnum - ok
19:53:21.0937 0x10b0 [ 07E33226AD218A2A162662A05CAFB52F, 0AC3D8B79EDA6DA232FA4E1CAF6592420A9EDE96350D1F0504C2434261684F0B ] BTHMODEM C:\Windows\System32\drivers\bthmodem.sys
19:53:21.0968 0x10b0 BTHMODEM - ok
19:53:21.0984 0x10b0 [ 25BB93167DEF270188072603F92A1EF5, CE4637CE4B63420E218F53CAF89A8C85D036B879B80456FEF3C7C395590E26BB ] BthPan C:\Windows\System32\drivers\bthpan.sys
19:53:22.0015 0x10b0 BthPan - ok
19:53:22.0078 0x10b0 [ 97B9076611291AE4C4C107BC915BD026, 0A77873AAF1ADB76CAB98A84D2242781E34E2699632E45EB92ED7DB20B2BE0C1 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
19:53:22.0187 0x10b0 BTHPORT - ok
19:53:22.0250 0x10b0 [ E5E48FEED73D463175EAB1542495191C, 0A8182F5BA7B694AB1DD3680F1194E4A568FE40DBA4BFDFF2EA09BAD045FFB29 ] bthserv C:\Windows\system32\bthserv.dll
19:53:22.0281 0x10b0 bthserv - ok
19:53:22.0375 0x10b0 [ 23E75BED9076F856B36F5F934BBD5795, CCEB72B788522B7D52A6C07646005EBC68F9599D3714ECACF3A194CA47A1BE85 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
19:53:22.0406 0x10b0 BTHUSB - ok
19:53:22.0796 0x10b0 [ EB47E5BD8C8C16C43F087CBEBF34CAC0, B2C8D4C190BF088B44684CEF1C1367DD3FEEE71699EE81AD158129047C454437 ] CCDMonitorService C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe
19:53:22.0968 0x10b0 CCDMonitorService - ok
19:53:22.0984 0x10b0 [ 2FA6510E33F7DEFEC03658B74101A9B9, 61C8C8E3F09B427711464C974EE22E1E01C48E10DB54A4EC9901F482FC36C978 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
19:53:23.0062 0x10b0 cdfs - ok
19:53:23.0062 0x10b0 [ C6796EA22B513E3457514D92DCDB1A3D, 2B893F3950C6B913B934C2089B69F3B0B77F229AE1820907E598455CBB78139C ] cdrom C:\Windows\System32\drivers\cdrom.sys
19:53:23.0093 0x10b0 cdrom - ok
19:53:23.0109 0x10b0 [ AB285CE3431FF3D2ACE669245874C1C7, 6AF4C3E86EFA51F7FB6F8492CB2CCB807C7775EAE0508B87F07134FDAC679BD7 ] CertPropSvc C:\Windows\System32\certprop.dll
19:53:23.0171 0x10b0 CertPropSvc - ok
19:53:23.0265 0x10b0 [ 5832CD83F5E84BFF8BD93727685852CB, 4E0E170335E566E89E7FEA70629ACEF3E4BB8A54001AE81333FC99B983DB73F2 ] cfwids C:\Windows\system32\drivers\cfwids.sys
19:53:23.0343 0x10b0 cfwids - ok
19:53:23.0343 0x10b0 [ BE9936EDD3267FAAFF94A7835867F00B, 3CEEF2377D45ED38C7CD3CE4C746EC5EA7277EFEC728A5438F0EF5F62FC7C859 ] circlass C:\Windows\System32\drivers\circlass.sys
19:53:23.0375 0x10b0 circlass - ok
19:53:23.0406 0x10b0 [ 179A41249055D5F039F1B6703F3B6D2B, 886CF715D9E85DB5C9B991EBCB9B12E27AA0EEE52528E222C80CA5B5B0A7AF52 ] CLFS C:\Windows\system32\drivers\CLFS.sys
19:53:23.0421 0x10b0 CLFS - ok
19:53:23.0531 0x10b0 [ EF6EF85DADC3184A10D8F2F7159973CB, 42FCB286CED95A5DEBC5C0C894FCBC4818A2C818BB71087142FB51A08A0BE96B ] CmBatt C:\Windows\System32\drivers\CmBatt.sys
19:53:23.0609 0x10b0 CmBatt - ok
19:53:23.0734 0x10b0 [ 4E1207CE16E615B0B7A70DC889F4500E, 1778D5AC0AF5F5DD1551192F4CDBCCB9878995155CF337EBB03460A6FD5C6B78 ] CNG C:\Windows\system32\Drivers\cng.sys
19:53:23.0750 0x10b0 CNG - ok
19:53:23.0750 0x10b0 [ 03AAED827C36F35D70900558B8274905, 8E44A23C6013FFAE7769F99CAA3B1D6288DE00A38937F9056903AC265B503AFA ] CompositeBus C:\Windows\System32\drivers\CompositeBus.sys
19:53:23.0781 0x10b0 CompositeBus - ok
19:53:23.0781 0x10b0 COMSysApp - ok
19:53:23.0796 0x10b0 [ A1FF7DFBFBE164CF92603C651D304DD2, 470ACE5A75E64FC62C950037201199857E974803625DC73BEDBCF6FA4DDD496C ] condrv C:\Windows\system32\drivers\condrv.sys
19:53:23.0828 0x10b0 condrv - ok
19:53:23.0937 0x10b0 [ 585B94ED9EBE1FA9A30734BB2129C612, 6D2F31DB3902D5E7DA55B190D8D7EEDC85CFEF5C7A86020942E91358283ACC70 ] cphs C:\Windows\SysWow64\IntelCpHeciSvc.exe
19:53:23.0953 0x10b0 cphs - ok
19:53:24.0031 0x10b0 [ 0EFE4B5884A8032617826A4D76F80969, 083D296CC623C83D36A97AEE343ADF819B17E490F931DBE4D161BD1E8C289E02 ] CryptSvc C:\Windows\system32\cryptsvc.dll
19:53:24.0109 0x10b0 CryptSvc - ok
19:53:24.0140 0x10b0 [ 315BA4BC19316D72B2E037534E048B93, 69613635DB23E6A935673B1025C2010ED3E195473D25368CF74234C4C36910BE ] dam C:\Windows\system32\drivers\dam.sys
19:53:24.0156 0x10b0 dam - ok
19:53:24.0203 0x10b0 [ 81979817943D830BF24571B7C1B28A1A, 9584D8F1FB3E6CF17BD465670B208C723A8E8B06775A3DA44F75D7710404EEA6 ] DcomLaunch C:\Windows\system32\rpcss.dll
19:53:24.0328 0x10b0 DcomLaunch - ok
19:53:24.0515 0x10b0 [ D249C3A58A4FCF755EF4C94F7047E015, 68C044CE2DB93FB502F85F6E081EA164F6E6DCBA6B3EE2A5CBDA122065E522F8 ] defragsvc C:\Windows\System32\defragsvc.dll
19:53:24.0578 0x10b0 defragsvc - ok
19:53:24.0609 0x10b0 [ 8F387C2C99EE09C6E2AC316205F86A17, EC9E8AE72A21992AA118964E17090BA4503EB051273AD18185C95172F57328CE ] DeviceAssociationService C:\Windows\system32\das.dll
19:53:24.0640 0x10b0 DeviceAssociationService - ok
19:53:24.0671 0x10b0 [ BC6849C62DB407573C6AD8CB1A4D2628, 5BDE0D60F85E4C27CEAD1B301155B54D841FB773BD5BB8AC5DDAEE31F8E94627 ] DeviceInstall C:\Windows\system32\umpnpmgr.dll
19:53:24.0718 0x10b0 DeviceInstall - ok
19:53:24.0750 0x10b0 [ A03F362C5557E238CBFA914689C77248, BAD0A1124E6A384C15028FBE121ADF650F7716442555AD3737B9EA1F58A69246 ] Dfsc C:\Windows\system32\Drivers\dfsc.sys
19:53:24.0781 0x10b0 Dfsc - ok
19:53:24.0796 0x10b0 [ 73BDD44A6088916964945886F9025409, 8E2ECC9AAEF3C6EBA2E61D25F657FDFCC72AB517CC4FD5FFF992E1F9EB942662 ] dg_ssudbus C:\Windows\system32\DRIVERS\ssudbus.sys
19:53:24.0812 0x10b0 dg_ssudbus - ok
19:53:24.0843 0x10b0 [ 05DE04005CE0D84D0E6AD21CAEB369C6, E6704A2A685BCFD560796D7C328F8E53DF0793DBDA590598A492D9070D109298 ] Dhcp C:\Windows\system32\dhcpcore.dll
19:53:24.0875 0x10b0 Dhcp - ok
19:53:24.0906 0x10b0 [ 4D40C9B33F738797CF50E77CB7C53E85, 7BA341342A47DEB15B51971C97A5237ACD8BDAD9033F63DF0000892BE43F8E13 ] disk C:\Windows\system32\drivers\disk.sys
19:53:24.0921 0x10b0 disk - ok
19:53:24.0921 0x10b0 [ EB70A894708D1BC176AFD690FF06085F, 0DD2A97F5E1B38D1F7C0D44E50F09EA222B18B3B074CC9C8CD25A7526CB1A112 ] dmvsc C:\Windows\System32\drivers\dmvsc.sys
19:53:24.0953 0x10b0 dmvsc - ok
19:53:24.0984 0x10b0 [ FE7656474448BE6A6C68E5C9BEB7CA94, 8B9F04CAA29A6EEFCA3D1E7BAFE340D5CCA8AF665474E69B1DF7E2A518B83A89 ] Dnscache C:\Windows\System32\dnsrslvr.dll
19:53:25.0031 0x10b0 Dnscache - ok
19:53:25.0062 0x10b0 [ 50288EA079BB520C2B8C8A154202D518, 8916A9180CA009D124FFDFB4CCF5FDFEF7FA2FD37CBCD49FAD4C68E051B4734D ] dot3svc C:\Windows\System32\dot3svc.dll
19:53:25.0093 0x10b0 dot3svc - ok
19:53:25.0109 0x10b0 [ 281BEE07BA97E3E98D12A822D923D0D8, 6EB482B2D4D6048D145C3738B2B6FA27A90B5EA53E9167447820F9981B004E63 ] DPS C:\Windows\system32\dps.dll
19:53:25.0156 0x10b0 DPS - ok
19:53:25.0281 0x10b0 [ DDC11A202207C0400CBE07315B8FDE5E, 3ED0CA3A714582D92001BA3BFF78BE082F4DC8021298D5A2632F3B2B0A1C09DC ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
19:53:25.0328 0x10b0 drmkaud - ok
19:53:25.0375 0x10b0 [ 5B074F14F5DD6418F46EE4CA2DEB7EA8, B8223D73C3DE123759101F7D5D45C60BD12B221F09D349575A1044CE3F43CBC5 ] DsmSvc C:\Windows\System32\DeviceSetupManager.dll
19:53:25.0406 0x10b0 DsmSvc - ok
19:53:25.0468 0x10b0 [ 313DCE665B57000B18CB26C6B6A10DFE, 6C332D4AD13A316C192321AB7E7597E66AF8E1688101FFD851E06C52128DBA52 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
19:53:25.0546 0x10b0 DXGKrnl - ok
19:53:25.0656 0x10b0 [ 6073537F250B45E1CB2A02E97F0FE1B2, 653F3F2F2019168EDF225944A88AFDBF8393B62AA076BD19980691778F3DB67D ] Eaphost C:\Windows\System32\eapsvc.dll
19:53:25.0734 0x10b0 Eaphost - ok
19:53:26.0640 0x10b0 [ 114BCFDF367FF37C3F1B0A96AF542E4D, D385BC1D91BC1406091C8C3691C07A90BD60EDE05B1384E5AA3506FCB909C857 ] ebdrv C:\Windows\system32\drivers\evbda.sys
19:53:26.0765 0x10b0 ebdrv - ok
19:53:26.0781 0x10b0 [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] EFS C:\Windows\System32\lsass.exe
19:53:26.0796 0x10b0 EFS - ok
19:53:26.0828 0x10b0 [ 43531A5993380CC5113242C29D265FD9, EE0076D96F7F3CF29884AC7A67C08A429115A7201354A1FB5DE45FD63ABB4960 ] EhStorClass C:\Windows\system32\drivers\EhStorClass.sys
19:53:26.0828 0x10b0 EhStorClass - ok
19:53:26.0843 0x10b0 [ 6F8E738A9505A388B1157FDDE7B3101B, 3696CA634102B41EEA11EB9DCA0B24439D8636AED4A7190C138C5E64A2EFB514 ] EhStorTcgDrv C:\Windows\system32\drivers\EhStorTcgDrv.sys
19:53:26.0859 0x10b0 EhStorTcgDrv - ok
19:53:27.0000 0x10b0 [ F3388CA946DEC6C2B4AC4FF2DD22BF23, 777113458589E1496C812246C40064D459E6799CD625623C3F6305F00989CA17 ] ePowerSvc C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
19:53:27.0078 0x10b0 ePowerSvc - ok
19:53:27.0093 0x10b0 [ DFFFAE1442BA4076E18EED5E406FA0D3, 329FC6FB8D14BEACDBE2A5D4C496EDEA485E838B1DF27566E278F8F8E0D8E82E ] ErrDev C:\Windows\System32\drivers\errdev.sys
19:53:27.0109 0x10b0 ErrDev - ok
19:53:27.0140 0x10b0 [ 030CE75B7D8F75FAA7BA1EC6FD0EB5A3, 5264734F0572FAEDCCB008221C9982CCB7922C4FFC358605424EA413CDCDAE99 ] EventSystem C:\Windows\system32\es.dll
19:53:27.0187 0x10b0 EventSystem - ok
19:53:27.0203 0x10b0 [ 7729D294A555C7AEB281ED8E4D0E01E4, 7269E79D72CCE477AC108294D0DDFB59CF533B03C587599C5AB0507C43A0B6D4 ] exfat C:\Windows\system32\drivers\exfat.sys
19:53:27.0234 0x10b0 exfat - ok
19:53:27.0281 0x10b0 [ F1F6FD03EC909583A8CD56C2ABBC5BBE, ECCEE5B3E5C538017DDDC03FC3B74F27EFC9C67EFAA2758203952895C9A4C414 ] Ext2Fsd C:\Windows\system32\Drivers\Ext2Fsd.sys
19:53:27.0296 0x10b0 Ext2Fsd - ok
19:53:27.0328 0x10b0 [ 7C4E0D5900B2A1D11EDD626D6DDB937B, 732F310F8F6016C56F432A81636B13CE0124A802FE8DD91287B618EED22C9A1D ] fastfat C:\Windows\system32\drivers\fastfat.sys
19:53:27.0343 0x10b0 fastfat - ok
19:53:27.0375 0x10b0 [ 2BC8532ABF2B3756B78FA1DA54147DDE, DF65EE2AB0255A2CF3221085A6BE7C37E3DB6BFEED3BCADCDD69BB1049F6DCB1 ] Fax C:\Windows\system32\fxssvc.exe
19:53:27.0421 0x10b0 Fax - ok
19:53:27.0437 0x10b0 [ 5D8402613E778B3BD45E687A8372710B, EE9EA10805168D309A609B9019AEC5961EE46D18207B5E0EA2DE4064A5770AF8 ] fdc C:\Windows\System32\drivers\fdc.sys
19:53:27.0453 0x10b0 fdc - ok
19:53:27.0453 0x10b0 [ DC1A78BCCCB7EE53D6FD3BD615A8E222, EE16B6853185AAE779D7135035983938009901658F76A8856AAC12EBA15BB34E ] fdPHost C:\Windows\system32\fdPHost.dll
19:53:27.0484 0x10b0 fdPHost - ok
19:53:27.0500 0x10b0 [ E5AD448F2DC84B1CF387FA7F2A3D1936, BBB29C79A085C503F5EFFB5144596D5DEC48A4EB34A049A4E7B38B27F6D92E0A ] FDResPub C:\Windows\system32\fdrespub.dll
19:53:27.0531 0x10b0 FDResPub - ok
19:53:27.0546 0x10b0 [ 0046E0BD031213D37123876B0D0FA61C, A4FE17D56F0BAFB70D0D421ED9D1B6E50AF8ADAA4B59328A41AEC5B4C068A3CB ] fhsvc C:\Windows\system32\fhsvc.dll
19:53:27.0562 0x10b0 fhsvc - ok
19:53:27.0593 0x10b0 [ BCFD8B149B3ADF92D0DB1E909CAF0265, 002B085C131473642450176B4B8359F3E5B04350AFB659B9C0F9EB587D1181E7 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
19:53:27.0609 0x10b0 FileInfo - ok
19:53:27.0625 0x10b0 [ A1A66C4FDAFD6B0289523232AFB7D8AF, 0F5832F626BB62190D5F3A088CE6E048D8A400CCF9EA527F06973CAD96D3A81C ] Filetrace C:\Windows\system32\drivers\filetrace.sys
19:53:27.0656 0x10b0 Filetrace - ok
19:53:27.0672 0x10b0 [ BE743083CF7063C486A4398E3AEFE59A, 85796D89943DD6FE3932C1ED6CF01470C1B4DFD243C390B07055FFDA3C231551 ] flpydisk C:\Windows\System32\drivers\flpydisk.sys
19:53:27.0703 0x10b0 flpydisk - ok
19:53:27.0734 0x10b0 [ 6592D192E2823C043EDBC010E7774053, C025A0EC5517DC3BD5D6656DC0F0F19021FB3D2EE90EC6194E1BD74E638EBBDC ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
19:53:27.0750 0x10b0 FltMgr - ok
19:53:27.0797 0x10b0 [ 3FA6DC6B29717E32E211C1FD821F2C75, E467F3775427C93CC2B87327B0A45669631A5FC460C558F6796BA26002A8BBFC ] FontCache C:\Windows\system32\FntCache.dll
19:53:27.0875 0x10b0 FontCache - ok
19:53:27.0968 0x10b0 [ 1C52387BF5A127F5F3BFB31288F30D93, 90D13F60170CD74304F3036A90D596AA3E1E134455A780310BDF67AC7815F2E7 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
19:53:27.0968 0x10b0 FontCache3.0.0.0 - ok
19:53:27.0984 0x10b0 [ 35005534E600E993A90B036E4E599F2B, DA56FA3776FBD3D50276CB7410E0CB6F137DD8FCA84C0F3FEF8B1FEA5F6CA592 ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
19:53:28.0000 0x10b0 FsDepends - ok
19:53:28.0015 0x10b0 [ 09F460AFEDCA03F3BF6E07D1CCC9AC42, B832091BC9B2C2FE38A4BCA132ABB58251E851F21EC6F39636E73777AB9A5791 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
19:53:28.0015 0x10b0 Fs_Rec - ok
19:53:28.0062 0x10b0 [ F152D55E497E12256290C43B31C7D0CE, FFC54B14CCFBC1548948C07FB3866E40A11D0C05AC352BD000E71CEF053F6A6E ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
19:53:28.0078 0x10b0 fvevol - ok
19:53:28.0109 0x10b0 [ 9591D0B9351ED489EAFD9D1CE52A8015, AC64C236C3AE545FCE8ED44A4A87FB86265A453BA60026EC9A4DE2B631E99996 ] FxPPM C:\Windows\System32\drivers\fxppm.sys
19:53:28.0109 0x10b0 FxPPM - ok
19:53:28.0109 0x10b0 [ FC3EF65EE20D39F8749C2218DBA681CA, 12980F1DE99B25E6920A33556F3ABDA5EC9BFE4757BE602130B5E939D8D25CE3 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
19:53:28.0125 0x10b0 gagp30kx - ok
19:53:28.0140 0x10b0 [ 0BF5CAD281E25F1418E5B8875DC5ADD1, 0929AD8437DD78234553D8B2CDF0D6838FD54ACDE1918AFEBE48684EB32A07A3 ] gencounter C:\Windows\System32\drivers\vmgencounter.sys
19:53:28.0156 0x10b0 gencounter - ok
19:53:28.0187 0x10b0 [ 8DF1254093B5C354CE725EB6B9B0DE19, DE6C5661CC076DA44B8A5D044FDB7280EDCF38D322A98C14FDC82E25586B3014 ] GPIOClx0101 C:\Windows\system32\Drivers\msgpioclx.sys
19:53:28.0203 0x10b0 GPIOClx0101 - ok
19:53:28.0250 0x10b0 [ 69DB09F0263C637DA8568D404842466A, D042194266978AAD31E04DAF7018CD50754077212DC74A4D8AFF6BFEE80CDD20 ] gpsvc C:\Windows\System32\gpsvc.dll
19:53:28.0312 0x10b0 gpsvc - ok
19:53:28.0375 0x10b0 [ F172AD4E906D97ED8F071896FC6789DC, FC10B3CE3DB0D3BF84DFD28E900EB6A11EDAAE32AC50F23CB03AACC6AA496911 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:53:28.0390 0x10b0 gupdate - ok
19:53:28.0406 0x10b0 [ F172AD4E906D97ED8F071896FC6789DC, FC10B3CE3DB0D3BF84DFD28E900EB6A11EDAAE32AC50F23CB03AACC6AA496911 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:53:28.0406 0x10b0 gupdatem - ok
19:53:28.0437 0x10b0 [ 56F69F7C25FB67C970997D7066DBC593, 83E03A82237DCC5BCB3E722ACECACEF3510CAA619F33E0D7C4D902A482E90418 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
19:53:28.0515 0x10b0 HdAudAddService - ok
19:53:28.0547 0x10b0 [ D4B7ED39C7900384D9E5C1283F1E7926, F93F98858067B40F1C071EAD0F8E85442A78B95342BC692AF4D726540634923F ] HDAudBus C:\Windows\System32\drivers\HDAudBus.sys
19:53:28.0578 0x10b0 HDAudBus - ok
19:53:28.0593 0x10b0 [ 10A70BC1871CD955D85CD88372724906, 2480A74854D0A89FF028EE9BA41224D4B2F9B0863066BFC43097920794FEE08D ] HidBatt C:\Windows\System32\drivers\HidBatt.sys
19:53:28.0609 0x10b0 HidBatt - ok
19:53:28.0625 0x10b0 [ 1EA1B4FABB8CC348E73CA90DBA22E104, 5C18C6BD499272F216DD4626B5E8D38181AEAC9AD917FBEB614A75B70467B258 ] HidBth C:\Windows\System32\drivers\hidbth.sys
19:53:28.0640 0x10b0 HidBth - ok
19:53:28.0656 0x10b0 [ C241A8BAFBBFC90176EA0F5240EACC17, 571E20B87818618BE9179986177D55739A240F04D1F740B3C1B7809B9427B767 ] hidi2c C:\Windows\System32\drivers\hidi2c.sys
19:53:28.0718 0x10b0 hidi2c - ok
19:53:28.0734 0x10b0 [ 9BDDEE26255421017E161CCB9D5EDA95, B766FD5E31708F29384F69418FC33C4BCC6E3064AA553D5B1D30EE0B8B1BFB40 ] HidIr C:\Windows\System32\drivers\hidir.sys
19:53:28.0750 0x10b0 HidIr - ok
19:53:28.0781 0x10b0 [ 449A20A674AA3FAA7F0DD4E33EE2DC20, 28B9BDA306456E8640C355718DE3477537B0FAF8C37F633C709129AAB64D9873 ] hidserv C:\Windows\system32\hidserv.dll
19:53:28.0812 0x10b0 hidserv - ok
19:53:28.0828 0x10b0 [ 8DB8EAB9D0C6A5DF0BDCADEA239220B4, EDA23E6909EB83E5E148816DFB16CC29EA01BD6BD2F73AA46B3D820B85FB9C83 ] HidUsb C:\Windows\System32\drivers\hidusb.sys
19:53:28.0875 0x10b0 HidUsb - ok
19:53:28.0890 0x10b0 [ 7BF3ADCBD021D4F4A84CF40EB49C71B5, 5758A51FD2EBE67E6DBE3A298D714D351910F9E01C428D0C1359457C9242B298 ] hkmsvc C:\Windows\system32\kmsvc.dll
19:53:28.0906 0x10b0 hkmsvc - ok
19:53:28.0922 0x10b0 [ 6CD9C3819BE8C0A3DACC82AE5D3C4F18, 46BF4A968E506DE17CA401401D716B444CDC10A5C60EB081890DD4B886AEDF5F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
19:53:28.0953 0x10b0 HomeGroupListener - ok
19:53:28.0984 0x10b0 [ 1A4DA1D6287B99033D144B436C23B656, D4D1EEB372E61512EA36A33F095E68C225B8E6C72CC57ED8BD00533F88012F40 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
19:53:29.0047 0x10b0 HomeGroupProvider - ok
19:53:29.0078 0x10b0 [ A6AACEA4C785789BDA5912AD1FEDA80D, D197012A5DA6AB3F76FF298336DF0CF027C07ECC71267BAEF5912DE12893E096 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
19:53:29.0109 0x10b0 HpSAMD - ok
19:53:29.0203 0x10b0 [ 9DDCA7F18983C5410DEFF79F819DF93C, CE97B4440377BFC5CA81BB600C3BD1DD9FB3951CA1EB70735F5E2050EBB74223 ] HTTP C:\Windows\system32\drivers\HTTP.sys
19:53:29.0234 0x10b0 HTTP - ok
19:53:29.0265 0x10b0 [ 90656C0B3864804B090434EFC582404F, BDB60050B729AACB9E009AC7129BEBD6298BBD8A9DB14B817D02E8E13669BD6E ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
19:53:29.0281 0x10b0 hwpolicy - ok
19:53:29.0297 0x10b0 [ 6D6F9E3BF0484967E52F7E846BFF1CA1, C982966BDE6A3E6773D9441ADA7A3B08D13511DFC68D04DF303248B942423F38 ] hyperkbd C:\Windows\System32\drivers\hyperkbd.sys
19:53:29.0312 0x10b0 hyperkbd - ok
19:53:29.0312 0x10b0 [ 907C870F8C31F8DDD6F090857B46AB25, 308664A31717383D06185875E76C6612407A9F04E7DB28404F574A5706C6715D ] HyperVideo C:\Windows\system32\DRIVERS\HyperVideo.sys
19:53:29.0328 0x10b0 HyperVideo - ok
19:53:29.0343 0x10b0 [ 84CFC5EFA97D0C965EDE1D56F116A541, 0155EA62BF07D99D98D1C9B6559C8E3301B016A20D03DF1EF64B2FAB8C37403B ] i8042prt C:\Windows\System32\drivers\i8042prt.sys
19:53:29.0359 0x10b0 i8042prt - ok
19:53:29.0375 0x10b0 [ 5D90E32E36CE5D4C535D17CE08AEAF05, 976A463343E8C8308AFBE9E64DF56C430D2241DE002430D00318AB065EB72E4A ] iaLPSSi_GPIO C:\Windows\System32\drivers\iaLPSSi_GPIO.sys
19:53:29.0375 0x10b0 iaLPSSi_GPIO - ok
19:53:29.0375 0x10b0 [ DD05E7E80F52ADE9AEB292819920F32C, E71AB6A50B0F90C8F94569CE89F66F915A0A4A00D4AC091B2E5E750D88CFC334 ] iaLPSSi_I2C C:\Windows\System32\drivers\iaLPSSi_I2C.sys
19:53:29.0390 0x10b0 iaLPSSi_I2C - ok
19:53:29.0453 0x10b0 [ 57CD95DEB3529181BCC931DD2DFB2341, 03ACF906E4C3CF954F503900F42C7A60FCD5624772B90A956F032484146E42B7 ] iaStorA C:\Windows\system32\drivers\iaStorA.sys
19:53:29.0468 0x10b0 iaStorA - ok
19:53:29.0531 0x10b0 [ 08BFE413B0B4AA8DFA4B5684CE06D3DC, 95DEEBB203E12EE6E191F5247A74C04AEC0E16DE981FADDC4D6C42EE41D8D079 ] iaStorAV C:\Windows\system32\drivers\iaStorAV.sys
19:53:29.0593 0x10b0 iaStorAV - ok
19:53:29.0656 0x10b0 [ A2200C3033FA4EF249FC096A7A7D02A2, 5819F5C2020DE2EEE339B0C08CD4B1E3490EAFBBEA1277CE649DB5A5150986B0 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
19:53:29.0687 0x10b0 iaStorV - ok
19:53:29.0750 0x10b0 IBG_gds_db - ok
19:53:29.0750 0x10b0 IBS_gds_db - ok
19:53:29.0765 0x10b0 IEEtwCollectorService - ok
19:53:30.0422 0x10b0 [ 7A5A61997B5404C8EDDFCC62378164DC, C2BCA8A2AA2DFCCF3489FC7F0F366ABBDC8606CFC6397CD7B17C8CD4A28DD17F ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
19:53:30.0625 0x10b0 igfx - ok
19:53:30.0672 0x10b0 [ DEA76F90F9777E3427D70E380222B23B, B917BA423896A12E45623E3D494CA03317A6FC612CA433C62C897524DC3E756B ] IKEEXT C:\Windows\System32\ikeext.dll
19:53:30.0734 0x10b0 IKEEXT - ok
19:53:30.0765 0x10b0 [ 4011430BC9DA46ADFAE9915EFEC312FB, 925DDDA187AE7C46C94FBBFA18FC602260957B6BA891D65DFC09385B6DDEAB58 ] intaud_WaveExtensible C:\Windows\system32\drivers\intelaud.sys
19:53:30.0765 0x10b0 intaud_WaveExtensible - ok
19:53:30.0906 0x10b0 [ 8EB4D1D7806D05E5AB39D96464D801CA, 73853F56CD05243B1CABED2CA2420DFC8BA53F951030EECCD0D2A0E26D8A0D1B ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
19:53:31.0015 0x10b0 IntcAzAudAddService - ok
19:53:31.0047 0x10b0 [ D6A22510D795928E8840619900D672B4, 296F232B0A6D42840A745E4706D2815F6D2E4279DBD90112CBFBFF8833B724AF ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys
19:53:31.0047 0x10b0 IntcDAud - ok
19:53:31.0125 0x10b0 [ 0DB1E3F6189C628675F855C0EB510419, 989F539E82105019D2D81255369B96DC65826CD2A421DA09809155B26F69C555 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
19:53:31.0156 0x10b0 Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 )
19:53:33.0765 0x10b0 Detect skipped due to KSN trusted
19:53:33.0765 0x10b0 Intel(R) Capability Licensing Service Interface - ok
19:53:33.0843 0x10b0 [ 492AAF2FF66F437F0E796574B116EFC3, 6BF21C61ED05705DD58203952A750D1AB4D4B62F3A2B640BBBD9B85D1ECC3E5C ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
19:53:33.0859 0x10b0 Intel(R) Capability Licensing Service TCP IP Interface - ok
19:53:33.0890 0x10b0 [ 4E448FCFFD00E8D657CD9E48D3E47157, 4A958CF0BF8DAEAE5E008500BA67CE89B21388592811274331EE39CAC1043A00 ] intelide C:\Windows\system32\drivers\intelide.sys
19:53:33.0890 0x10b0 intelide - ok
19:53:33.0922 0x10b0 [ 139CFCDCD36B1B1782FD8C0014AC9B0E, E0D7E0E9B46A8CECE138D689820023BFA650FB689E4FD62855BED37E04F2D9FF ] intelpep C:\Windows\system32\drivers\intelpep.sys
19:53:33.0953 0x10b0 intelpep - ok
19:53:33.0969 0x10b0 [ 47E74A8E53C7C24DCE38311E1451C1D9, 79B06E37A552C8A847404D4C572CDB8CF525354D8AE3BEBC06892B7C3B330761 ] intelppm C:\Windows\System32\drivers\intelppm.sys
19:53:34.0000 0x10b0 intelppm - ok
19:53:34.0015 0x10b0 [ 9DB76D7F9E4E53EFE5DD8C53DE837514, 07BA4EDA9BE9139A689A2C3EFC1D1A4F3D1216625ED145F313398292A2CD5703 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:53:34.0015 0x10b0 IpFilterDriver - ok
19:53:34.0078 0x10b0 [ ACFEE9487693C2BD573DFCA71D98E17C, A347FD476147CD3568EEE6993B46AFC05A66A4269094CA51572D0FD013FCB535 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
19:53:34.0156 0x10b0 iphlpsvc - ok
19:53:34.0187 0x10b0 [ 9C096BF5E10CA8BFA56F32522A89FAF1, 6C1151160799338DA351C7237AB049926C6C15F24F5E154BBF5929B4A96C0B8D ] IPMIDRV C:\Windows\System32\drivers\IPMIDrv.sys
19:53:34.0203 0x10b0 IPMIDRV - ok
19:53:34.0234 0x10b0 [ B7342B3C58E91107F6E946A93D9D4EFD, D5DA3C02C5C5A343785745EF6983CC9B5FBD3FB8D49FE9B450523E50212D1A32 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
19:53:34.0281 0x10b0 IPNAT - ok
19:53:34.0297 0x10b0 [ AE44C526AB5F8A487D941CEB57B10C97, A783A2EAF7A6FF450FB3F189A5930036FA60D125C42171AC44B6FE2E3DBD6F7A ] IRENUM C:\Windows\system32\drivers\irenum.sys
19:53:34.0312 0x10b0 IRENUM - ok
19:53:34.0344 0x10b0 [ 8AFEEA3955AA43616A60F133B1D25F21, E99359A4F1D653790133F145CF7C9F97399FD75C5E135AA7E5F989BB660789AF ] isapnp C:\Windows\system32\drivers\isapnp.sys
19:53:34.0344 0x10b0 isapnp - ok
19:53:34.0390 0x10b0 [ D90AB68D0FAC9F357F663670FDBB511E, A82AAA5DF1B38EFBDCF834535A0C520D1BB2D7A4A906C18CFDD22BCF16BDB97D ] iScsiPrt C:\Windows\System32\drivers\msiscsi.sys
19:53:34.0390 0x10b0 iScsiPrt - ok
19:53:34.0453 0x10b0 [ EE03564B7FAFE2E44EDA33D52E83B4A3, 53C917EEC92B813EB0C86B225E9887C9CDFDD7708AEA71BFAC0A3039E26D7BEB ] iwdbus C:\Windows\System32\drivers\iwdbus.sys
19:53:34.0453 0x10b0 iwdbus - ok
19:53:34.0531 0x10b0 [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
19:53:34.0547 0x10b0 jhi_service - ok
19:53:34.0562 0x10b0 [ 45369E037410609D769852A1CE46A184, 752BE7BB167E602CD89D52E3A4382AF7C75033306E31884EC55872EF7A0A3EE2 ] k57nd60a C:\Windows\system32\DRIVERS\k57nd60a.sys
19:53:34.0609 0x10b0 k57nd60a - ok
19:53:34.0625 0x10b0 [ 8BE92376799B6B44D543E8D07CDCF885, 425B8BB1BAF62F735B3CB5A002E6055879F02E7207E55942BFD37F1784F5F368 ] kbdclass C:\Windows\System32\drivers\kbdclass.sys
19:53:34.0640 0x10b0 kbdclass - ok
19:53:34.0672 0x10b0 [ FB6E47E569D4872ABEB506BE03A45FBA, 5C4056CADA8F67587A119D9AE2A0EFAB30387CF6298F4019FF68AC92E2F6F54B ] kbdhid C:\Windows\System32\drivers\kbdhid.sys
19:53:34.0687 0x10b0 kbdhid - ok
19:53:34.0687 0x10b0 [ 813871C7D402A05F2E3A7075F9584A05, FF0C2F87EB083F8CE74C679D80C845CDFBFBBC70BE818F899F3336BBB54A3FFB ] kdnic C:\Windows\system32\DRIVERS\kdnic.sys
19:53:34.0718 0x10b0 kdnic - ok
19:53:34.0718 0x10b0 [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] KeyIso C:\Windows\system32\lsass.exe
19:53:34.0734 0x10b0 KeyIso - ok
19:53:34.0750 0x10b0 [ ADDECBCC777665BD113BED437E602AB0, B6283475A1219CE44E9F683DD3BEB8C42DA0943297E5C4699B22176AD8A6A7ED ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
19:53:34.0765 0x10b0 KSecDD - ok
19:53:34.0781 0x10b0 [ 6D2EE96150E35B9EA49F2B481DE0369A, AC5915219FD81D89E444F6E86D71F7C495108FC35E7BD683321FC7006161AFE1 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
19:53:34.0797 0x10b0 KSecPkg - ok
19:53:34.0812 0x10b0 [ 11AFB527AA370B1DAFD5C36F35F6D45F, 757AD234284467ADB826F7CA0251F58D48866B91995BC867DEA4BAF676947163 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
19:53:34.0828 0x10b0 ksthunk - ok
19:53:34.0859 0x10b0 [ 32B1A8351160F307A8C66BCB0F94A9C2, 52F1DEC2BBD4D5DDBB85ED20B99D96BBA7EB83304D76F183A11FDAFDA364E873 ] KtmRm C:\Windows\system32\msdtckrm.dll
19:53:34.0890 0x10b0 KtmRm - ok
19:53:34.0922 0x10b0 [ 793EACA6BAE9F481C2059BCB3743EB4A, 2624905C6B6A1227BD1CAC7D4FE55A5F6543E1278DAB31EC553748472D180D1D ] LanmanServer C:\Windows\system32\srvsvc.dll
19:53:35.0000 0x10b0 LanmanServer - ok
19:53:35.0047 0x10b0 [ D0D9C2ECA4D03A8F06DCD91236B90C98, E2D1144DC8040EA5FEB0602A20BA4CB920B4BC86AD5AD05FC0DF7D74DC95DC66 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
19:53:35.0093 0x10b0 LanmanWorkstation - ok
19:53:35.0125 0x10b0 [ 626D19F1771E1AE72208AE9A8F3082F7, 78FDB64545ED2EAE9F51C08120E21D2C3285208F6846BD8BBA08CAA839E7A0C4 ] lfsvc C:\Windows\System32\GeofenceMonitorService.dll
19:53:35.0172 0x10b0 lfsvc - ok
19:53:35.0187 0x10b0 [ C09010B3680860131631F53E8FE7BAD8, 35F2A06D5F29478D22ABDCC20DA893EF9D96504C65594A0CEA674D1C21B04FF8 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
19:53:35.0203 0x10b0 lltdio - ok
19:53:35.0234 0x10b0 [ 00E070FC0C673311AFD4B068D1242780, 50B0E0E625361145332C849709498FF444E46578DCAD2536E6D0289E0125580F ] lltdsvc C:\Windows\System32\lltdsvc.dll
19:53:35.0250 0x10b0 lltdsvc - ok
19:53:35.0281 0x10b0 [ 4ACC60B4CBC911F3F34A1D66213BBBF5, C09A87ACAE0D41FD425BAF076FFE9B601DB89BB66199E5BD72FC59C6A8E449DB ] LMDriver C:\Windows\System32\drivers\LMDriver.sys
19:53:35.0281 0x10b0 LMDriver - ok
19:53:35.0297 0x10b0 [ D113FAD71A5E67AA94B32A0F8828D265, 08DDB4BBDB570C59926DBF5E27FCF46DCDF8B8212BB9251E97837E0504516FB3 ] lmhosts C:\Windows\System32\lmhsvc.dll
19:53:35.0328 0x10b0 lmhosts - ok
19:53:35.0359 0x10b0 [ 6A35B295812CE7064CFBCD9F254169CF, 561DD131FED6F90686D8C031B45B87B6D065C7E0C8804AEFCDE239725AAEE43E ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
19:53:35.0375 0x10b0 LMS - ok
19:53:35.0406 0x10b0 [ A462D3C78D92E24CFD06D6E82994CD15, C3BB5F657BFFCF51A0B5298A21AF6231464690E67B6FD2B5A68842C199EF46C6 ] LMSvc C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
19:53:35.0422 0x10b0 LMSvc - ok
19:53:35.0437 0x10b0 [ C755AE4635457AA2A11F79C0DF857ABC, E03D1ACAC155287291FE1BD0B653953ADC94279A74D0152088D698FAA796460F ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
19:53:35.0437 0x10b0 LSI_SAS - ok
19:53:35.0453 0x10b0 [ ADAC09CBE7A2040B7F68B5E5C9A75141, 7865DA7E91404F3642BC444B97F6B7AA42B9523D5EDD7F6365DA236B8EC3410F ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
19:53:35.0468 0x10b0 LSI_SAS2 - ok
19:53:35.0468 0x10b0 [ 04D1274BB9BBCCF12BD12374002AA191, 4B9618F8D25F2278DE1610A70ACAADB074D171D162C3AF27D464F5DC800A8E60 ] LSI_SAS3 C:\Windows\system32\drivers\lsi_sas3.sys
19:53:35.0484 0x10b0 LSI_SAS3 - ok
19:53:35.0484 0x10b0 [ 327469EEF3833D0C584B7E88A76AEC0C, 3D88B5A2D68F93F01B39C6E3D8D5C7A2A20686EFC756086E66AFFF1BC3019B85 ] LSI_SSS C:\Windows\system32\drivers\lsi_sss.sys
19:53:35.0484 0x10b0 LSI_SSS - ok
19:53:35.0531 0x10b0 [ 8EBB271E4588D835784A3FF7E80076A8, A508BE95F6F5063A76F4C8726D9425BB1F00DE803EFE73A0BE145DD9AB82FF0A ] LSM C:\Windows\System32\lsm.dll
19:53:35.0594 0x10b0 LSM - ok
19:53:35.0625 0x10b0 [ DDEE191AB32DFC22C6465002ECDF5EE4, 190C3930A8449118F9FEDF43C482837EF1C255E6D67F9651156E66A1E2BC6553 ] luafv C:\Windows\system32\drivers\luafv.sys
19:53:35.0656 0x10b0 luafv - ok
19:53:35.0656 0x10b0 McAfee SiteAdvisor Service - ok
19:53:35.0703 0x10b0 [ EB5C03A070F30D64A6DF80E53B22F53F, 12051B6AEBDEE1E28F24364F25A52BA3A6E282ECF86D6290E34BD38E6D4E066D ] megasas C:\Windows\system32\drivers\megasas.sys
19:53:35.0703 0x10b0 megasas - ok
19:53:35.0718 0x10b0 [ F6F13533196DE7A582D422B0241E4363, B3CD9B08937AFFF12141B38634AF3A56F5AC5FF3EF03941802B9841DEC559469 ] megasr C:\Windows\system32\drivers\megasr.sys
19:53:35.0734 0x10b0 megasr - ok
19:53:35.0781 0x10b0 [ 926C135CFB0C75B32FB714B5C0C58FAA, AF627CD125794B69D450D298D5608D357F2C91FB89EBFAA0DA2A0F07C6A304A8 ] MEIx64 C:\Windows\system32\DRIVERS\TeeDriverx64.sys
19:53:35.0797 0x10b0 MEIx64 - ok
19:53:35.0844 0x10b0 [ D9D93198D7479C8FC52375806CFDC1CF, 856806C154367F3E32B7FCC797719D37942A1249138DD8DA87B95BC757CB8A95 ] mfeapfk C:\Windows\system32\drivers\mfeapfk.sys
19:53:35.0859 0x10b0 mfeapfk - ok
19:53:35.0890 0x10b0 [ EBC37DF7D14D33056C46CCD233A3E9DF, 3FDE4214B888004ED8FF93DEBA80EABA738E66A592078032414E94F9F769D3DF ] mfeavfk C:\Windows\system32\drivers\mfeavfk.sys
19:53:35.0890 0x10b0 mfeavfk - ok
19:53:35.0922 0x10b0 [ 381EECD28C170978837DE41835647F07, DD385B4C6C1BB2B775ED39E7045EB000676BF2B29DD0BA3D31FE95969DC63DF4 ] mfeelamk C:\Windows\system32\drivers\mfeelamk.sys
19:53:35.0937 0x10b0 mfeelamk - ok
19:53:36.0000 0x10b0 [ 89A8491264921184753B472F96A68E2F, 4FC0ACF8023C6324789F6300B4646C23EDCDA6B6409B277DA3C7B000EC94C4D4 ] mfefire C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
19:53:36.0015 0x10b0 mfefire - ok
19:53:36.0062 0x10b0 [ 688FC9DB0D8319413F99C020D646A0BD, 52FB02DD79CB04F5559965B2EF4020FA65194163D3BB8289697A063B3A864360 ] mfefirek C:\Windows\system32\drivers\mfefirek.sys
19:53:36.0078 0x10b0 mfefirek - ok
19:53:36.0125 0x10b0 [ 205FF925AACA86BF19B1395D22463AF7, 1447338FEB4EBE18E4D2B37BC1A09723EC8DF52D28FEBB38B86552CDA06F303C ] mfehidk C:\Windows\system32\drivers\mfehidk.sys
19:53:36.0156 0x10b0 mfehidk - ok
19:53:36.0172 0x10b0 [ 5E03DF8154CCA4D5B236B8AFAF3ECE48, B35B786EE7476A189771CA741862D13C7BBF9233367396371413849FF48C7E23 ] mfevtp C:\Windows\system32\mfevtps.exe
19:53:36.0187 0x10b0 mfevtp - ok
19:53:36.0218 0x10b0 [ FD426ABB976F264C5741D724B0046B06, B03AEFB874C7C5EC80A18F9E6670C0F8C4F5AC0F94FF43BE956C9CD0DB03BF8F ] mfewfpk C:\Windows\system32\drivers\mfewfpk.sys
19:53:36.0218 0x10b0 mfewfpk - ok
19:53:36.0234 0x10b0 [ FD788C2D96EA91469A3C1D13E80D7473, 7B14D4BFDE18CECC19FBFFAA5AFF5FD78BFB7FCDA6613990740A8A7DD9873D26 ] MMCSS C:\Windows\system32\mmcss.dll
19:53:36.0281 0x10b0 MMCSS - ok
19:53:36.0281 0x10b0 [ 8B38C44F69259987C95135C9627E2378, E698B82D4EFFF56D66C7FC9866369BA5736FDBDBE2028CC421C51E70DEA74727 ] Modem C:\Windows\system32\drivers\modem.sys
19:53:36.0312 0x10b0 Modem - ok
19:53:36.0328 0x10b0 [ 601589000CC90F0DF8DA2CC254A3CCC9, D1238A386C41B6C368D9A44B7C112C943995B5403E2A5B4B7346B266DDB0C5A0 ] monitor C:\Windows\System32\drivers\monitor.sys
19:53:36.0344 0x10b0 monitor - ok
19:53:36.0359 0x10b0 [ CEAC6D40FE887CE8406C2393CF97DE06, 34E76908B802764FF0D7AB3AF89BE77BD35B44787983343FAD89891891C0A045 ] mouclass C:\Windows\System32\drivers\mouclass.sys
19:53:36.0375 0x10b0 mouclass - ok
19:53:36.0390 0x10b0 [ 02D98BF804084E9A0D69D1C69B02CCA9, EC5BC5D87043DFFD035FD4DD27B3D94E03119063519E4151BCC3522B613E2D7F ] mouhid C:\Windows\System32\drivers\mouhid.sys
19:53:36.0406 0x10b0 mouhid - ok
19:53:36.0422 0x10b0 [ 515549560D481138E6E21AF7C6998E56, C7E4B38D8CCAF15B9BDA63C8C8209F6193AD220DA02E1264F1B687AACD8F409F ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
19:53:36.0437 0x10b0 mountmgr - ok
19:53:36.0468 0x10b0 [ D1CB0BC1CBA61639FE7162C5476A22C0, 80469683BD18CE0B6E9D9BD3613A63896F3D50A783EFDC15CEA28560C151C6B9 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
19:53:36.0468 0x10b0 MozillaMaintenance - ok
19:53:36.0484 0x10b0 [ F170510BE94CF45E3C6274578F6204B2, 344C3DDE1D622607CA2ABECB2C47CB0166D2D258BD94A7960C45A5ADBB640566 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
19:53:36.0500 0x10b0 mpsdrv - ok
19:53:36.0562 0x10b0 [ D186C5844393252147BE934F3871DB7A, 30160F8268B9F46E82C5CB536867E0CF280DC98074A481595072E3320200E343 ] MpsSvc C:\Windows\system32\mpssvc.dll
19:53:36.0625 0x10b0 MpsSvc - ok
19:53:36.0687 0x10b0 [ 1D55DADC22D21883A2F80297F5A5AE48, B79DF4AFC2A9CBC54E74233596544D6E41C8CAA0516BD57CA695D051EC780265 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
19:53:36.0734 0x10b0 MRxDAV - ok
19:53:36.0797 0x10b0 [ 7A1A3F213CDB3363D179D5014272025D, 6756F5B7D9FBF6839DB1FF4E94EA45B5499D7DF925E75581C96FBBA4BE131542 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
19:53:36.0876 0x10b0 mrxsmb - ok
19:53:36.0908 0x10b0 [ 3E28B99198B514DFEB152EACF913025E, 6C1D8353DCD5F811F39C0C3CB5DF3D2457F0D17EE80FB06196AA169E3D19E9B2 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:53:36.0939 0x10b0 mrxsmb10 - ok
19:53:36.0970 0x10b0 [ C910E5D18958914A66F0E45689D0B40A, AD7C91DD8A60A511E580DD56BACC97F85075A539E7C5D95040A8F870A621DAF4 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:53:37.0001 0x10b0 mrxsmb20 - ok
19:53:37.0033 0x10b0 [ E0927EFA25D473367C3341B9F5969779, B77A162BD3334557623674373D8EC2BE7CC0B359DF06304E467ABFFEE0530271 ] MsBridge C:\Windows\system32\DRIVERS\bridge.sys
19:53:37.0064 0x10b0 MsBridge - ok
19:53:37.0095 0x10b0 [ A082C17D14D0790E27D064EA4B138AE1, 9A565ED885782D9D5135C8399C11C356DBF9EBF3B8EB4B4504BD2604AD0B45E6 ] MSDTC C:\Windows\System32\msdtc.exe
19:53:37.0111 0x10b0 MSDTC - ok
19:53:37.0126 0x10b0 [ D13329FBF8345B28AB30F44CC247DC08, 9C7EC2D4D65E6510EB5B9E61BB0D14F725D7E8FE98D65161C3971E43EF1AB6EB ] Msfs C:\Windows\system32\drivers\Msfs.sys
19:53:37.0142 0x10b0 Msfs - ok
19:53:37.0158 0x10b0 [ C6B474E46F9E543B875981ED3FFE6ADD, E16687E52FB649C23D92159A1F036CB662202C1E58D961EECDAA528AA4FA669A ] msgpiowin32 C:\Windows\System32\drivers\msgpiowin32.sys
19:53:37.0173 0x10b0 msgpiowin32 - ok
19:53:37.0173 0x10b0 [ 65C92EB9D08DB5C69F28C7FFD4E84E31, D709BA4723225321F665B1157A33A4AE230420752308EF535DA9A41CAC164628 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
19:53:37.0189 0x10b0 mshidkmdf - ok
19:53:37.0189 0x10b0 [ 52299F086AC2DAFD100DD5DC4A8614BA, B36BE0FC96798E5EB8C193C318970E3906961E3ABC3BFAAD73138C76D9A95B0B ] mshidumdf C:\Windows\System32\drivers\mshidumdf.sys
19:53:37.0220 0x10b0 mshidumdf - ok
19:53:37.0236 0x10b0 [ 36D92AF3343C3A3E57FEF11C449AEA4C, ECC85AA1E530DF55B4A4545798219F87F0FCA66DDD2E37BCEF0850D3C9129DD2 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
19:53:37.0251 0x10b0 msisadrv - ok
19:53:37.0267 0x10b0 [ 810F8A0A0680662BB0CE44D0E2CEF90C, 5631B07911B7EF378CB1583A480A3C5715E59A5488B33A528F4D7A2F849B9113 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
19:53:37.0283 0x10b0 MSiSCSI - ok
19:53:37.0283 0x10b0 msiserver - ok
19:53:37.0298 0x10b0 [ A9BBBD2BAE6142253B9195E949AC2E8D, 599D2952D4E0B0B3E02D91E38A30F4900B1ADA330716B887B156A1CB9A3E6EE9 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
19:53:37.0314 0x10b0 MSKSSRV - ok
19:53:37.0329 0x10b0 [ 375E44168F2DFB91A68B8A3F619C5A7C, AC243E02E9A39D0B4DE9571F196941700EE6EB5E94F5B0BA8994FB551E73A7A8 ] MsLldp C:\Windows\system32\DRIVERS\mslldp.sys
19:53:37.0361 0x10b0 MsLldp - ok
19:53:37.0361 0x10b0 [ 7B2128EB875DCBC006E6A913211006D6, 97BBD7FF770741FBFC0F181A609AD0954EA926DA203B742E8F08C89AD8FE476E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
19:53:37.0376 0x10b0 MSPCLOCK - ok
19:53:37.0376 0x10b0 [ 1E88171579B218115C7A772F8DE04BD8, B9EAA835D0BF8F9C4DF8403D95EF1400E8AE38F28F9DBA87657DE2129FEF02D2 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
19:53:37.0392 0x10b0 MSPQM - ok
19:53:37.0423 0x10b0 [ BBE2A455053E63BECBF42C2F9B21FAE0, 7C5DF563499DF59DF9895A1581E47ADF5FD54C94ECEF6C886CDB60E5E95A6DAE ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
19:53:37.0439 0x10b0 MsRPC - ok
19:53:37.0439 0x10b0 [ 8D6B7D515C5CBCDB75B928A0B73C3C5E, 1EB4DC3DD21D2627C78EC3F9931D9E5D033169087E43B5D7C17BF1FF2A0028CD ] mssmbios C:\Windows\System32\drivers\mssmbios.sys
19:53:37.0454 0x10b0 mssmbios - ok
19:53:37.0454 0x10b0 [ 115019AE01E0EB9C048530D2928AB4A2, 6E2275E85EACF2D0FC784792E0D72A165589D33CBAB3BCFA8E271CA09566C925 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
19:53:37.0470 0x10b0 MSTEE - ok
19:53:37.0486 0x10b0 [ 96D604A35070360F0DD4A7A8AF410B5E, F94DD1A3566C7C8D0A76D6E1E2530552A9B7F99C5DA0DE11829325EAB9F8B7ED ] MTConfig C:\Windows\System32\drivers\MTConfig.sys
19:53:37.0486 0x10b0 MTConfig - ok
19:53:37.0517 0x10b0 [ 619CA29326B82372621DB2C0964D8365, 4091F08E266DB45A6E33A4A8B1CE9FA78BB294B3111526AA9E3868620F30AFDF ] Mup C:\Windows\system32\Drivers\mup.sys
19:53:37.0517 0x10b0 Mup - ok
19:53:37.0517 0x10b0 [ B8C35C94DCB2DFEAF03BB42131F2F77F, F0FCF367CA8F722D6ABCF7F363CD406D890D71452E91C3FC6677B47AD74D6324 ] mvumis C:\Windows\system32\drivers\mvumis.sys
19:53:37.0533 0x10b0 mvumis - ok
19:53:37.0564 0x10b0 [ 41A45D2A75494EABF2806EA051E00376, EB2497561C8E33A4297C044604C717FF854C7F046882A9E4A400AE7679BF5467 ] napagent C:\Windows\system32\qagentRT.dll
19:53:37.0579 0x10b0 napagent - ok
19:53:37.0626 0x10b0 [ 26ACA481FAFEC59FE311D719E3027BBA, 16A24CCA95A38BDFE970580159F6ACAA13FF1B74CF2290B1B020D909F90D3347 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
19:53:37.0689 0x10b0 NativeWifiP - ok
19:53:37.0720 0x10b0 [ 71E3C0100AA19D11373CCEB2F51A6008, 58FBF35F5FE19BEABE483C11E9996BE93D76721C8C34465350FA98B465CA3672 ] NcaSvc C:\Windows\System32\ncasvc.dll
19:53:37.0751 0x10b0 NcaSvc - ok
19:53:37.0767 0x10b0 [ 51DF09CAB2CAC64FEE3E371D9028ED01, 9B81604D0D0359AF8F54FED6DA7116FFD2F40407895028EAD99FF1D7CFDC2D14 ] NcbService C:\Windows\System32\ncbservice.dll
19:53:37.0814 0x10b0 NcbService - ok
19:53:37.0829 0x10b0 [ 2586C4C167499210DCBF3ECFD8CCE210, D8129FEDE9918BF4FB0057CC58700D4E08457060E810B9CC25CA0F598506ADB8 ] NcdAutoSetup C:\Windows\System32\NcdAutoSetup.dll
19:53:37.0892 0x10b0 NcdAutoSetup - ok
19:53:37.0954 0x10b0 [ E4B4BE2D7750849C07589DA0B0AABA01, BB5AA727BA018A94B5DE2C4E0B594DD2E7A2B3457885446EE568F3A1E18AB3B0 ] NDIS C:\Windows\system32\drivers\ndis.sys
19:53:38.0001 0x10b0 NDIS - ok
19:53:38.0033 0x10b0 [ C6BB12BC35D1637CA17AE16D3A4725EB, 01C1D9FA738886A195166F88207EEB6715A1DE0608978ED6C5DC738AF5C02513 ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
19:53:38.0064 0x10b0 NdisCap - ok
19:53:38.0079 0x10b0 [ B1AA3B19A2E596A59224F893E01A5A75, E08696CA5E087E51AC3E64D4FB8490EEADD612DDF30C9A94DD1BD1BA124B71B7 ] NdisImPlatform C:\Windows\system32\DRIVERS\NdisImPlatform.sys
19:53:38.0111 0x10b0 NdisImPlatform - ok
19:53:38.0111 0x10b0 [ 9423421E735BD5394351E0C47C76BB92, 763E5D06F896C0EF8AD52515464F28BA85DB7A1560E451857AC9AA68FAFCBC66 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
19:53:38.0142 0x10b0 NdisTapi - ok
19:53:38.0142 0x10b0 [ B832B35055BA2B7B4181861FF94D8E59, 2E60E5D503E88D27E35ECFEE265D51328E93A9C7B9B931F86D9CBC947636BB00 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
19:53:38.0173 0x10b0 Ndisuio - ok
19:53:38.0189 0x10b0 [ 1F58E48EF75F34C35D8E93A0DC535CFE, D65619A6C4B1747F8B05DA08A44EF0E46B5CC384880E04E4755A2BA6CDB3C4EA ] NdisVirtualBus C:\Windows\System32\drivers\NdisVirtualBus.sys
19:53:38.0204 0x10b0 NdisVirtualBus - ok
19:53:38.0220 0x10b0 [ DEC29080202D4F9F17F55E18BCFCC41A, F7E543741B1F4F637A99C40543D6AEC6EBF893F74359BBA769D1F882E0AFB571 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
19:53:38.0236 0x10b0 NdisWan - ok
19:53:38.0236 0x10b0 [ DEC29080202D4F9F17F55E18BCFCC41A, F7E543741B1F4F637A99C40543D6AEC6EBF893F74359BBA769D1F882E0AFB571 ] NdisWanLegacy C:\Windows\system32\DRIVERS\ndiswan.sys
19:53:38.0251 0x10b0 NdisWanLegacy - ok
19:53:38.0251 0x10b0 [ A5BD69A8812FA79D1A487691DD3FB244, 67B5EDE101943E0E8B8041DB2353D20C8B9F2D253E77964761CFE8F136C0BBC7 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
19:53:38.0267 0x10b0 NDProxy - ok
19:53:38.0298 0x10b0 [ 5A072F0B90C29C5233D78BE33EF5ED78, B32ED76A674B1FC743361FB7BBD4C915A78B14132AB056AADD445D5995AD4F32 ] Ndu C:\Windows\system32\drivers\Ndu.sys
19:53:38.0314 0x10b0 Ndu - ok
19:53:38.0329 0x10b0 [ A83D67D347A684F10B7D3019C8A6380C, 2B86832967981C8C786BF24C1CF8E13E01745ACE3333CF5C821DD93D623B96E4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
19:53:38.0329 0x10b0 NetBIOS - ok
19:53:38.0345 0x10b0 [ 0217532E19A748F0E5D569307363D5FD, C40C2E7AFA276057E7327A7BB173122689D6CEC9AE443C3850C3F94AF03DFBF5 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
19:53:38.0392 0x10b0 NetBT - ok
19:53:38.0392 0x10b0 [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] Netlogon C:\Windows\system32\lsass.exe
19:53:38.0408 0x10b0 Netlogon - ok
19:53:38.0439 0x10b0 [ B7AD851A21FEBA3BA214972627614207, 29605320CCC3DAAD062CAECF0009DACBC2F6D28ED4E8AF7CE76132129F5572A0 ] Netman C:\Windows\System32\netman.dll
19:53:38.0454 0x10b0 Netman - ok
19:53:38.0470 0x10b0 [ F0F0A372C2EF6358399C4936F91B6131, CE596C71EB4D1A5E104D3148F2D0D8789882C59FD198DCF33CCAC7A08B50E4EE ] netprofm C:\Windows\System32\netprofmsvc.dll
19:53:38.0517 0x10b0 netprofm - ok
19:53:38.0548 0x10b0 [ 1092B3190E69E0C5ECBCE90F171DE047, C16106EEFC324EE80E5F659CB71A5DD69FA800D36D829F5B0E6AD3393BD1BAF7 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:53:38.0564 0x10b0 NetTcpPortSharing - ok
19:53:38.0611 0x10b0 [ 70414DB660BFBB7BD58FCE8EA4364E1B, 6DFB3897CD55E22BA1EDF0AE672F4D7A6A1F512F8A0A26AF106765E6B1CF65AC ] netvsc C:\Windows\system32\DRIVERS\netvsc63.sys
19:53:38.0626 0x10b0 netvsc - ok
19:53:38.0658 0x10b0 [ 3A280F3B3C7A46E29C404ACD46ECBF5E, 81C3367A2A212DBCC65B8A0166FD092E3205AB31A146B4B737061335CEC51F9D ] NlaSvc C:\Windows\System32\nlasvc.dll
19:53:38.0689 0x10b0 NlaSvc - ok
19:53:38.0704 0x10b0 [ 8F44A2F57C9F1A19AC9C6288C10FB351, 310274DDBAC0FE4BE54ECD3B90C97D82A0F9F5CFCA7A35711A36164DE4B94074 ] Npfs C:\Windows\system32\drivers\Npfs.sys
19:53:38.0720 0x10b0 Npfs - ok
19:53:38.0736 0x10b0 [ CBDB4F0871C88DF930FC0E8588CA67FC, 7E4AA3EA81A9D532F236FD7896744F07ED07CA9B37A9F18A9778BCCCC67490F2 ] npsvctrig C:\Windows\System32\drivers\npsvctrig.sys
19:53:38.0767 0x10b0 npsvctrig - ok
19:53:38.0783 0x10b0 [ 6E2271ED0C3E95B8E29F3752B91B9E84, 44026AD9757EA82967D7F7578455802FAD7FE0057EAC088E0AE207C15F594B86 ] nsi C:\Windows\system32\nsisvc.dll
19:53:38.0814 0x10b0 nsi - ok
19:53:38.0829 0x10b0 [ E490B459978CB87779E84C761D22B827, 1E5CA38626E41618E4CA16DD0C70EB2FA86E986F0CF21A749BDE2A17015DEEC6 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
19:53:38.0845 0x10b0 nsiproxy - ok
19:53:38.0908 0x10b0 [ 038C77D577900EE39410662478BB0D50, A33AAFD5750245C17A47EC71F3C6EAD2E0925CAD34C65AB3E6CEE44756C668E6 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
19:53:38.0986 0x10b0 Ntfs - ok
19:53:38.0986 0x10b0 [ EF1B290FC9F0E47CC0B537292BEE5904, DBC07BBC54EBC2D2E576B23A4CE116B3DA988577AD0D96CB7289A6748A60F9EA ] Null C:\Windows\system32\drivers\Null.sys
19:53:39.0001 0x10b0 Null - ok
19:53:39.0298 0x10b0 [ A6ED9DACE68E83B6F79FEC5799799FB6, 9CB41236E73B8435364B3133A7EF1A286E5E92C4832ADC4B54F86BB13C6B44A9 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:53:39.0673 0x10b0 nvlddmkm - ok
19:53:39.0736 0x10b0 [ BC6B5942AFF25EBAF62DE43C3807EDF8, CB0FA194084B8C309039D571B5760FDA800E9531B8660C499B4F9977BA5C36D5 ] nvraid C:\Windows\system32\drivers\nvraid.sys
19:53:39.0751 0x10b0 nvraid - ok
19:53:39.0751 0x10b0 [ 1F43ABFFAC3D6CA356851D517392966E, 6FD7621F67BA94B0E1D8F43BEC2951DBCDEEA1E848BB265AC169E27C01DA68F2 ] nvstor C:\Windows\system32\drivers\nvstor.sys
19:53:39.0767 0x10b0 nvstor - ok
19:53:39.0814 0x10b0 [ 9D67B25C69B684139169C18C9F1DFDE1, 90A4F1920EB3F071BD32BA70F998E2040BAC2ABD1B22BDF43E71455B88DAEA4D ] nvsvc C:\Windows\system32\nvvsvc.exe
19:53:39.0861 0x10b0 nvsvc - ok
19:53:39.0923 0x10b0 [ 87FCD47E1C99D3E5E2807912AA17236A, AB9CD34A9FD52D71B4E862CE909F27B34348732DD2F3A9B13BFF9452F1AE12AF ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
19:53:39.0970 0x10b0 nvUpdatusService - ok
19:53:40.0017 0x10b0 [ 6934A936A7369DFE37B7DBA93F5E5E49, 0900FEEB0CE8D09F0FC60630B5B986034A8BCD3882ED66E47170810C32492892 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
19:53:40.0033 0x10b0 nv_agp - ok
19:53:40.0064 0x10b0 [ E287F157F7A0011D93179C64EF8ADCF2, C16FB92C7B18D634BB1344238D35B3111494C243FBD5853F05376F5051480D83 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
19:53:40.0111 0x10b0 p2pimsvc - ok
19:53:40.0158 0x10b0 [ 2A57A937BC5B1B2D6AFE6A8C5925F50B, 00D84EFED5A7129AAD86945940030474795905C32D65CBD5B1A3EBADCED8F873 ] p2psvc C:\Windows\system32\p2psvc.dll
19:53:40.0189 0x10b0 p2psvc - ok
19:53:40.0220 0x10b0 [ 764B1121867B2D9B31C491668AC72B2B, 32C04B6FCE1DDD09697B81473A23BDCED8BEEFBCD0D2D58DDC9A11A33C756967 ] Parport C:\Windows\System32\drivers\parport.sys
19:53:40.0251 0x10b0 Parport - ok
19:53:40.0267 0x10b0 [ EF0C1749C9A8CEE9A457473D433CC00F, A5FDAB5AD47471640D697C6CFBA6C67730878ABBA47D394EAA47C9733EDCE1F3 ] partmgr C:\Windows\system32\drivers\partmgr.sys
19:53:40.0298 0x10b0 partmgr - ok
19:53:40.0329 0x10b0 [ 9A5309EF92F39346CFD5A4C2C3D1BFAD, 5908E0C9562F9CB24784491BD9AE7983A33A6BDF81AFA0A08045518A0C9BB2B1 ] PcaSvc C:\Windows\System32\pcasvc.dll
19:53:40.0392 0x10b0 PcaSvc - ok
19:53:40.0423 0x10b0 [ 91ED124E261EA8FAA1C0FFDF2A71B0C4, 20E41A38067395D03184938983A9BE459717A1941352972DBC28D83D542319EC ] pci C:\Windows\system32\drivers\pci.sys
19:53:40.0439 0x10b0 pci - ok
19:53:40.0454 0x10b0 [ 346E38FCC6859A727DD28AFAD1F0AFF4, FF3DA26F79B3BC3A5B8A8AA0B9139B9EF70297F4EA1203B1E68FB5A212C3AA58 ] pciide C:\Windows\system32\drivers\pciide.sys
19:53:40.0470 0x10b0 pciide - ok
19:53:40.0501 0x10b0 [ 4D3BDCC1C7B40C9D7B6AD990E6DEC397, 27A7AF2127B699F4579CB77936F38DC102211E26E5E2947DB808756FE06FC98E ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
19:53:40.0517 0x10b0 pcmcia - ok
19:53:40.0517 0x10b0 [ BF28771D1436C88BE1D297D3098B0F7D, 5F7630916A76A8CF31289E9C577F522B999C74C39E541CD40E62BD53004BEF74 ] pcw C:\Windows\system32\drivers\pcw.sys
19:53:40.0533 0x10b0 pcw - ok
19:53:40.0564 0x10b0 [ B9D968D8E2B0F9C6301CEB39CFC9B9E4, 83F32831B0727F18B56DC3CAF37E45A3523D2BBCD54D1421F0DE5A0179D8A404 ] pdc C:\Windows\system32\drivers\pdc.sys
19:53:40.0564 0x10b0 pdc - ok
19:53:40.0673 0x10b0 [ 8F98C4BC605261B4B6E568FE791EB67A, 7B0D99D972A60423F7378BEE886061695FDA79B59AFF939744A130721E0174A1 ] PDF Architect 2 C:\Program Files (x86)\PDF Architect 2\ws.exe
19:53:40.0751 0x10b0 PDF Architect 2 - ok
19:53:40.0783 0x10b0 [ B2309F132A31AF03C0A249AEDE8CF289, BBAE32AA55E495ACB9A8089C090ADD78BE1DC16233CAA61BBED1456CA718D430 ] PDF Architect 2 Creator C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
19:53:40.0829 0x10b0 PDF Architect 2 Creator - ok
19:53:40.0876 0x10b0 [ 9077A3059AB47834633AEAAED465F3D9, 9CA662E9CBA30795E4E5DAB3E309D2062FFDC2053C261054E24EF7EE5300F69F ] pdfforge CrashHandler C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe
19:53:40.0908 0x10b0 pdfforge CrashHandler - ok
19:53:40.0954 0x10b0 [ 0ECEE590F2E2EF969FB74A6FC583A1E6, 1C611D9225C863CF32125F684B324C58BDE1942F4F283F5674133200AC505D44 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
19:53:41.0001 0x10b0 PEAUTH - ok
19:53:41.0095 0x10b0 [ 8E3C640FFF5A963F570233AE99C0FFF3, 3DE978B005BF2E88BA858CE37D9E27BD3584642B8412E22C300A1E739743838A ] PerfHost C:\Windows\SysWow64\perfhost.exe
19:53:41.0126 0x10b0 PerfHost - ok
19:53:41.0220 0x10b0 [ 928061178CD9856CA6B67FFFCE6BA766, 71DE3C7CA7F83EAAA550CD8A68FB67DE042B0AE51BFACB1ECB8852D502E11F50 ] pla C:\Windows\system32\pla.dll
19:53:41.0283 0x10b0 pla - ok
19:53:41.0314 0x10b0 [ BC6849C62DB407573C6AD8CB1A4D2628, 5BDE0D60F85E4C27CEAD1B301155B54D841FB773BD5BB8AC5DDAEE31F8E94627 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
19:53:41.0329 0x10b0 PlugPlay - ok
19:53:41.0329 0x10b0 [ 045EB4F260606A03BE340D09DEAF3BA4, 6F34B8D414F7F69F4388F2F8A86E0F3AD179E423126990AF3E1EC4DCCB8E7693 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
19:53:41.0361 0x10b0 PNRPAutoReg - ok
19:53:41.0376 0x10b0 [ E287F157F7A0011D93179C64EF8ADCF2, C16FB92C7B18D634BB1344238D35B3111494C243FBD5853F05376F5051480D83 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
19:53:41.0392 0x10b0 PNRPsvc - ok
19:53:41.0423 0x10b0 [ C16097D77A232A288D65F299E2E01105, 5CE4B44B06FD26569C0F92FF1D3991D0128D8444AE7BC9EBEF5A33811D721BE8 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
19:53:41.0454 0x10b0 PolicyAgent - ok
19:53:41.0486 0x10b0 [ 00E08B30E7F7C13ECE2CDF4F46A77311, 1807C0A64C1794E572C86730816C01DCF4D8F773ADE9CAEA3AC0658F7BD71A4E ] Power C:\Windows\system32\umpo.dll
19:53:41.0501 0x10b0 Power - ok
19:53:41.0626 0x10b0 [ 3C96A45CA3403A276B0F045C448EC27B, C0011DB8C5A85817CAF815CC0095EE2C1CDD5964DCD8EAF4C35A2495D6A873CC ] PrintNotify C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll
19:53:41.0923 0x10b0 PrintNotify - ok
19:53:41.0955 0x10b0 [ ECD373F9571C745894367CC2635EA44F, E08B2A1017DAE1BF10B986DAFAD14BDE20D79703E0EF3A8C700A3753908C1392 ] Processor C:\Windows\System32\drivers\processr.sys
19:53:42.0001 0x10b0 Processor - ok
19:53:42.0033 0x10b0 [ EF1F8B57323E5D3FC6A0A25F98F90DBC, F50E81151604DCD59BB647FD6767C1631AE48B5FCA6D3423C4E32535C94D6369 ] ProfSvc C:\Windows\system32\profsvc.dll
19:53:42.0095 0x10b0 ProfSvc - ok
19:53:42.0111 0x10b0 [ 8528BB05E4D4E25945F78B00B2555FB7, FF8E0D4580F93CD348080967F52FE6C2C68B56DAEACAE2EAEF04E19412A953AE ] Psched C:\Windows\system32\DRIVERS\pacer.sys
19:53:42.0142 0x10b0 Psched - ok
19:53:42.0236 0x10b0 [ C99D94151EDA07D418E14158E3C54A87, 9831EAE1E7851727810FCFA5AA66B80D6CD0B5072C04A7D1091DBE24F3AC638D ] QASvc C:\Program Files\Acer\Acer Quick Access\QASvc.exe
19:53:42.0345 0x10b0 QASvc - ok
19:53:42.0392 0x10b0 [ AF90BB44C99D6820BE52C9BBAA523283, 9772D9CC1666959EC8EE4ED740A5179473CE4F38762109F1123DD68010D20EA1 ] QWAVE C:\Windows\system32\qwave.dll
19:53:42.0439 0x10b0 QWAVE - ok
19:53:42.0454 0x10b0 [ 3FB466684609A4329858CF2EBD62E0FD, CFC8FBAB1436948F9D34CE6A2D6DE2F86F3E93E50B86851CED979C8CCE609798 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
19:53:42.0470 0x10b0 QWAVEdrv - ok
19:53:42.0470 0x10b0 [ 6A52182919E25FB56D253D389F92CE98, AE6497D5CF324CB813248ADECB0F53E5CB3D6C326774E2257319E4CE7782C591 ] RadioShim C:\Windows\System32\drivers\RadioShim.sys
19:53:42.0486 0x10b0 RadioShim - ok
19:53:42.0486 0x10b0 [ 2C56F0EE27E4EF70CA4B4983D3638905, AFFDD686886CE982424B644D9168D61C6F86A5244FF97BC644DF75B321E415E5 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
19:53:42.0501 0x10b0 RasAcd - ok
19:53:42.0517 0x10b0 [ 5F061AC45266841A2860C1858ED863B8, 9E0D52BAC8A50225C32D0397C35350601B996443E2481C808CC59D3B0763FEF0 ] RasAuto C:\Windows\System32\rasauto.dll
19:53:42.0533 0x10b0 RasAuto - ok
19:53:42.0579 0x10b0 [ 5C7B86EE33505E36026AFAAB62DA6364, 903BB1A355AC746BF09C2A7C87B068168648DB79DEF39AB1DC710B6A7A5F6556 ] RasMan C:\Windows\System32\rasmans.dll
19:53:42.0642 0x10b0 RasMan - ok
19:53:42.0642 0x10b0 [ 5247F308C4103CDC4FE12AE1D235800A, E567CD33CA1897D53795E071B7AFBAF98B2C8F725F8BED0BA90F5EF611520E48 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
19:53:42.0673 0x10b0 RasPppoe - ok
19:53:42.0704 0x10b0 [ A1A5E79C0D1352AFDC08328A623DA051, 01546DDE6F1FF159A7EB7F2BF104910445D3D863F1F37DEA695579BA60D84280 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
19:53:42.0736 0x10b0 rdbss - ok
19:53:42.0767 0x10b0 [ 6B21EBF892CD8CACB71669B35AB5DE32, 0AD8E14FEF16FB2559F5FC8AFBC9D49E4E24F43CF65F480DBF9FAB593269B419 ] rdpbus C:\Windows\System32\drivers\rdpbus.sys
19:53:42.0798 0x10b0 rdpbus - ok
19:53:42.0814 0x10b0 [ 680C1DAE268B6FB67FA21B389A8B79EF, 856911F77BDD8830C3D683EBE8AF399FB3A54C7D8D0B34EA37D903377F0A39BD ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
19:53:42.0829 0x10b0 RDPDR - ok
19:53:42.0845 0x10b0 [ 9F08A6608F98B5407E7DDBCF306573EF, 92812F97CFDB2EC128BC48143DE215B7D012B15D3FB4D2199222AD8C31DA5016 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
19:53:42.0861 0x10b0 RdpVideoMiniport - ok
19:53:42.0892 0x10b0 [ A26AEC49F318FEE141DDDB2C5F99B3E6, 246AD79FF27E79DEDCB0AAA7C22A8EA6349DEDAC863413A1E378E68FD94C9C4F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
19:53:42.0908 0x10b0 rdyboost - ok
19:53:42.0939 0x10b0 [ E515A287C8FAE901EB8FB42F168E14F2, 9AE8D608587713FD18BB728BADD402C86FFF06A67359B22ED9431705522BC310 ] ReFS C:\Windows\system32\drivers\ReFS.sys
19:53:42.0970 0x10b0 ReFS - ok
19:53:43.0001 0x10b0 [ BFFB40FBE6D2C3469F8D06EE5E4934AB, 5B6763F973A740DCD53CEA75156926457BED8B075965033C484877DDA8B97F39 ] RemoteAccess C:\Windows\System32\mprdim.dll
19:53:43.0033 0x10b0 RemoteAccess - ok
19:53:43.0064 0x10b0 [ 4DCCABE03D06955ED61BABBD8EF9F30F, 531CD60315AAF283B73E0F6CF77D4DE093B809E73C44D2AC43B7247500B3485E ] RemoteRegistry C:\Windows\system32\regsvc.dll
19:53:43.0095 0x10b0 RemoteRegistry - ok
19:53:43.0126 0x10b0 [ 0527EF6E23B9FAB37DDCBC479C6CFA28, C004CE600074AC434F8B24A3383F8C0ACFA5476D9E3B1493B40911C78B028D64 ] RFCOMM C:\Windows\System32\drivers\rfcomm.sys
19:53:43.0142 0x10b0 RFCOMM - ok
19:53:43.0189 0x10b0 [ F3C0FACA2664136D9E101212BF31BA79, 6EBA80BF4ED57A5285AE00B672D8587462EB22F172ECF21627AEE05B7D47515D ] RMSvc C:\Program Files\Acer\Acer Quick Access\RMSvc.exe
19:53:43.0189 0x10b0 RMSvc - ok
19:53:43.0220 0x10b0 [ D894CBD7DA753C881EE8D5E33B583225, DA4472A85F10A3DF8CE969F731E67FE7C75EE6095908AB8AC2C44851DC5A3F8B ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
19:53:43.0236 0x10b0 RpcEptMapper - ok
19:53:43.0251 0x10b0 [ 5CAE8F47B31D5CFC322B5B898C19E0FE, FDB5F0B6EA36403E031D9147AB0519011FAAD3AC8190DE5B1F17FB5472D79D47 ] RpcLocator C:\Windows\system32\locator.exe
19:53:43.0267 0x10b0 RpcLocator - ok
19:53:43.0298 0x10b0 [ 81979817943D830BF24571B7C1B28A1A, 9584D8F1FB3E6CF17BD465670B208C723A8E8B06775A3DA44F75D7710404EEA6 ] RpcSs C:\Windows\system32\rpcss.dll
19:53:43.0329 0x10b0 RpcSs - ok
19:53:43.0361 0x10b0 [ F95482385625D1C89576D0E0E22A2229, 9ED3FEF8A73C768CCDB01822384B3A6CB371BF8EADDD4C05057B3BFDEE90595F ] RSPCIESTOR C:\Windows\system32\DRIVERS\RtsPStor.sys
19:53:43.0376 0x10b0 RSPCIESTOR - ok
19:53:43.0392 0x10b0 [ 2D05A5508F4685412F2B89E8C2189ABC, 82F12B4E0E73411A121EFD35FBD3B44CBBC0AE96ACFBB45D8C3C3777E2EA320D ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
19:53:43.0470 0x10b0 rspndr - ok
19:53:43.0486 0x10b0 [ 1A063730F221B2746FF00457AE17E4F0, 39A3C258CBFE3BC566C63528C9020A3BC9409736AE5289C08A7BA471D8409263 ] s3cap C:\Windows\System32\drivers\vms3cap.sys
19:53:43.0517 0x10b0 s3cap - ok
19:53:43.0548 0x10b0 [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] SamSs C:\Windows\system32\lsass.exe
19:53:43.0564 0x10b0 SamSs - ok
19:53:43.0595 0x10b0 [ C624A1B32211C3166EDB3F4AB02A30B7, 6B2A4607DB52D74242787ED9DF9067058983D310431D8612D2B0236E6201E681 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
19:53:43.0595 0x10b0 sbp2port - ok
19:53:43.0626 0x10b0 [ 47C497FA4DDEA908633CAA60CEBE6805, 4DF5742D4C99D3F7B6A5671AEDB1E5E47D3399D36B28BA19C105FA604D8D5A1C ] SCardSvr C:\Windows\System32\SCardSvr.dll
19:53:43.0626 0x10b0 SCardSvr - ok
19:53:43.0658 0x10b0 [ E76C4E98302AE39CC6FA5D20FC8B5438, B6B6B59CF427515087689285797F4A5763103440EBE5D87A61FA74F80F895BD0 ] ScDeviceEnum C:\Windows\System32\ScDeviceEnum.dll
19:53:43.0673 0x10b0 ScDeviceEnum - ok
19:53:43.0689 0x10b0 [ ABD0237B15DBD2B4695F4B7D734A58F7, D6831921F0CD3E03CBF1CA3ED5824EE0C75127842D12D4E897E74EC72B0792EB ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
19:53:43.0689 0x10b0 scfilter - ok
19:53:43.0767 0x10b0 [ D3AE5DB16EAF913860EC28654CE00E6B, AD76B6044F7247C6E86F6DCB7CFD6B25BCA2B9F09A97A419F043A999E66726A2 ] Schedule C:\Windows\system32\schedsvc.dll
19:53:43.0876 0x10b0 Schedule - ok
19:53:43.0908 0x10b0 [ AB285CE3431FF3D2ACE669245874C1C7, 6AF4C3E86EFA51F7FB6F8492CB2CCB807C7775EAE0508B87F07134FDAC679BD7 ] SCPolicySvc C:\Windows\System32\certprop.dll
19:53:43.0923 0x10b0 SCPolicySvc - ok
19:53:44.0001 0x10b0 [ FDEC5799BA499D18AFA3A540538866E7, 551EE0945FE4EC213FFF623E524500B57531EFEA2D76FA7ED1D2D605E7E2168F ] sdbus C:\Windows\System32\drivers\sdbus.sys
19:53:44.0017 0x10b0 sdbus - ok
19:53:44.0033 0x10b0 [ 0B1E929D11A8E358106955603FAC65E8, A5EC91BFC0873EC6AB1D0DB4E91654BD35339BD680E7E82DA2DC64996B4AE515 ] sdstor C:\Windows\System32\drivers\sdstor.sys
19:53:44.0048 0x10b0 sdstor - ok
19:53:44.0080 0x10b0 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
19:53:44.0095 0x10b0 secdrv - ok
19:53:44.0111 0x10b0 [ C49009F897BA4F2F4F31043663AA1485, 48C8BE1E3A4F150662AD012AF4E0357ABA792AD1147AB90EFF6CB2630E2501B6 ] seclogon C:\Windows\system32\seclogon.dll
19:53:44.0142 0x10b0 seclogon - ok
19:53:44.0158 0x10b0 [ A88882E64BDC1D8E8D6E727B71CCCC53, 12D2235F54D0CEEED8AA268C17CDE44020269F4FEFC70CE957DBBF99AF7F553D ] SENS C:\Windows\System32\sens.dll
19:53:44.0173 0x10b0 SENS - ok
19:53:44.0205 0x10b0 [ E66A7C8CE7ED22DED6DF1CA479FB4790, ADEB076F131E7A8C3AD96022B09BB33EB9AB26C9C831503B8C6960AA763B8975 ] SensrSvc C:\Windows\system32\sensrsvc.dll
19:53:44.0251 0x10b0 SensrSvc - ok
19:53:44.0267 0x10b0 [ DB2FF24CE0BDD15FE75870AFE312BA89, 7DB0D978C92CD0A0A81F7AB46FE323B4929CEA01585B0F330921E6DFA7DE1B85 ] SerCx C:\Windows\system32\drivers\SerCx.sys
19:53:44.0283 0x10b0 SerCx - ok
19:53:44.0314 0x10b0 [ 0044B31F93946D5D41982314381FE431, 95B8A94BA9EF770F29ACD5B23D447EC2B6CF1CB3D0030343BA1550AC31F6E2A5 ] SerCx2 C:\Windows\system32\drivers\SerCx2.sys
19:53:44.0330 0x10b0 SerCx2 - ok
19:53:44.0345 0x10b0 [ 3CD600C089C1251BEEB4CD4CD5164F9E, D9F81951B4454B24E821E33ACA53A851A61F3135E8EC6FBE6761A1A3E1CDCBE2 ] Serenum C:\Windows\System32\drivers\serenum.sys
19:53:44.0376 0x10b0 Serenum - ok
19:53:44.0392 0x10b0 [ D864381BC9C725FAB01D94C060660166, 132FED95222BBE3B0B25B3F1F0EFC5903D04564BD047BA4D2042AD51E3FDA724 ] Serial C:\Windows\System32\drivers\serial.sys
19:53:44.0408 0x10b0 Serial - ok
19:53:44.0408 0x10b0 [ 0BD2B65DCE756FDE95A2E5CCCBF7705D, F13FAFEC8FCF3E796196562717C433CE359A74A3E5876AB070647C717AF74028 ] sermouse C:\Windows\System32\drivers\sermouse.sys
19:53:44.0408 0x10b0 sermouse - ok
19:53:44.0439 0x10b0 [ D5C3776CBD8BC307DCCA3FD4CE667A37, 98E4253B770C25914C91A6148E2EA15ED0EF37ADCB042A47252DBA135972BF74 ] SessionEnv C:\Windows\system32\sessenv.dll
19:53:44.0470 0x10b0 SessionEnv - ok
19:53:44.0470 0x10b0 [ 472B7A5AC181C050888DB454663DD764, C950A8615D57BFD455E18880398350642B2E1D6B951EC9754FD8D429F3418835 ] sfloppy C:\Windows\System32\drivers\sfloppy.sys
19:53:44.0501 0x10b0 sfloppy - ok
19:53:44.0533 0x10b0 [ F4414F57DF2CECB8FC969AA43A6B0D50, AD09A6E1294721507DD6BE82B91F2EEB0FF0151B9BC14A75840CD657DBFDECEC ] SharedAccess C:\Windows\System32\ipnathlp.dll
19:53:44.0564 0x10b0 SharedAccess - ok
19:53:44.0626 0x10b0 [ 0D190D8B4B20446BE6299AC734DFADF1, 6551095971F99820BBFC5FED8FAB9591A3F8ABFA0F027887F3B71B79325FF6D9 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
19:53:44.0658 0x10b0 ShellHWDetection - ok
19:53:44.0673 0x10b0 [ 2F518D13DD6F3053837FE606F1A2EA1F, 64109296CE95BD233525688A350D575CF97B9464659AA07CF78B307B6ADBC835 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
19:53:44.0673 0x10b0 SiSRaid2 - ok
19:53:44.0689 0x10b0 [ 1AC9A200A9C49C4508F04AAFFCA34A3F, 972BCB2A39169155F74111FAC74ACCD8F50E34EADCF087833B0980827627BBF4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
19:53:44.0689 0x10b0 SiSRaid4 - ok
19:53:44.0705 0x10b0 [ 3660CA8089E00C721EAC28F7093CB156, E1FA33C868D605B6CBAE1F781F201D99EE494A4551BD9C524CC28733F7260BBA ] SmbDrvI C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys
19:53:44.0720 0x10b0 SmbDrvI - ok
19:53:44.0736 0x10b0 [ 587ACA15210D1B01FBF272E07A08F91A, 1F3C13C218C5EA329C6E33E4AE7CFE88DAD59DA40F59FDE09D733AFD2E489000 ] smphost C:\Windows\System32\smphost.dll
19:53:44.0783 0x10b0 smphost - ok
19:53:44.0814 0x10b0 [ 49EEB92DE930B8566EF615D600781DB4, 0B7C929D24FAFC34F95BB4AA77DCBA29DDD8F1977EB42713B64228677D1FBFD3 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
19:53:44.0830 0x10b0 SNMPTRAP - ok
19:53:44.0955 0x10b0 [ 3A4F2C0BB87A0895ABEBA341AA1E341B, 4DADEEF3C5D181502D6F4A00FBBF3B001FA626E49569FB330D7AE2955CC7DE08 ] Sony PC Companion C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
19:53:44.0970 0x10b0 Sony PC Companion - ok
19:53:45.0001 0x10b0 [ 240C5C3793206725AA05665851E8C214, 96ADFB85EB1623EB00C251C1C6A1F441A1795F0EBFD10B17DD1CA58E3AE8A90D ] spaceport C:\Windows\system32\drivers\spaceport.sys
19:53:45.0017 0x10b0 spaceport - ok
19:53:45.0048 0x10b0 [ F337BE11071818FC3F5DC2940B6BDE34, D5CFF00E5DF37045F71AEE101AC9B270EBB29F372F404757B58600E9966C7E4D ] SpbCx C:\Windows\system32\drivers\SpbCx.sys
19:53:45.0048 0x10b0 SpbCx - ok
19:53:45.0080 0x10b0 [ 42FEA9E0BA9761D9E65A4F167D91515B, 9A34CE83F3ACD50608671BDABE5E475F8E0C8335D3B8B7B3D7E84B2A319FA29F ] Spooler C:\Windows\System32\spoolsv.exe
19:53:45.0142 0x10b0 Spooler - ok
19:53:45.0330 0x10b0 [ C993A0B97BECD3AAF5158E3869878465, 8B86F37DEFCBE55DE507D830EC4980EBB39B3CCA30C2B3E76B588AAB282A50FC ] sppsvc C:\Windows\system32\sppsvc.exe
19:53:45.0580 0x10b0 sppsvc - ok
19:53:45.0642 0x10b0 [ 6416E79A58A8FCC33A447A4DDDD3BF04, 839E3107ACCD520C309BD6C8324DF7A8EB724EAD442AB1F1CACB0D83F84BE488 ] srv C:\Windows\system32\DRIVERS\srv.sys
19:53:45.0767 0x10b0 srv - ok
19:53:45.0814 0x10b0 [ 5BED3AB69797C8786EF70AEA8C33748B, 0474EE6C43D437CBA9848BCF25D1341B122D7E9F371A0FF3C62C83D14B2CB095 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
19:53:45.0892 0x10b0 srv2 - ok
19:53:45.0923 0x10b0 [ D047CD668E6277FD80F0C613946F034C, BD0209E7FD89F9295D4DE48C9652DF2A2990277C16AFA473B96704B1CBD2F338 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
19:53:45.0939 0x10b0 srvnet - ok
19:53:45.0955 0x10b0 [ BB9ED3EDD8E85008215A7250D325A72E, D3404E31B7706B25CDEA7CB4260C343B5F090E8CCB9A5FA203B0F94A9112F1B3 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
19:53:45.0986 0x10b0 SSDPSRV - ok
19:53:46.0017 0x10b0 [ 3911418AFDE10EA6823B7799E4815524, A73517C4C1271E666B2B3A747756070098E923742B41572AA16573170440AA07 ] SstpSvc C:\Windows\system32\sstpsvc.dll
19:53:46.0033 0x10b0 SstpSvc - ok
19:53:46.0064 0x10b0 [ 5252D7BC56E5E0ED715AEA8FE173A455, 1408B3E98B35A449434718777EE70595F0D306197A428279C6281D2F1953F259 ] ssudmdm C:\Windows\system32\DRIVERS\ssudmdm.sys
19:53:46.0080 0x10b0 ssudmdm - ok
19:53:46.0126 0x10b0 [ 7E815DDD79CC73A02A33DF11FABE4E1E, A05A85CDB0CB0AA1AAC93AA801C39242BFE59082E2BC580F04EBFA71B5B61F07 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
19:53:46.0189 0x10b0 Steam Client Service - ok
19:53:46.0205 0x10b0 [ 366DEA74BBA65B362BCCFC6FC2ADFD8B, 4D28122AB9D8DAB724021E6513B4474BD34FCEDF47769B1D27AC7551FCA002F8 ] stexstor C:\Windows\system32\drivers\stexstor.sys
19:53:46.0220 0x10b0 stexstor - ok
19:53:46.0283 0x10b0 [ D638904FE86A5FE542A1BA13A9D68E5C, 89A956F932316BC50DD99B54BAF4E2809DCAA084DBB04CB84D11E5470BEAF251 ] stisvc C:\Windows\System32\wiaservc.dll
19:53:46.0361 0x10b0 stisvc - ok
19:53:46.0361 0x10b0 [ 0ED2E318ABB68C1A35A8B8038BDB4C90, 5C3ABC245F4BCFE64E646D9C0E2F5E211244956C84D03084C71FF6A7E0CDED30 ] storahci C:\Windows\system32\drivers\storahci.sys
19:53:46.0361 0x10b0 storahci - ok
19:53:46.0408 0x10b0 [ 7A08CEE1535F5A448215634C5EA74E50, 41529CDC08A3956F8FE9D5759B147E2E56E3305149EA415EB200249F7CD32094 ] storflt C:\Windows\system32\DRIVERS\vmstorfl.sys
19:53:46.0423 0x10b0 storflt - ok
19:53:46.0439 0x10b0 [ 6B06E2D11E604BE2B1A406C4CB3B90DE, 2DDEA1568A85AD64FCE5D10D348304FCD9BE6E96C2313353EF70A2933306D188 ] stornvme C:\Windows\system32\drivers\stornvme.sys
19:53:46.0455 0x10b0 stornvme - ok
19:53:46.0486 0x10b0 [ 3118058E3D07021A55324A943C6D722B, 0B255DF1977DADD2B9766EEEA814B464F0ABFA34D6439F3C453083850C121F16 ] StorSvc C:\Windows\system32\storsvc.dll
19:53:46.0517 0x10b0 StorSvc - ok
19:53:46.0533 0x10b0 [ 548759755BC73DAD663250239D7E0B9F, D31A05A8CE800B539420B6E545F1F4BF6E4B02EAF8366DE89CAF13A83C6CA48D ] storvsc C:\Windows\system32\drivers\storvsc.sys
19:53:46.0548 0x10b0 storvsc - ok
19:53:46.0564 0x10b0 [ D8E1AE075AB3E8AD56F69C44AA978596, CAFF5116DE7F0EEFFEBE38724BCEE7D11B44153AD35EE43E314C56D5E210758A ] svsvc C:\Windows\system32\svsvc.dll
19:53:46.0580 0x10b0 svsvc - ok
19:53:46.0595 0x10b0 [ 84E0F5D41C138C5CC975137A2A98F6D3, 1E36CED05E4F4365C2AB020CAF920E3959995D7F89F3FABD7B2FB05985F85F38 ] swenum C:\Windows\System32\drivers\swenum.sys
19:53:46.0611 0x10b0 swenum - ok
19:53:46.0642 0x10b0 [ 850EBB87584484DC16F917E7B6F4A304, C253D1DFFCDFB018432063602FB01DBCBDDD6E03458E5C366AABD4670F114B0C ] swprv C:\Windows\System32\swprv.dll
19:53:46.0767 0x10b0 swprv - ok
19:53:46.0830 0x10b0 [ B60E34DF2F11A7067521FEA2472D1C42, E13A7693E88EDF7441C39965DFF73FD5472BB61D54481AE2CEE561D06B689F99 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
19:53:46.0861 0x10b0 SynTP - ok
19:53:47.0001 0x10b0 [ 3DA26652B12E9AB43FD04976AC6DFD33, DEFE220D86197949E97342FE3487CD6A07DD2FFAF6D17A7C65419C2C1B9D1AB5 ] SysMain C:\Windows\system32\sysmain.dll
19:53:47.0126 0x10b0 SysMain - ok
19:53:47.0173 0x10b0 [ FD4EA8E9232ADD51DC31C295DDEF2768, 3EA40D7376AB5AA5DA2BCF4745C79F7BF819363466967ECC3CD15ADECBFD7244 ] SystemEventsBroker C:\Windows\System32\SystemEventsBrokerServer.dll
19:53:47.0267 0x10b0 SystemEventsBroker - ok
19:53:47.0314 0x10b0 [ BA6DD39266A5E15515C8C14DA2DA3E5C, 5BC917BA4E7281A67CC6CEF2F4D1972DF04DECBEFB6DED0B08FFBD06E15D4B4F ] TabletInputService C:\Windows\System32\TabSvc.dll
19:53:47.0376 0x10b0 TabletInputService - ok
19:53:47.0408 0x10b0 [ B517410F157693043DACA21B19B258A6, 2224EECEB575CEA811036C43BB5B0A408DE5F59BC97235AB948968E4C3E438F2 ] TapiSrv C:\Windows\System32\tapisrv.dll
19:53:47.0455 0x10b0 TapiSrv - ok
19:53:47.0580 0x10b0 [ CCB3A2BB60FE5073F2DEA63FE83CF8FE, 02982136236DD595D8974E6645A008D663B4DD3BC3824721E4DE4377B97887C7 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
19:53:47.0658 0x10b0 Tcpip - ok
19:53:47.0814 0x10b0 [ CCB3A2BB60FE5073F2DEA63FE83CF8FE, 02982136236DD595D8974E6645A008D663B4DD3BC3824721E4DE4377B97887C7 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
19:53:47.0876 0x10b0 TCPIP6 - ok
19:53:47.0908 0x10b0 [ 41CF802064F72E55F50CA0A221FD36D4, 70ABCDF9E96611E8C83042C581575E26649FE479475E8E118CD3FF6CB1C84C3F ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
19:53:48.0001 0x10b0 tcpipreg - ok
19:53:48.0048 0x10b0 [ FFF28F9F6823EB1756C60F1649560BBF, 208DFF8BF0329D0D4761C7E31527AEED7FF5F3C36C5005953D01477F35408D5C ] tdx C:\Windows\system32\DRIVERS\tdx.sys
19:53:48.0080 0x10b0 tdx - ok
19:53:48.0126 0x10b0 [ 232D185D2337F141311D0CF1983E1431, 02EB56D3F26174AF1741C1A444CE30DE84D5BAF583C1A52C7A953BCC52445547 ] terminpt C:\Windows\System32\drivers\terminpt.sys
19:53:48.0158 0x10b0 terminpt - ok
19:53:48.0236 0x10b0 [ 3D748E5558FD9A9F03182CB2330698DC, 70B2069AB7912EB49AB3ABD18D4B42CB94AC99CA6DE3F63F4888B8EAAC78AAA2 ] TermService C:\Windows\System32\termsrv.dll
19:53:48.0361 0x10b0 TermService - ok
19:53:48.0392 0x10b0 [ 05FBE1F7C13E87AF7A414CDF288B1F62, 24079E1A6B2E33A1A8E76A77F73473B93DD6B379E44C982CE50D6CEED9747838 ] Themes C:\Windows\system32\themeservice.dll
19:53:48.0455 0x10b0 Themes - ok
19:53:48.0470 0x10b0 [ FD788C2D96EA91469A3C1D13E80D7473, 7B14D4BFDE18CECC19FBFFAA5AFF5FD78BFB7FCDA6613990740A8A7DD9873D26 ] THREADORDER C:\Windows\system32\mmcss.dll
19:53:48.0486 0x10b0 THREADORDER - ok
19:53:48.0517 0x10b0 [ 347A3E49CE18402305B8119A6EC7CFEB, 6768B20EE577880B0353FE84B980D4A18D323929A63FAE41F7A55123BBFC8DBA ] TimeBroker C:\Windows\System32\TimeBrokerServer.dll
19:53:48.0548 0x10b0 TimeBroker - ok
19:53:48.0564 0x10b0 [ 82F909359600D3603FE852DB7F135626, 2EB2BB9D81AC9A2E432B2628E296B7B21F1C82EAE8009300EEF1B8596A9F418D ] TPM C:\Windows\system32\drivers\tpm.sys
19:53:48.0580 0x10b0 TPM - ok
19:53:48.0626 0x10b0 [ C97E14BB6A196B0554D6EB67D8818175, C00588C94988F10507F84584DFA4C0A43B8648AD1AD35E9BAE14CDD21FCF7B90 ] TrkWks C:\Windows\System32\trkwks.dll
19:53:48.0673 0x10b0 TrkWks - ok
19:53:48.0736 0x10b0 [ 887CC44830D3F367CAD17A0CA7CCA5C8, D4022A76433A11FD66D0F41A1EB4D6893BC5B22317E7E9E021739109EB493B44 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
19:53:48.0798 0x10b0 TrustedInstaller - ok
19:53:48.0861 0x10b0 [ BF8F54CA37E9C9D6582C31C5761F8C93, 337C566792F6FB9B7FD5D1D4384B767CFE4CF5DBB2E4688CCC36CBB018A0DD0F ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
19:53:48.0892 0x10b0 TsUsbFlt - ok
19:53:48.0908 0x10b0 [ E0088068DCE2EE82897027DDB8E05254, FA9C201D3C885DAD2ABE6A23343EDCC83CFB342EFF9E3005FA50B1D88B21D203 ] TsUsbGD C:\Windows\System32\drivers\TsUsbGD.sys
19:53:48.0939 0x10b0 TsUsbGD - ok
19:53:48.0955 0x10b0 [ C8E0E78B5D284C2FF59BDFFDAF997242, BA1576C491A1246EF9866762426D110F4570F9DB42A68C174943C7D5020FE3E2 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
19:53:48.0955 0x10b0 tunnel - ok
19:53:48.0970 0x10b0 [ F6EEAD052943B5A3104C1405BB856C54, FE422813E6C1012E9F392EFF2AE4C6D3A4DBD9CB2BD5E6A5CAB57D4E89A29468 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
19:53:48.0970 0x10b0 uagp35 - ok
19:53:49.0001 0x10b0 [ FE6067B1FD4E63650C667B33D080565B, 2C330ED00E49BA55E25564230E0DFB8A35F2B5320EB18D4AF7CAACFA9A449044 ] UASPStor C:\Windows\System32\drivers\uaspstor.sys
19:53:49.0017 0x10b0 UASPStor - ok
19:53:49.0048 0x10b0 [ B034A41891A36457B994307DFA772293, CA5E6500764A9777AE0E15B2AFB6F05982C90F01374E3F6DDC6DF3852282C66B ] UCX01000 C:\Windows\System32\drivers\ucx01000.sys
19:53:49.0048 0x10b0 UCX01000 - ok
19:53:49.0080 0x10b0 [ 1EC649F112896FAE33250F0B97AC5D0B, 0C0A1C2C7615DEB298AD3073340FD1BF91FEBE611F133E3B48D994A6EAA8369F ] udfs C:\Windows\system32\DRIVERS\udfs.sys
19:53:49.0095 0x10b0 udfs - ok
19:53:49.0095 0x10b0 [ 9578691F297E1B1F519970FE6D47CB21, 080C352AAF22A16A4F3C4AB4DCEA5BFA656457C73F735CEBA30516FDACCF6301 ] UEFI C:\Windows\System32\drivers\UEFI.sys
19:53:49.0111 0x10b0 UEFI - ok
19:53:49.0142 0x10b0 [ 320878AFECDBBD61BBE98624A6CAAC08, 15C090EA32A24D976B5FCB1373B1281DCC2295C075299C814345D694AEB47CB9 ] UI0Detect C:\Windows\system32\UI0Detect.exe
19:53:49.0158 0x10b0 UI0Detect - ok
19:53:49.0173 0x10b0 [ 5EAB5117DDB24FC4D39E6FFFCF1837B9, 2BC709240867F161E94BE6625A04F478EAAA3EEE7BC7C37ED0DFA9EEA5928E98 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
19:53:49.0189 0x10b0 uliagpkx - ok
19:53:49.0189 0x10b0 [ DA34C39A18E60E7C3FA0630566408034, 2F162504214053894C72760D9933D01DBF3578609FE5E2376C3272818599FE32 ] umbus C:\Windows\System32\drivers\umbus.sys
19:53:49.0205 0x10b0 umbus - ok
19:53:49.0205 0x10b0 [ AE8294875E5446E359B1E8035D40C05E, AE0357BAB47C07C3576BC76951CD258C009BC5A1B93259D2122A841BD9CDA8FA ] UmPass C:\Windows\System32\drivers\umpass.sys
19:53:49.0205 0x10b0 UmPass - ok
19:53:49.0236 0x10b0 [ E3DDF7D43E05784FAA5E042605EEE528, 8E20E880FAB09AF4FF5C438BF9EAE9970D46C05167870110869B744E498FD761 ] UmRdpService C:\Windows\System32\umrdp.dll
19:53:49.0251 0x10b0 UmRdpService - ok
19:53:49.0267 0x10b0 [ 4A2FFDAC45F317E17DF642C7160EB633, F1AB762912FAA5F469F322407DA37C91556086C42D1643AD27516C12A84F74D0 ] upnphost C:\Windows\System32\upnphost.dll
19:53:49.0314 0x10b0 upnphost - ok
19:53:49.0330 0x10b0 [ FF78D053A05E5A394F4E3C1816CC65A8, 5DAE02414271231F5FDBB751AFEB99874779B467947020815D4AE54432D4269D ] usbccgp C:\Windows\System32\drivers\usbccgp.sys
19:53:49.0345 0x10b0 usbccgp - ok
19:53:49.0376 0x10b0 [ B3D6457D841A0CAEF4C52D88621715F2, CBDD76A8A28379B107B1FB530757B477B8AB74CD01F9F3CEDC7B1BA0C6E5A990 ] usbcir C:\Windows\System32\drivers\usbcir.sys
19:53:49.0392 0x10b0 usbcir - ok
19:53:49.0423 0x10b0 [ 48BA326A3DBA5B5BEB5F2777F4618696, B9EC8155F11A3A7644BD9DC8910681B46AE44AE3BF53F052DF50E9C5555E3229 ] usbehci C:\Windows\System32\drivers\usbehci.sys
19:53:49.0423 0x10b0 usbehci - ok
19:53:49.0455 0x10b0 [ FEF0BC107812B36849741C3211BA6B60, B3EF738BE1E6B6027F29C9713CD3F367EA067D2BE46580AFBC0FB58046EF6BBD ] usbhub C:\Windows\System32\drivers\usbhub.sys
19:53:49.0486 0x10b0 usbhub - ok
19:53:49.0501 0x10b0 [ 65392F3F3F65E4C6CC82A0F4F8A0B051, C11B662A28D95820717DFFC6B76DBB755E4876009A2342E5E3992DE32D6BFF61 ] USBHUB3 C:\Windows\System32\drivers\UsbHub3.sys
19:53:49.0517 0x10b0 USBHUB3 - ok
19:53:49.0548 0x10b0 [ 3019097FB6C985EF24C058090FF3BDBD, 24AC518D34E338D94BF3D5B3F72E53F8A1369BAA7F32FEA3EDBCF928C4FF1D17 ] usbohci C:\Windows\System32\drivers\usbohci.sys
19:53:49.0595 0x10b0 usbohci - ok
19:53:49.0595 0x10b0 [ 4D655E3B684BE9B0F7FFD8A2935C348C, 3A7FC1748C5AEA8CFE0E7C22ADC77E3DCA475455FC16D9C6A5C16EB5E949A516 ] usbprint C:\Windows\System32\drivers\usbprint.sys
19:53:49.0642 0x10b0 usbprint - ok
19:53:49.0689 0x10b0 [ 66732C13628BDB1AB0D6FD46027327C2, B582C0F348D8F79419CA5A58F10CA151E06D7CA3BE162344CADA46D9D7FED97C ] USBSTOR C:\Windows\System32\drivers\USBSTOR.SYS
19:53:49.0705 0x10b0 USBSTOR - ok
19:53:49.0720 0x10b0 [ 064260B3A5868AC894A4943543BC7AB7, D3534E98B34C4AC9A430D7E0AB301A0E5E1511E3117C2FEA392636B0DE2C38E2 ] usbuhci C:\Windows\System32\drivers\usbuhci.sys
19:53:49.0767 0x10b0 usbuhci - ok
19:53:49.0798 0x10b0 [ 18F744E8CCEB2670040EBAF7AD77B8C6, C5E2DF4EA0D946B4DA67DE29FA9D0F079DED35EC59B98E532C4C2D5F8E86DA0A ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
19:53:49.0814 0x10b0 usbvideo - ok
19:53:49.0845 0x10b0 [ 48430B0313FC1CFE3D2400553F1A93CD, 92994DE6B131E904AFF2C9C4FBB4E6B0D58525A1539763327373DA18C9F08193 ] USBXHCI C:\Windows\System32\drivers\USBXHCI.SYS
19:53:49.0861 0x10b0 USBXHCI - ok
19:53:49.0892 0x10b0 [ F6F209DDB94959BA104FC8FC87C53759, 8E862D41F4332EABF64BD034E2C0E3CC8109C7990CB4112C2B2880E8E6EDF2D3 ] VaultSvc C:\Windows\system32\lsass.exe
19:53:49.0892 0x10b0 VaultSvc - ok
19:53:49.0908 0x10b0 [ FEB26E3B8345A7E8D62F945C4AE86562, 3AAFE87C402FC8E92542DFE60EC9540559863065F88D429A16D7B1BF829223FF ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
19:53:49.0908 0x10b0 vdrvroot - ok
19:53:49.0955 0x10b0 [ E3EF58D4123B5AA29C8E19825AF84A5E, FB1046722BC643E955DBC3B1459DBF2A6D575EBA2BCF7B20A0FA51E3993835E2 ] vds C:\Windows\System32\vds.exe
19:53:50.0017 0x10b0 vds - ok
19:53:50.0033 0x10b0 [ A026EDEAA5EECAE0B08E2748B616D4BD, 2525A54DC7F49DDFBB999C22BF3FAB6D9E9F70C0806E58D81E90AC59F9F46089 ] VerifierExt C:\Windows\system32\drivers\VerifierExt.sys
19:53:50.0033 0x10b0 VerifierExt - ok
19:53:50.0080 0x10b0 [ 52E483A3701A5A61A75A06993720347D, 689E812755E485DF6960D1E049740FBAFB812467D23B673DCAA40C03FEBB544F ] vhdmp C:\Windows\System32\drivers\vhdmp.sys
19:53:50.0111 0x10b0 vhdmp - ok
19:53:50.0126 0x10b0 [ 06D38968028E9AB19DE9B618C7B6D199, 62022297A47F440D1C82CA0B0E57C0C8E9D5033D83DD3B40492B218DF65EBF68 ] viaide C:\Windows\system32\drivers\viaide.sys
19:53:50.0126 0x10b0 viaide - ok
19:53:50.0142 0x10b0 [ C6305BDFC4F7CE51F72BB072C03D4ACE, 73E62869CA3104F48CC3B0C45E69CE9BF4F8D7D06E29C2F049B9347ABB50554D ] vmbus C:\Windows\system32\drivers\vmbus.sys
19:53:50.0142 0x10b0 vmbus - ok
19:53:50.0142 0x10b0 [ DA40BEA0A863CE768C940CA9723BF81F, 567C0C3F422325635808B0CF76E05D3B6187F96845C33F85F92F98C9FE53A5B8 ] VMBusHID C:\Windows\System32\drivers\VMBusHID.sys
19:53:50.0173 0x10b0 VMBusHID - ok
19:53:50.0205 0x10b0 [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicguestinterface C:\Windows\System32\ICSvc.dll
19:53:50.0220 0x10b0 vmicguestinterface - ok
19:53:50.0236 0x10b0 [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicheartbeat C:\Windows\System32\ICSvc.dll
19:53:50.0251 0x10b0 vmicheartbeat - ok
19:53:50.0267 0x10b0 [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmickvpexchange C:\Windows\System32\ICSvc.dll
19:53:50.0283 0x10b0 vmickvpexchange - ok
19:53:50.0298 0x10b0 [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicrdv C:\Windows\System32\ICSvc.dll
19:53:50.0314 0x10b0 vmicrdv - ok
19:53:50.0314 0x10b0 [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicshutdown C:\Windows\System32\ICSvc.dll
19:53:50.0330 0x10b0 vmicshutdown - ok
19:53:50.0345 0x10b0 [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmictimesync C:\Windows\System32\ICSvc.dll
19:53:50.0361 0x10b0 vmictimesync - ok
19:53:50.0376 0x10b0 [ 9067880BBB1C18703DBFF27D731D7ECA, 0044246249F4B945D72BBC0FEF9BF3C31E62F57CBF77615A95213B36A29F0C71 ] vmicvss C:\Windows\System32\ICSvc.dll
19:53:50.0392 0x10b0 vmicvss - ok
19:53:50.0423 0x10b0 [ 55D7D963DE85162F1C49721E502F9744, 5AD34D6DB707EF3E5242BD8CA67B21D6258EE7E7FC477D5227BD15500AE7F45F ] volmgr C:\Windows\system32\drivers\volmgr.sys
19:53:50.0439 0x10b0 volmgr - ok
19:53:50.0455 0x10b0 [ CCB9E901F7254BF96D28EB1B0E5329B7, F0E3CA4EFA544CDAEF4092284CF3EC7DF07F806A770285E281816457AD8813F5 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
19:53:50.0470 0x10b0 volmgrx - ok
19:53:50.0517 0x10b0 [ 64CA2B4A49A8EAF495E435623ECCE7DB, 81151F295A54DE2B8B88C7F48C86BF58CDFF96F98493509C06D6F41484594386 ] volsnap C:\Windows\system32\drivers\volsnap.sys
19:53:50.0533 0x10b0 volsnap - ok
19:53:50.0548 0x10b0 [ 01355C98B5C3ED1EC446743CDA848FCE, B9FCF558C20E05DD0F53FFB70BBEF873EA57801E13A16701E636128D625C4B67 ] vpci C:\Windows\System32\drivers\vpci.sys
19:53:50.0564 0x10b0 vpci - ok
19:53:50.0580 0x10b0 [ 4539F45F9F4C9757A86A56C949421E07, DEC362314B2C66414F39354AFE79C02B18BF4EEF90787FB58307F6EB62237E2C ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
19:53:50.0580 0x10b0 vsmraid - ok
19:53:50.0642 0x10b0 [ E369C59F2C0852DDD090C07E0DDE0051, 4FAC94458EAAEED4F84A86FBAB8FBB332D0AF85BD528E63C0C058A2DA8E3011D ] VSS C:\Windows\system32\vssvc.exe
19:53:50.0798 0x10b0 VSS - ok
19:53:50.0845 0x10b0 [ 0849B7260F26FE05EA56DED0672E2F4B, 7EAC0E7988F45CB4133A15932955B7B03CE715C967A3BAC9999D81543EBCAEC5 ] VSTXRAID C:\Windows\system32\drivers\vstxraid.sys
19:53:50.0908 0x10b0 VSTXRAID - ok
19:53:50.0955 0x10b0 [ BE970C369E43B509C1EDA2B8FA7CECB0, 18951F2AA842A0795AA79A4E164EE925A35E6270EBE4C4CDB19D0A891830E383 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
19:53:51.0001 0x10b0 vwifibus - ok
19:53:51.0048 0x10b0 [ 35BF5C5F5E3C9902C98978C7640574DA, C61E50B04000DCEC72365723F0C0725C2E005529DAF2777A59E624C14DA29E55 ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
19:53:51.0111 0x10b0 vwififlt - ok
19:53:51.0142 0x10b0 [ 65ED7B9CFEA893DF7748D5FF692690DE, 73AB9D8BB928B3247BDFC7BB47AD7FCA763B375DC250C251DB4E0573531040E8 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
19:53:51.0158 0x10b0 vwifimp - ok
19:53:51.0205 0x10b0 [ 7599E582CA3A6AAA95A18FFE1172D339, A0410778FBBC4302EA91CF24B944427410B4706535F1192504D4F34C3ED4503E ] W32Time C:\Windows\system32\w32time.dll
19:53:51.0236 0x10b0 W32Time - ok
19:53:51.0267 0x10b0 [ 0910AB9ED404C1434E2D0376C2AD5D8B, 62585CA5F1375BDA440D28D5DF1ADDC9DE3DDFA196D49BBFF3456A5A09EE1C6B ] WacomPen C:\Windows\System32\drivers\wacompen.sys
19:53:51.0283 0x10b0 WacomPen - ok
19:53:51.0345 0x10b0 [ 61692DB39AD3DF2F29392D68EAA7BB93, 854D4B9C7DD1676968598ED973500650ECEC02C420E44C0B3957C24F073AA5FB ] wbengine C:\Windows\system32\wbengine.exe
19:53:51.0486 0x10b0 wbengine - ok
19:53:51.0548 0x10b0 [ 3BC1D1D56637A32CD91C8AE08E2484AA, 9EE1BD3FB0D289E25F3DDD0D8F67DC1C701A6B1D5418FADF348D0E642B1DEBEB ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
19:53:51.0658 0x10b0 WbioSrvc - ok
19:53:51.0705 0x10b0 [ A07CFC4B593D15B6BF06813C3B5B33BF, B57BD918E2AFF9943B51A24B95E0C4D3482B4DF73C0E2421E8CC67C2BC7A4C70 ] Wcmsvc C:\Windows\System32\wcmsvc.dll
19:53:51.0752 0x10b0 Wcmsvc - ok
19:53:51.0798 0x10b0 [ D2726823DF7E19F213F4805A9D6D145F, A7F582C99918D204264D3B374F70D75984BDA5805203041E3DECB8153D16E102 ] wcncsvc C:\Windows\System32\wcncsvc.dll
19:53:51.0876 0x10b0 wcncsvc - ok
19:53:51.0908 0x10b0 [ 846C02A8B48CBD921A3D6AB521AA0DC4, B07573A774A6C65D24E5718DC25DF378270EB5B40221CA5A53B21D47838381D3 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
19:53:51.0955 0x10b0 WcsPlugInService - ok
19:53:51.0986 0x10b0 [ 0359607177E5E9F6041136CC0A5CB0B6, 16687BE2639648CF46E8768BA1798030472C525612C629BF134D053240E2195B ] WdBoot C:\Windows\system32\drivers\WdBoot.sys
19:53:51.0986 0x10b0 WdBoot - ok
19:53:52.0048 0x10b0 [ CB6C63FF8342B467E2EF76E98D5B934D, BE017CE91E3BAB293DE6ECF143797CCE3F33CC63024437472B4E38C6961AD884 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
19:53:52.0095 0x10b0 Wdf01000 - ok
19:53:52.0126 0x10b0 [ DE8D12B4C3F55FA2C5E9774314F6C58A, C3E835DC066A94E1431BCDC90D7EA27AAC6F82826F4A5527B37D865241D7A366 ] WdFilter C:\Windows\system32\drivers\WdFilter.sys
19:53:52.0126 0x10b0 WdFilter - ok
19:53:52.0173 0x10b0 [ 40C67D1A4891120874767F6E6604D6C5, 4D9DD658566DE711ADF4D6C33FCB31DA351EE050E3ED188664D04526CCAAEEF5 ] WdiServiceHost C:\Windows\system32\wdi.dll
19:53:52.0220 0x10b0 WdiServiceHost - ok
19:53:52.0220 0x10b0 [ 40C67D1A4891120874767F6E6604D6C5, 4D9DD658566DE711ADF4D6C33FCB31DA351EE050E3ED188664D04526CCAAEEF5 ] WdiSystemHost C:\Windows\system32\wdi.dll
19:53:52.0236 0x10b0 WdiSystemHost - ok
19:53:52.0251 0x10b0 [ 4AD874CDC812EC156265E451B6B09DAB, 6E3E05B8301841425E9BB0D54B35EF386B78EEB307B5A6153FD1F366D30F23FA ] WdNisDrv C:\Windows\system32\Drivers\WdNisDrv.sys
19:53:52.0251 0x10b0 WdNisDrv - ok
19:53:52.0283 0x10b0 WdNisSvc - ok
19:53:52.0314 0x10b0 [ 91B18D7A1702ED589E67C6C81052B955, 5D1DA8B86106A28E50BBCCB36527CC130D41201F5BE1D3DC5F1D6F7ECCF807BA ] WebClient C:\Windows\System32\webclnt.dll
19:53:52.0361 0x10b0 WebClient - ok
19:53:52.0392 0x10b0 [ 3274312F263882B51B964329FAF49734, 99A020377ACF0762BE5ECD2D68EB5E1497B9D59963247E725F7F96FB5DF41FAD ] Wecsvc C:\Windows\system32\wecsvc.dll
19:53:52.0423 0x10b0 Wecsvc - ok
19:53:52.0439 0x10b0 [ 7CDD84E0023A0C5C230B06A7965EC65E, 6EC7DC18C76D66CF9A893C3DD20F9BE3ADD76546F9A9BA42CE4F24854709F9D9 ] WEPHOSTSVC C:\Windows\system32\wephostsvc.dll
19:53:52.0470 0x10b0 WEPHOSTSVC - ok
19:53:52.0502 0x10b0 [ 959534ACF085C137D2D094384EF89C45, D029F440789FE170A1C46217C6DE6D78DC0188A5CF33FCCC17FA65D3BC80C2B7 ] wercplsupport C:\Windows\System32\wercplsupport.dll
19:53:52.0533 0x10b0 wercplsupport - ok
19:53:52.0548 0x10b0 [ 82BCCF5FBE47AC9E8CBA2020994DFB3F, EA96C6BD98A701B465D0780EC10BDA92E45FE636D60C1385813AA3B456D8B931 ] WerSvc C:\Windows\System32\WerSvc.dll
19:53:52.0564 0x10b0 WerSvc - ok
19:53:52.0595 0x10b0 [ BFBE1C5F57FE7A885673A1962D5532B7, F0BD05B257108699FE6AB32EF11F927C31932F27062A705B3FEFA4F5B4C0D8C3 ] WFPLWFS C:\Windows\system32\DRIVERS\wfplwfs.sys
19:53:52.0611 0x10b0 WFPLWFS - ok
19:53:52.0627 0x10b0 [ E06AFE2F94BA7CFA2FE4FD2A449E60E2, 99A81E16366E9E77905D873B0246E4C11B383FE1E99E0E1D9A07FAD4E52EA9E4 ] WiaRpc C:\Windows\System32\wiarpc.dll
19:53:52.0642 0x10b0 WiaRpc - ok
19:53:52.0658 0x10b0 [ 867BCC69ED9C31C501465EB0E8BA9DFA, 678B7FF4D4E8624514301956CDA7FB451159BBFC83FF2E4E5E7DADAE3C7AB2EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
19:53:52.0673 0x10b0 WIMMount - ok
19:53:52.0673 0x10b0 WinDefend - ok
19:53:52.0705 0x10b0 [ DD079EC8F44DCA3A176B345C6ADEFB66, 6CD9371B83EA23D2181891FAE1DB285BC111A78C35F374E57666ED09860C91A9 ] WinHttpAutoProxySvc C:\Windows\system32\winhttp.dll
19:53:52.0752 0x10b0 WinHttpAutoProxySvc - ok
19:53:52.0814 0x10b0 [ 9DB490F3E823C5C3C070644B96CB9D59, 81937D0B331E43C7C61514E60B3AD51370C5201F7B4D12F8534840D91EDC32DD ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
19:53:52.0877 0x10b0 Winmgmt - ok
19:53:53.0001 0x10b0 [ 9CE162EB9057CF079736F4DD00FC0D6C, 412C34557866D2A3B3CDAFA5A03B87C01AACF75E349802E511098B20137028D9 ] WinRM C:\Windows\system32\WsmSvc.dll
19:53:53.0111 0x10b0 WinRM - ok
19:53:53.0173 0x10b0 [ AC263C2F66405589528995AA41040599, 81B46E551D6130A2C3D113EC3B563CEDB5A06BB340986C0E03136CE5BE729481 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
19:53:53.0189 0x10b0 WinUsb - ok
19:53:53.0298 0x10b0 [ 3F5EF31C6AA204B099EE76497DF80A26, CBE648A4E7E1D98A3D8C72582C1CB3C2FD2329EAA24EE4DCAD271AAA6F4D82CE ] WlanSvc C:\Windows\System32\wlansvc.dll
19:53:53.0376 0x10b0 WlanSvc - ok
19:53:53.0455 0x10b0 [ 5F56C0DE776C7AE43AF749845BFAA1EF, 837993C5853B7E682C7FB8401B7F5D951FFD15E5659EBB1B01DC3F5719ACEE19 ] wlidsvc C:\Windows\system32\wlidsvc.dll
19:53:53.0548 0x10b0 wlidsvc - ok
19:53:53.0580 0x10b0 [ 2834D9D3B4F554A39C72F00EA3F0E128, D10124343C67FE9A0B711AD569BB8080495FCEA0ECEF9AC3F3FBD6865F436A44 ] WmiAcpi C:\Windows\System32\drivers\wmiacpi.sys
19:53:53.0595 0x10b0 WmiAcpi - ok
19:53:53.0627 0x10b0 [ 7AFAC828F52D62F304A911EC32F42EEE, 4EDCF4149069413A166169F2E23F7505F47B39B7EC319E1EF6D2C46CD140AA24 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
19:53:53.0642 0x10b0 wmiApSrv - ok
19:53:53.0673 0x10b0 WMPNetworkSvc - ok
19:53:53.0720 0x10b0 [ 7FC5667DF73D4B04AA457CC3A4180E09, CB7B014945DCA16B6D120DBE0E5876C4C867A4ACD3C3536AEADC14B908613D4E ] Wof C:\Windows\system32\drivers\Wof.sys
19:53:53.0736 0x10b0 Wof - ok
19:53:53.0814 0x10b0 [ 61BF52E9FFAB27A0B6D621BE26088373, 81291D52C381360E69D51E7DEB05CFAC651A7E9EF781CA23062C0583D0C94708 ] workfolderssvc C:\Windows\system32\workfolderssvc.dll
19:53:53.0939 0x10b0 workfolderssvc - ok
19:53:53.0970 0x10b0 [ 182561A14F2E93E81E66FE3700D17A5A, FB9A06058A8BCCEDCDC5BF8899D9B2FBA5752C262C5FC6D2B8338884F3303D12 ] wpcfltr C:\Windows\system32\DRIVERS\wpcfltr.sys
19:53:53.0986 0x10b0 wpcfltr - ok
19:53:54.0017 0x10b0 [ 4E6A0F60DA7EF050D3D26417CD4D24E9, E6B3BFB007B641D41F8532ED086F92CB3D86E210023DBFAA9AD8152A9FD33CCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
19:53:54.0033 0x10b0 WPCSvc - ok
19:53:54.0048 0x10b0 [ 618A19EB31ECA7B7F2AA0207BAF598A5, CB18CF9B781EAB3D775F8201F294A7135E058D6C963D2CC759DCA14D95EED538 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
19:53:54.0080 0x10b0 WPDBusEnum - ok
19:53:54.0111 0x10b0 [ 9F2904B55F6CECCD1A8D986B5CE2609A, E19ED4DD3CEF3A22C058FC324824604FB3FC98A029C94E6C2A3389F938D680B6 ] WpdUpFltr C:\Windows\system32\drivers\WpdUpFltr.sys
19:53:54.0142 0x10b0 WpdUpFltr - ok
19:53:54.0142 0x10b0 [ AE072B0339D0A18E455DC21666CAD572, AB1DAEA25E2C7AD610818D4B4783F6D4190D85EBB3963BBAD410E8CEA7899EDB ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
19:53:54.0173 0x10b0 ws2ifsl - ok
19:53:54.0205 0x10b0 [ 9654DE19551093CD73874281E1573C94, 5E3513EC0CB180D90904BE8970AB64A4434279E8C467AE2CF693254E47B1D11E ] wscsvc C:\Windows\System32\wscsvc.dll
19:53:54.0252 0x10b0 wscsvc - ok
19:53:54.0267 0x10b0 [ F586F3F1BF962FE9AE4316E0D896B22F, 8D0AD48D79294567123D943D0F5B6D5A32D7A82B129A24DC821D3095AFAA100B ] WSDPrintDevice C:\Windows\System32\drivers\WSDPrint.sys
19:53:54.0298 0x10b0 WSDPrintDevice - ok
19:53:54.0298 0x10b0 WSearch - ok
19:53:54.0408 0x10b0 [ 95B6670E6933E1DEE19686C55BE709A0, 4B9EB8F1712B7959A71F6DA445D29BD09B25EEFC6B30D736EFE30163D79B233E ] WSService C:\Windows\System32\WSService.dll
19:53:54.0580 0x10b0 WSService - ok
19:53:54.0736 0x10b0 [ DCD090318EC800CF6275C6835900B0C6, 9E72762EEE46CC0606B909850E6D22E9C8E5C88E82F7C974B2B7C1E5160BEBA7 ] wuauserv C:\Windows\system32\wuaueng.dll
19:53:54.0892 0x10b0 wuauserv - ok
19:53:54.0923 0x10b0 [ D537815E450A149752C15868392AD1F3, 8788CE493349299DB36E409C8CC3C6EA08301FA492C95D9D556E00BC13A05F13 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
19:53:54.0939 0x10b0 WudfPf - ok
19:53:54.0955 0x10b0 [ 7CCBBCEE408A5DBE3FE47297DB5A6CFC, FB44B65B37B1C1A12C618E16BEF195EF861A87179B9216E43024C671C3AE052C ] WUDFRd C:\Windows\System32\drivers\WUDFRd.sys
19:53:54.0986 0x10b0 WUDFRd - ok
19:53:55.0002 0x10b0 [ 9CDC2059A23E3C9B57696178508777E7, B680A2E2EDA5C8C6A547E7D9B2F2F8E6407C3EA0A01B82A4B88D48A27913A597 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
19:53:55.0017 0x10b0 wudfsvc - ok
19:53:55.0033 0x10b0 [ 7CCBBCEE408A5DBE3FE47297DB5A6CFC, FB44B65B37B1C1A12C618E16BEF195EF861A87179B9216E43024C671C3AE052C ] WUDFWpdFs C:\Windows\system32\DRIVERS\WUDFRd.sys
19:53:55.0033 0x10b0 WUDFWpdFs - ok
19:53:55.0048 0x10b0 [ 7CCBBCEE408A5DBE3FE47297DB5A6CFC, FB44B65B37B1C1A12C618E16BEF195EF861A87179B9216E43024C671C3AE052C ] WUDFWpdMtp C:\Windows\system32\DRIVERS\WUDFRd.sys
19:53:55.0048 0x10b0 WUDFWpdMtp - ok
19:53:55.0095 0x10b0 [ 2FA9794CA36147756F3FDFD6CA29B46F, 4B86DC38C2411C281686E9A4E64DA6FB2992E39391371F78E012D6D8BB85123F ] WwanSvc C:\Windows\System32\wwansvc.dll
19:53:55.0111 0x10b0 WwanSvc - ok
19:53:55.0111 0x10b0 ================ Scan global ===============================
19:53:55.0158 0x10b0 [ C89780A6F58D113C28A96D85D1261DC5, 185114F33A60916C7904E4A0F278CA43258454343E614F01F0DAFA98BAC981B1 ] C:\Windows\system32\basesrv.dll
19:53:55.0189 0x10b0 [ 00DD4D2ACC2E72155A8AAA82018BEC0D, 9D7CA68B4A81240477FCC85A3CC11EF986093F9D6228A6C5AC608EDAD664068C ] C:\Windows\system32\winsrv.dll
19:53:55.0220 0x10b0 [ 9C1833ABD62876856836C5AE55C7CE86, 0A21E2C8B2FF3B0438C86DA7151A548F9C6F5C62CD402CBBEDB435994C8508F1 ] C:\Windows\system32\sxssrv.dll
19:53:55.0283 0x10b0 [ 067CB90C277DB4A737D5DEABA3055972, C681BF013170F2D92A3FC4D783FC3F200CDC0C8173373B7ECC27FCF32A03CCBD ] C:\Windows\system32\services.exe
19:53:55.0298 0x10b0 [ Global ] - ok
19:53:55.0314 0x10b0 ================ Scan MBR ==================================
19:53:55.0345 0x10b0 [ BAF7E83D7646387A296B4B5C8A512525 ] \Device\Harddisk0\DR0
19:53:55.0642 0x10b0 \Device\Harddisk0\DR0 - ok
19:53:55.0658 0x10b0 [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR1
19:53:55.0877 0x10b0 \Device\Harddisk1\DR1 - ok
19:53:55.0877 0x10b0 ================ Scan VBR ==================================
19:53:55.0877 0x10b0 [ 51C4CF5B5A47D3E39668B9779289EF09 ] \Device\Harddisk0\DR0\Partition1
19:53:55.0955 0x10b0 \Device\Harddisk0\DR0\Partition1 - ok
19:53:55.0955 0x10b0 [ 7D1B5F31EBB1BD6AF12825B70A5C5D37 ] \Device\Harddisk0\DR0\Partition2
19:53:56.0017 0x10b0 \Device\Harddisk0\DR0\Partition2 - ok
19:53:56.0048 0x10b0 [ 05632B556E5AA83A8ACDFCBF100FED80 ] \Device\Harddisk1\DR1\Partition1
19:53:56.0142 0x10b0 \Device\Harddisk1\DR1\Partition1 - ok
19:53:56.0158 0x10b0 [ 43133062AEB203AAD05C57930E0C19E5 ] \Device\Harddisk1\DR1\Partition2
19:53:56.0220 0x10b0 \Device\Harddisk1\DR1\Partition2 - ok
19:53:56.0236 0x10b0 [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk1\DR1\Partition3
19:53:56.0236 0x10b0 \Device\Harddisk1\DR1\Partition3 - ok
19:53:56.0252 0x10b0 [ FB25779A9723A63273DA90A98F701282 ] \Device\Harddisk1\DR1\Partition4
19:53:56.0330 0x10b0 \Device\Harddisk1\DR1\Partition4 - ok
19:53:56.0361 0x10b0 [ 4B7F9D8DBB47463F5E556BA7D88AFE71 ] \Device\Harddisk1\DR1\Partition5
19:53:56.0392 0x10b0 \Device\Harddisk1\DR1\Partition5 - ok
19:53:56.0392 0x10b0 ================ Scan generic autorun ======================
19:53:56.0455 0x10b0 [ D31CE5E6AAB2EDAE45E84FCC60814D97, 5C6D0B91F3F49AB6B9284B769ED905FDA2362DF6A1CF725BBD4C2AE2F5F376EB ] C:\Windows\system32\igfxtray.exe
19:53:56.0502 0x10b0 IgfxTray - ok
19:53:56.0517 0x10b0 [ 85F94C6528AF5855CE38C6852A215A76, 81900FCEF15F5FF4DACF82A6F0E30301E1D04B327DC674E97EA2DC4648FD8719 ] C:\Windows\system32\hkcmd.exe
19:53:56.0533 0x10b0 HotKeysCmds - ok
19:53:56.0548 0x10b0 [ 1C0E99738F8C1FE9162B743207A16F5D, E3EF02EDCBA2D4B2D7B069065BE814EDA9D47FB0ABD79A1405292C9EB420EE3C ] C:\Windows\system32\igfxpers.exe
19:53:56.0564 0x10b0 Persistence - ok
19:53:56.0986 0x10b0 [ 0011163AC036C71E03883DD10C626F81, CD1F55C6BC20817F69E76A2B2AB4BA30D175821A3A4EA5A34E285182584518B7 ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
19:53:57.0377 0x10b0 RtHDVCpl - ok
19:53:57.0455 0x10b0 [ 59F8DA04498B80D58FD8638370C5C84F, 522F347F1F1B3991FDC60FF3CE8F8ABB2EDFE65C569D18EF5ACB690FD1BADC82 ] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
19:53:57.0502 0x10b0 RtHDVBg_Dolby - ok
19:53:57.0548 0x10b0 [ 690EB331346D7ADFDA18E50042DEA4B4, 0C219D7A5FCD4E0252C815373E67F843DBD7356FAE7AB836C451068B51438FE7 ] C:\Program Files\Classic Shell\ClassicStartMenu.exe
19:53:57.0658 0x10b0 Classic Start Menu - ok
19:53:57.0658 0x10b0 SynTPEnh - ok
19:53:57.0720 0x10b0 [ 47EA5F76FAB723C61AB4A0D79BAD512C, A7A38EB0A7068B160E6949945EF639F999A06AE35746F6E79C7350745798E5C9 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
19:53:57.0845 0x10b0 Adobe ARM - ok
19:53:58.0033 0x10b0 [ B66E0842FCF485F3E2D41BF0BA10966F, 966B8386B2D060167E8EAAE478509013A8729FE2CF11F890D3F9DCDA90768F34 ] C:\Users\AR\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
19:53:58.0423 0x10b0 Spotify Web Helper - ok
19:53:58.0455 0x10b0 [ CA069983D646BFB6606D9DF844FB7647, 2A5F88BFAEC1858C976D65D0A5E8AA69C3E99CABD2FCBD9DF1B0E7093D6E4E02 ] C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
19:53:58.0533 0x10b0 Sony PC Companion - ok
19:53:58.0533 0x10b0 Waiting for KSN requests completion. In queue: 121
19:53:59.0548 0x10b0 Waiting for KSN requests completion. In queue: 121
19:54:00.0564 0x10b0 Waiting for KSN requests completion. In queue: 121
19:54:01.0580 0x10b0 AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.6.305.0 ), 0x61100 ( enabled : updated )
19:54:01.0580 0x10b0 Win FW state via NFP2: enabled
19:54:03.0955 0x10b0 ============================================================
19:54:03.0955 0x10b0 Scan finished
19:54:03.0955 0x10b0 ============================================================
19:54:03.0955 0x0c60 Detected object count: 0
19:54:03.0955 0x0c60 Actual detected object count: 0
|
|
09.12.2014, 16:02
| #4 |
| /// the machine /// TB-Ausbilder | Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" Wieso kommst Du bei der Meldung auf einen Zusammenhang mit ZBot?? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.12.2014, 00:12
| #5 | |
| | Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren"Zitat:
->cmd ->enter -es öffnet sich wie gewohnt die Kommandozeile *plöp* -Ein breiter streifen mit der Meldung erscheint "Ihr Computer wird in unter einer Minute heruntergefahren" Das passierte mehrmals, also hab ich mal nach der Meldung gegoogelt. Da meinte google das müsse ZBOt sein. BTW. die JRT oder ADWCleaner haben mein classicshell startmenü ersatz weggezaubert.  Ich habe den Laptop erst seit kurzem...auf dem Laptop den ich vorher hatte, hatte ich 2 mal alles verseucht. Bin deswegen auf Ubuntu umgestiegen und hatte danach Ruhe bis ich den Laptop kaputt gemacht habe. Auf dem neuen habe ich noch kein Ubuntu drauf, weil ich den Aufwand gescheut habe win 8.1 und Ubuntu parallel auf einem UEFI Gerät ans laufen zu bringen....(Es hört sich verdammt kompliziert und wage an wenn man sich so Anleitungen durchliest) Und nen Ordentlichen Virenscanner habe ich mir nicht angeschafft, weil ich dachte das ich ja sicher in Kürze sowieso mein Ubuntu wieder hab....  Brauche Win8.1 eigentlich nur für das nächste Starcraft und für delphi...dachte ich...nun bin ich fast wieder hier zuhause. MBAM findet mein System ok Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 09.12.2014 Suchlauf-Zeit: 22:39:43 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2014.12.09.08 Rootkit Datenbank: v2014.12.08.03 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: AR Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 365534 Verstrichene Zeit: 17 Min, 58 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) ADWCleaner hatte erst einen Appcrash HKCU\Software\OCS HKCU64\Software\OCS Hat er stehen gelassen und es kam zu einem Appcrash bei ca 50% des balken. Also kein Neustart. Code:
ATTFilter Problemsignatur:
Problemereignisname: APPCRASH
Anwendungsname: AdwCleaner_4.105.exe
Anwendungsversion: 4.1.0.5
Anwendungszeitstempel: 548627dd
Fehlermodulname: AdwCleaner_4.105.exe
Fehlermodulversion: 4.1.0.5
Fehlermodulzeitstempel: 548627dd
Ausnahmecode: c0000005
Ausnahmeoffset: 0001eeaa
Betriebsystemversion: 6.3.9600.2.0.0.768.101
Gebietsschema-ID: 1031
Zusatzinformation 1: 5861
Zusatzinformation 2: 5861822e1919d7c014bbb064c64908b2
Zusatzinformation 3: 84a0
Zusatzinformation 4: 84a09ea102a12ee665c500221db8c9d6
AdwCleaner Logfile: AdwCleaner Logfile: AdwCleaner Logfile: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v4.105 - Bericht erstellt am 09/12/2014 um 23:25:08
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-08.2 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : AR - ONYX
# Gestartet von : C:\Users\AR\Desktop\AdwCleaner_4.105.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\AR\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\AR\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\foxydeal.sqlite
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKCU64\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : HKLM64\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Habe ADWCleaner dann nochmal probiert und es ging  Code:
ATTFilter # AdwCleaner v4.105 - Bericht erstellt am 09/12/2014 um 23:34:57
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-08.2 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : AR - ONYX
# Gestartet von : C:\Users\AR\Desktop\AdwCleaner_4.105.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v34.0 (x86 de)
-\\ Google Chrome v39.0.2171.71
*************************
AdwCleaner[R0].txt - [1894 octets] - [09/12/2014 23:24:05]
AdwCleaner[R1].txt - [985 octets] - [09/12/2014 23:31:06]
AdwCleaner[S0].txt - [1122 octets] - [09/12/2014 23:25:08]
AdwCleaner[S1].txt - [861 octets] - [09/12/2014 23:34:57]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [920 octets] ##########
--- --- --- --- --- --- --- --- --- --- --- --- [/CODE] JRT lief auch gut JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows 8.1 x64
Ran by AR on 09.12.2014 at 23:42:16,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\AR\AppData\Roaming\mozilla\firefox\profiles\7wl2ztw7.default\minidumps [2 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.12.2014 at 23:45:29,83
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 02 Ran by AR (administrator) on ONYX on 09-12-2014 23:47:49 Running from C:\Users\AR\Desktop Loaded Profiles: UpdatusUser & AR (Available profiles: UpdatusUser & AR) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe (Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe (Embarcadero Technologies, Inc.) C:\Delphi\InterBaseXE3\bin\ibguard.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe (Embarcadero Technologies, Inc.) C:\Delphi\InterBaseXE3\bin\ibserver.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QASvc.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\RMSvc.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAEvent.exe (Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QAMsg.exe (Acer Incorporate) C:\Program Files\Acer\Acer Quick Access\QuickAccess.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Dolby Laboratories Inc.) C:\Program Files\Dolby Digital Plus\ddp.exe (Spotify Ltd) C:\Users\AR\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Dropbox, Inc.) C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13647576 2013-08-27] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor) HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2773232 2014-09-16] (Synaptics Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [133760 2013-12-24] ( (Atheros Communications)) HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Run: [Spotify Web Helper] => C:\Users\AR\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-11] (Spotify Ltd) HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [468192 2014-10-15] (Sony) HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\MountPoints2: {b635b6dc-40df-11e4-825f-202564942c7c} - "G:\Startme.exe" HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\MountPoints2: {f42be8b0-cace-11e3-8252-806e6f6e6963} - "D:\wubi.exe" Startup: C:\Users\AR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=ACJB HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB URLSearchHook: [S-1-5-21-1591653119-3682044142-3444803271-1001] ATTENTION ==> Default URLSearchHook is missing. SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1591653119-3682044142-3444803271-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002 -> {43A9E85B-6778-4F9C-94DA-3471D0EC462D} URL = BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll (IvoSoft) BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: PDF Architect Helper -> {691B33B0-B86E-47F3-81C7-56E4FE3B929C} -> C:\Program Files (x86)\PDF Architect 2\creator-ie-helper.dll (pdfforge GmbH) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files (x86)\PDF Architect 2\creator-ie-plugin.dll (pdfforge GmbH) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default FF DefaultSearchEngine: Startpage HTTPS - Deutsch FF SelectedSearchEngine: Startpage HTTPS - Deutsch FF Homepage: https://startpage.com/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll (pdfforge GmbH) FF Plugin HKU\S-1-5-21-1591653119-3682044142-3444803271-1002: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll (Sony Network Entertainment International LLC) FF SearchPlugin: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\searchplugins\google-maps.xml FF SearchPlugin: C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\searchplugins\startpage-https---deutsch.xml FF Extension: FoxVox - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\foxvox@wordit.com [2014-09-28] FF Extension: HTTPS-Everywhere - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\https-everywhere@eff.org [2014-10-16] FF Extension: Lightbeam - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2014-09-20] FF Extension: Adblock Plus - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-17] FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_2_conv@pdfarchitect.org] - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension FF Extension: PDF Architect 2 Creator - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension [2014-12-02] FF HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\AR\AppData\Roaming\Mozilla\Firefox\Profiles\7wl2ztw7.default\extensions\cliqz@cliqz.com Chrome: ======= CHR Profile: C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-21] CHR Extension: (Google Docs) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-21] CHR Extension: (Google Drive) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-21] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-21] CHR Extension: (YouTube) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-21] CHR Extension: (Google-Suche) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-21] CHR Extension: (Google Tabellen) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-21] CHR Extension: (Google Wallet) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-21] CHR Extension: (Google Mail) - C:\Users\AR\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-21] CHR HKLM-x32\...\Chrome\Extension: [ihenkjeihefokohmemphikjnjbmegdik] - "C:\Program Files (x86)\Sony\Media Go\MediaGoDetector.crx" [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [318592 2013-12-24] (Windows (R) Win 7 DDK provider) R2 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [3058944 2014-08-06] (Acer Incorporated) R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2577640 2013-12-04] (Acer Incorporated) R2 IBG_gds_db; C:\Delphi\InterBaseXE3\bin\ibguard.exe [636744 2014-03-24] (Embarcadero Technologies, Inc.) R3 IBS_gds_db; C:\Delphi\InterBaseXE3\bin\ibserver.exe [5487944 2014-03-24] (Embarcadero Technologies, Inc.) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation) R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [459496 2013-11-23] (Acer Incorporate) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-07] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-07] (McAfee, Inc.) S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH) R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH) S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH) R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [457768 2013-08-02] (Acer Incorporate) R3 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [448040 2013-08-02] (Acer Incorporate) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation) S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\siteadvisor\mcsacore.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3881472 2013-12-12] (Qualcomm Atheros Communications, Inc.) S3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-12-24] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-08-07] (McAfee, Inc.) R2 Ext2Fsd; C:\Windows\system32\Drivers\Ext2Fsd.sys [771224 2014-08-26] (www.ext2fsd.com) R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-09] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation) S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-07] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-07] (McAfee, Inc.) S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69264 2013-08-07] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-07] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-07] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-07] (McAfee, Inc.) R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-01] (Synaptics Incorporated) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-09 23:45 - 2014-12-09 23:45 - 00000739 _____ () C:\Users\AR\Desktop\JRT.txt 2014-12-09 23:42 - 2014-12-09 23:42 - 00000000 ____D () C:\Windows\ERUNT 2014-12-09 23:38 - 2014-12-09 23:38 - 00000999 _____ () C:\Users\AR\Desktop\AdwCleaner[S1].txt 2014-12-09 23:30 - 2014-12-09 23:34 - 00000725 _____ () C:\Users\AR\Desktop\Appcrash.txt 2014-12-09 23:24 - 2014-12-09 23:34 - 00000000 ____D () C:\AdwCleaner 2014-12-09 23:18 - 2014-12-09 23:18 - 00001185 _____ () C:\Users\AR\Desktop\mbam.txt 2014-12-09 22:38 - 2014-12-09 23:37 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-09 22:38 - 2014-12-09 22:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-12-09 22:37 - 2014-12-09 22:38 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-12-09 22:37 - 2014-12-09 22:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-09 22:37 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-09 22:37 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-09 22:37 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-09 22:36 - 2014-12-09 22:31 - 01707646 _____ (Thisisu) C:\Users\AR\Desktop\JRT.exe 2014-12-09 22:36 - 2014-12-09 22:28 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\AR\Desktop\mbam-setup-2.0.4.1028.exe 2014-12-09 22:30 - 2014-12-09 22:31 - 01707646 _____ (Thisisu) C:\Users\AR\Downloads\JRT.exe 2014-12-09 22:30 - 2014-12-09 22:30 - 02166272 _____ () C:\Users\AR\Desktop\AdwCleaner_4.105.exe 2014-12-09 22:27 - 2014-12-09 22:28 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\AR\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-08 19:48 - 2014-12-08 19:50 - 04184008 _____ (Kaspersky Lab ZAO) C:\Users\AR\Desktop\tdsskiller.exe 2014-12-08 03:11 - 2014-12-08 03:18 - 00003940 _____ () C:\Users\AR\Desktop\gmer.log 2014-12-08 03:02 - 2014-12-08 03:02 - 00000951 _____ () C:\Users\AR\Downloads\anleitung.txt 2014-12-08 03:01 - 2014-12-08 03:01 - 00380416 _____ () C:\Users\AR\Desktop\gm.exe 2014-12-08 02:51 - 2014-12-08 02:52 - 00053803 _____ () C:\Users\AR\Desktop\Addition.txt 2014-12-08 02:50 - 2014-12-09 23:47 - 00020223 _____ () C:\Users\AR\Desktop\FRST.txt 2014-12-08 02:50 - 2014-12-09 23:47 - 00000000 ____D () C:\FRST 2014-12-08 02:48 - 2014-12-08 02:49 - 02119680 _____ (Farbar) C:\Users\AR\Desktop\FRST64.exe 2014-12-08 02:46 - 2014-12-08 02:46 - 00000466 _____ () C:\Users\AR\Desktop\defogger_disable.log 2014-12-08 02:46 - 2014-12-08 02:46 - 00000000 _____ () C:\Users\AR\defogger_reenable 2014-12-08 02:45 - 2014-12-08 02:45 - 00050477 _____ () C:\Users\AR\Desktop\Defogger.exe 2014-12-07 23:55 - 2014-12-07 23:55 - 03640880 _____ () C:\Users\AR\Downloads\avg_remover_zbot.exe 2014-12-07 23:31 - 2014-12-07 23:31 - 00000000 ____D () C:\Users\AR\AppData\Local\Intel_Corporation 2014-12-07 23:28 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-12-07 23:28 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-12-07 22:27 - 2014-12-07 23:33 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-12-07 22:27 - 2014-12-07 22:27 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-12-07 22:27 - 2014-12-07 22:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-12-07 22:27 - 2014-12-07 22:27 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-12-07 22:21 - 2014-12-07 22:25 - 31036328 _____ (Oracle Corporation) C:\Users\AR\Downloads\jre-7u72-windows-x64.exe 2014-12-04 23:22 - 2014-12-05 01:42 - 177856928 _____ (Oracle Corporation) C:\Users\AR\Downloads\jdk-8u25-windows-x64.exe 2014-12-04 20:44 - 2014-12-04 20:44 - 00000911 _____ () C:\Users\AR\Desktop\eclipse - Verknüpfung.lnk 2014-12-02 14:36 - 2014-12-02 14:36 - 00000000 ____D () C:\Users\AR\AppData\Roaming\PDF Architect 2 2014-12-02 14:34 - 2014-12-02 14:34 - 00000000 ____D () C:\Users\AR\AppData\Local\PDFCreator 2014-12-02 14:30 - 2014-12-02 14:30 - 00000993 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk 2014-12-02 14:29 - 2014-12-02 14:30 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2 2014-12-02 14:29 - 2014-12-02 14:29 - 00000000 ____D () C:\Users\AR\Documents\PDF Architect 2 2014-12-02 14:29 - 2014-12-02 14:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2 2014-12-02 14:27 - 2014-12-02 14:31 - 00000000 ____D () C:\Program Files\PDFCreator 2014-12-02 14:27 - 2014-12-02 14:27 - 00113848 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll 2014-12-02 14:27 - 2014-12-02 14:27 - 00000852 _____ () C:\Users\Public\Desktop\PDFCreator.lnk 2014-12-02 14:27 - 2014-12-02 14:27 - 00000000 ____D () C:\ProgramData\PDF Architect 2 2014-12-02 14:27 - 2014-12-02 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator 2014-12-02 14:25 - 2014-12-02 14:26 - 27276128 _____ (pdfforge ) C:\Users\AR\Downloads\PDFCreator-2_0_0-setup.exe 2014-12-02 14:05 - 2014-12-02 14:05 - 00065345 _____ () C:\Users\AR\Downloads\jarfix.exe 2014-12-01 22:49 - 2014-12-01 22:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-29 11:50 - 2014-12-07 22:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit 2014-11-29 11:50 - 2014-12-07 22:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-11-29 11:50 - 2014-11-29 13:11 - 00000000 ____D () C:\ProgramData\Oracle 2014-11-29 11:50 - 2014-11-29 11:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-11-29 11:50 - 2014-11-29 11:50 - 00000000 ____D () C:\Program Files (x86)\Java 2014-11-29 11:47 - 2014-11-29 11:47 - 00638888 _____ (Oracle Corporation) C:\Users\AR\Downloads\jxpiinstall.exe 2014-11-29 11:43 - 2014-11-29 12:01 - 370763706 _____ () C:\Users\AR\Downloads\adt-bundle-windows-x86_64-20140702.zip 2014-11-27 21:13 - 2014-11-27 21:13 - 07693351 _____ () C:\Users\AR\Downloads\hibiscus.zip 2014-11-25 22:11 - 2014-11-25 22:11 - 00000000 ____D () C:\ProgramData\Samsung 2014-11-25 22:11 - 2014-11-25 22:11 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate 2014-11-25 20:20 - 2014-12-09 22:27 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-11-25 20:20 - 2014-11-25 20:35 - 00000000 ____D () C:\ProgramData\Adobe 2014-11-25 20:20 - 2014-11-25 20:20 - 00002003 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk 2014-11-25 20:20 - 2014-11-25 20:20 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-11-25 19:28 - 2014-11-25 19:28 - 00001156 _____ () C:\Users\AR\Desktop\Helden-Software.lnk 2014-11-24 23:01 - 2014-11-25 01:32 - 00000000 ____D () C:\Users\AR\Documents\Beruflich 2014-11-23 00:17 - 2014-11-23 00:17 - 00001317 _____ () C:\Users\AR\Bildbestellung.html 2014-11-21 21:22 - 2014-11-27 21:25 - 00002159 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-11-21 21:22 - 2014-11-21 21:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-11-21 21:19 - 2014-12-09 23:37 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-11-21 21:19 - 2014-12-09 23:24 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-11-21 21:19 - 2014-11-21 21:22 - 00000000 ____D () C:\Users\AR\AppData\Local\Google 2014-11-21 21:19 - 2014-11-21 21:22 - 00000000 ____D () C:\Program Files (x86)\Google 2014-11-21 21:19 - 2014-11-21 21:19 - 00880784 _____ (Google Inc.) C:\Users\AR\Downloads\ChromeSetup.exe 2014-11-21 21:19 - 2014-11-21 21:19 - 00004084 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-21 21:19 - 2014-11-21 21:19 - 00003848 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-18 21:42 - 2014-11-10 00:19 - 00991232 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-18 21:42 - 2014-11-10 00:19 - 00806400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-18 21:42 - 2014-11-10 00:18 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2014-11-18 21:42 - 2014-11-10 00:18 - 00208896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2014-11-14 21:05 - 2014-11-14 21:05 - 00000000 __SHD () C:\Users\AR\AppData\Local\EmieBrowserModeList 2014-11-12 20:30 - 2014-11-20 21:51 - 00106976 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-11 22:22 - 2014-10-10 02:58 - 00177472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-11-11 22:22 - 2014-10-10 02:58 - 00027456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys 2014-11-11 22:22 - 2014-10-10 02:44 - 00563976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2014-11-11 22:22 - 2014-10-08 08:37 - 00736768 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2014-11-11 22:22 - 2014-10-08 08:37 - 00154112 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2014-11-11 22:22 - 2014-10-08 08:34 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2014-11-11 22:22 - 2014-10-08 08:24 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\rfxvmt.dll 2014-11-11 22:22 - 2014-10-08 07:56 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2014-11-11 22:22 - 2014-10-08 07:51 - 00736768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2014-11-11 22:22 - 2014-10-08 07:51 - 00154112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2014-11-11 22:22 - 2014-10-08 07:18 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2014-11-11 22:22 - 2014-10-08 07:17 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-11-11 22:22 - 2014-10-08 06:23 - 03547648 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2014-11-11 22:22 - 2014-09-27 08:13 - 00104336 _____ (Microsoft Corporation) C:\Windows\system32\ncryptsslp.dll 2014-11-11 22:22 - 2014-09-27 06:24 - 00088800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptsslp.dll 2014-11-11 22:22 - 2014-09-27 04:38 - 00426496 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-11-11 22:22 - 2014-09-27 04:30 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll 2014-11-11 22:22 - 2014-09-27 04:17 - 00357376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-11-11 22:21 - 2014-10-18 10:55 - 00055776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-11-11 22:21 - 2014-10-18 09:09 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-11-11 22:21 - 2014-10-18 09:09 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-11-11 22:21 - 2014-10-18 08:25 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-11-11 22:21 - 2014-10-18 07:50 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\wuaext.dll 2014-11-11 22:21 - 2014-10-18 07:38 - 03557376 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-11-11 22:21 - 2014-10-18 07:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-11-11 22:21 - 2014-10-18 07:26 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-11-11 22:21 - 2014-10-18 07:23 - 00407552 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2014-11-11 22:21 - 2014-10-18 07:23 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-11-11 22:21 - 2014-10-18 07:21 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-11-11 22:21 - 2014-10-18 07:20 - 01714176 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-11-11 22:21 - 2014-10-18 07:14 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-11-11 22:21 - 2014-10-18 07:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-11-11 22:21 - 2014-10-18 07:12 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-11-11 22:21 - 2014-10-18 07:11 - 00723968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-11-11 22:20 - 2014-10-31 06:28 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-11-11 22:20 - 2014-10-31 04:42 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-11-11 22:20 - 2014-09-22 05:38 - 01519488 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll 2014-11-11 22:20 - 2014-09-22 04:06 - 00258368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys 2014-11-11 22:20 - 2014-09-22 04:06 - 00114496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys 2014-11-11 22:20 - 2014-09-22 03:49 - 00035320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys 2014-11-11 22:20 - 2014-09-19 01:16 - 01346048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll 2014-11-11 22:20 - 2014-09-02 23:08 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\winshfhc.dll 2014-11-11 22:20 - 2014-09-02 23:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winshfhc.dll 2014-11-11 22:19 - 2014-10-31 06:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-11-11 22:19 - 2014-10-31 06:12 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-11-11 22:19 - 2014-10-31 06:10 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-11-11 22:19 - 2014-10-31 06:09 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-11-11 22:19 - 2014-10-31 06:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-11-11 22:19 - 2014-10-31 06:06 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-11-11 22:19 - 2014-10-31 06:06 - 00237568 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-11-11 22:19 - 2014-10-31 06:06 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-11-11 22:19 - 2014-10-31 06:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-11-11 22:19 - 2014-10-31 06:05 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-11-11 22:19 - 2014-10-31 06:05 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-11-11 22:19 - 2014-10-31 06:04 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-11-11 22:19 - 2014-10-31 05:57 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-11-11 22:19 - 2014-10-31 05:56 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-11-11 22:19 - 2014-10-31 05:54 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-11-11 22:19 - 2014-10-31 05:53 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-11-11 22:19 - 2014-10-31 05:52 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll 2014-11-11 22:19 - 2014-10-31 05:51 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-11-11 22:19 - 2014-10-31 05:51 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-11-11 22:19 - 2014-10-31 05:51 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-11-11 22:19 - 2014-10-31 05:50 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-11-11 22:19 - 2014-10-31 05:50 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-11-11 22:19 - 2014-10-31 05:40 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-11-11 22:19 - 2014-10-31 05:38 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-11-11 22:19 - 2014-10-31 05:30 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-11-11 22:19 - 2014-10-31 05:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-11-11 22:19 - 2014-10-31 05:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-11-11 22:19 - 2014-10-31 05:28 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-11-11 22:19 - 2014-10-31 05:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-11-11 22:19 - 2014-10-31 05:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-11-11 22:19 - 2014-10-31 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-11-11 22:19 - 2014-10-31 05:23 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-11-11 22:19 - 2014-10-31 05:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-11-11 22:19 - 2014-10-31 05:19 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-11-11 22:19 - 2014-10-31 05:15 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2014-11-11 22:19 - 2014-10-31 05:08 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-11-11 22:19 - 2014-10-31 05:06 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-11-11 22:19 - 2014-10-31 05:05 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-11-11 22:19 - 2014-10-31 05:05 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-11-11 22:19 - 2014-10-31 05:03 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-11-11 22:19 - 2014-10-31 04:59 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-11-11 22:19 - 2014-10-31 04:45 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-11-11 22:19 - 2014-10-31 04:44 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2014-11-11 22:19 - 2014-10-31 04:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-11-11 22:19 - 2014-10-31 04:32 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-11-11 22:19 - 2014-10-31 04:28 - 00137728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2014-11-11 22:19 - 2014-10-31 04:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-11-11 22:19 - 2014-10-31 04:27 - 00152064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2014-11-11 22:19 - 2014-10-31 04:26 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2014-11-11 22:19 - 2014-10-31 04:25 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-11-11 22:19 - 2014-10-31 04:24 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-11-11 22:19 - 2014-10-31 04:24 - 00235520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-11-11 22:19 - 2014-10-31 04:24 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-11-11 22:19 - 2014-10-31 04:23 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2014-11-11 22:19 - 2014-10-31 04:23 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-11-11 22:19 - 2014-10-31 04:22 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-11-11 22:19 - 2014-10-31 04:20 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-11-11 22:19 - 2014-10-31 04:18 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-11-11 22:19 - 2014-10-31 04:16 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-11-11 22:19 - 2014-10-31 04:15 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-11-11 22:19 - 2014-10-31 04:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2014-11-11 22:19 - 2014-10-31 04:13 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-11-11 22:19 - 2014-10-31 04:13 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll 2014-11-11 22:19 - 2014-10-31 04:12 - 00661504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-11-11 22:19 - 2014-10-31 04:12 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-11-11 22:19 - 2014-10-31 04:11 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-11-11 22:19 - 2014-10-31 04:03 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2014-11-11 22:19 - 2014-10-31 04:02 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-11-11 22:19 - 2014-10-31 03:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-11-11 22:19 - 2014-10-31 03:56 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2014-11-11 22:19 - 2014-10-31 03:56 - 00090624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-11-11 22:19 - 2014-10-31 03:56 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2014-11-11 22:19 - 2014-10-31 03:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-11-11 22:19 - 2014-10-31 03:53 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-11-11 22:19 - 2014-10-31 03:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-11-11 22:19 - 2014-10-31 03:51 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2014-11-11 22:19 - 2014-10-31 03:50 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-11-11 22:19 - 2014-10-31 03:48 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2014-11-11 22:19 - 2014-10-31 03:46 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-11-11 22:19 - 2014-10-31 03:46 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2014-11-11 22:19 - 2014-10-31 03:42 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2014-11-11 22:19 - 2014-10-31 03:40 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-11-11 22:19 - 2014-10-31 03:40 - 00325632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-11-11 22:19 - 2014-10-31 03:39 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-11-11 22:19 - 2014-10-31 03:30 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-11-11 22:19 - 2014-10-31 03:26 - 01042944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll 2014-11-11 22:19 - 2014-10-31 03:24 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2014-11-11 22:19 - 2014-10-31 03:17 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-11-11 22:19 - 2014-10-31 03:13 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-11-11 22:19 - 2014-10-31 03:11 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-11-11 22:19 - 2014-10-07 07:28 - 00500016 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2014-11-11 22:19 - 2014-10-07 07:27 - 00482872 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2014-11-11 22:19 - 2014-10-07 07:27 - 00394120 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2014-11-11 22:19 - 2014-10-07 07:27 - 00272248 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe 2014-11-11 22:19 - 2014-10-07 07:27 - 00108432 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2014-11-11 22:19 - 2014-10-07 04:34 - 00370424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2014-11-11 22:19 - 2014-10-07 04:34 - 00344536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2014-11-11 22:19 - 2014-10-07 04:33 - 00424544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2014-11-11 22:19 - 2014-10-07 04:30 - 04182016 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-11-11 22:19 - 2014-10-07 02:54 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll 2014-11-11 22:19 - 2014-10-07 02:46 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-11-11 22:19 - 2014-08-31 01:15 - 21197152 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-11-11 22:19 - 2014-08-30 23:59 - 18723112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-11-11 22:19 - 2014-08-28 03:55 - 07484224 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-11-11 22:19 - 2014-08-23 05:50 - 02714112 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll 2014-11-11 22:18 - 2014-10-13 03:33 - 00116032 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-11-11 22:18 - 2014-10-11 01:58 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-11-11 22:18 - 2014-10-11 01:53 - 03607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-11-11 22:18 - 2014-10-08 08:30 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll 2014-11-11 22:18 - 2014-10-08 08:09 - 00428032 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-11-11 22:18 - 2014-10-08 07:27 - 00325120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-11-11 22:18 - 2014-10-08 06:32 - 02773504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-11-11 22:18 - 2014-10-08 06:19 - 02459136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-11-11 22:18 - 2014-09-10 07:25 - 00474432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-11-11 22:18 - 2014-09-08 04:07 - 02497344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-11-11 22:18 - 2014-09-08 04:07 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-11-11 22:18 - 2014-09-07 23:08 - 00389176 _____ () C:\Windows\system32\ApnDatabase.xml 2014-11-11 22:18 - 2014-09-04 23:30 - 00822272 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-11-11 22:18 - 2014-09-04 23:21 - 01053184 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2014-11-11 22:18 - 2014-09-04 04:05 - 00836176 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll 2014-11-11 22:18 - 2014-09-04 03:22 - 00670384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll 2014-11-11 22:18 - 2014-09-04 02:01 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll 2014-11-11 22:18 - 2014-09-04 01:32 - 00334336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll 2014-11-11 22:18 - 2014-08-31 01:17 - 00148800 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS 2014-11-11 22:18 - 2014-08-30 23:05 - 00615424 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOMEX.dll 2014-11-11 22:18 - 2014-08-30 22:58 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll 2014-11-11 22:18 - 2014-08-30 22:04 - 00941568 _____ (Microsoft Corporation) C:\Windows\system32\MFMediaEngine.dll 2014-11-11 22:18 - 2014-08-30 21:53 - 00239104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FXSAPI.dll 2014-11-11 22:18 - 2014-08-30 21:17 - 00799744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFMediaEngine.dll 2014-11-11 22:18 - 2014-08-28 01:21 - 02480128 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-11-11 22:18 - 2014-08-28 01:06 - 02030592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-11-11 22:18 - 2014-08-23 06:14 - 13424128 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll 2014-11-11 22:18 - 2014-08-23 06:04 - 11820544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll 2014-11-11 22:18 - 2014-08-02 01:51 - 00545792 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll 2014-11-11 22:18 - 2014-08-02 01:35 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll 2014-11-11 22:17 - 2014-10-23 06:48 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-11-11 22:17 - 2014-10-23 06:05 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-11-11 22:17 - 2014-10-17 08:01 - 00789184 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2014-11-11 22:17 - 2014-10-17 07:58 - 00602768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2014-11-11 22:17 - 2014-08-23 06:18 - 02149376 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-11-11 22:17 - 2014-08-23 06:03 - 01346048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-09 23:48 - 2014-09-12 21:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-09 23:42 - 2014-09-12 18:41 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1591653119-3682044142-3444803271-1002 2014-12-09 23:41 - 2014-09-12 19:22 - 00000000 ____D () C:\Users\AR\AppData\Roaming\ClassicShell 2014-12-09 23:40 - 2014-04-23 21:02 - 00765582 _____ () C:\Windows\system32\perfh007.dat 2014-12-09 23:40 - 2014-04-23 21:02 - 00159366 _____ () C:\Windows\system32\perfc007.dat 2014-12-09 23:40 - 2014-01-27 12:17 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-09 23:37 - 2014-09-14 10:36 - 00000000 ___RD () C:\Users\AR\Dropbox 2014-12-09 23:37 - 2014-09-14 10:32 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Dropbox 2014-12-09 23:36 - 2014-01-27 12:15 - 00080354 _____ () C:\Windows\PFRO.log 2014-12-09 23:36 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-09 23:35 - 2014-04-23 11:20 - 01360013 _____ () C:\Windows\WindowsUpdate.log 2014-12-09 23:35 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-12-09 23:29 - 2014-09-13 21:58 - 00000000 ____D () C:\Users\AR\AppData\Local\CrashDumps 2014-12-09 23:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2014-12-09 23:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness 2014-12-09 22:48 - 2014-09-12 21:17 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-09 22:35 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2014-12-08 02:46 - 2014-09-12 18:35 - 00000000 ____D () C:\Users\AR 2014-12-07 23:36 - 2014-09-18 22:41 - 00000000 ____D () C:\Users\AR\.android 2014-12-07 23:32 - 2014-09-12 17:46 - 00000000 ____D () C:\Program Files\Java 2014-12-07 22:08 - 2014-09-12 18:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-12-07 22:05 - 2014-09-12 17:13 - 00000000 ____D () C:\Android-SDK 2014-12-02 14:38 - 2014-11-05 18:56 - 00003028 _____ () C:\Users\AR\.heldEinstellungen4_1.xml 2014-12-02 14:38 - 2014-09-12 20:13 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Spotify 2014-12-02 14:24 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-12-02 14:06 - 2014-11-05 18:56 - 00000285 _____ () C:\Users\AR\.dsa4.properties 2014-12-02 14:06 - 2014-11-05 18:56 - 00000000 ____D () C:\Users\AR\helden 2014-12-02 13:55 - 2014-11-03 20:54 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-12-02 13:55 - 2014-11-03 20:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-12-02 13:30 - 2014-09-12 20:13 - 00000000 ____D () C:\Users\AR\AppData\Local\Spotify 2014-12-02 13:26 - 2014-09-20 17:36 - 00002006 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk 2014-12-02 13:26 - 2014-09-20 17:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony 2014-12-02 13:26 - 2014-04-23 11:40 - 00275362 _____ () C:\Windows\DPINST.LOG 2014-12-02 13:25 - 2014-04-23 11:10 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-11-25 20:34 - 2014-09-12 21:03 - 00000000 ____D () C:\Users\AR\AppData\Local\Adobe 2014-11-25 20:34 - 2014-09-12 18:36 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Adobe 2014-11-21 22:12 - 2014-11-02 21:51 - 1024789391 _____ () C:\Users\AR\Rosas 2014.cpr 2014-11-20 21:51 - 2013-08-22 16:38 - 00714208 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-15 04:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2014-11-14 18:56 - 2014-09-14 10:36 - 00001058 _____ () C:\Users\AR\Desktop\Dropbox.lnk 2014-11-14 18:56 - 2014-09-14 10:34 - 00000000 ____D () C:\Users\AR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-11-12 20:29 - 2013-08-22 15:44 - 00413408 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData 2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ImmersiveControlPanel 2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files\Windows Defender 2014-11-12 02:15 - 2013-08-22 16:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-11-11 22:28 - 2014-09-13 03:33 - 00000000 ____D () C:\Windows\system32\MRT 2014-11-11 22:24 - 2014-09-13 03:33 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-11-09 11:22 - 2013-08-22 15:46 - 00028037 _____ () C:\Windows\setupact.log Some content of TEMP: ==================== C:\Users\AR\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppaxqoa.dll C:\Users\AR\AppData\Local\Temp\Quarantine.exe C:\Users\AR\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-09 02:04 ==================== End Of Log ============================ Addition FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 02
Ran by AR at 2014-12-09 23:48:08
Running from C:\Users\AR\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8102 - Acer Incorporated)
Acer Power Management (HKLM\...\{E438A632-CADC-49E4-9492-C9F50F9AE37F}) (Version: 7.01.8100 - Acer Incorporated)
Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.00.3000 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8101 - Acer Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
ALDI NORD Bestellsoftware 4.14.5 (HKLM-x32\...\ALDI NORD Bestellsoftware) (Version: 4.14.5 - ORWO Net)
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.01.2012.1 - Acer Incorporated)
BDE_ENT (x32 Version: 5.1.1 - Borland Software Corp.) Hidden
Classic Shell (HKLM\...\{840C85B7-D3D6-4143-9AF9-DAE80FD54CFC}) (Version: 4.1.0 - IvoSoft)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
CodeSite Express 5.1.5 (HKLM-x32\...\CodeSite Express 5.1.5) (Version: 5.1.3 - Raize Software, Inc.)
CollabNet Subversion Client 1.7.5 (HKLM-x32\...\CollabNet Subversion Client) (Version: 1.7.5 - CollabNet)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3323.57 - CyberLink Corp.)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.3.2.2 - Dolby Laboratories Inc)
Dropbox (HKU\S-1-5-21-1591653119-3682044142-3444803271-1002\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
Embarcadero Delphi and C++Builder XE6 Help System (HKLM-x32\...\Embarcadero Delphi and C++Builder XE6 Help System) (Version: 14.0 - Embarcadero Technologies, Inc.)
Embarcadero Delphi and C++Builder XE6 Help System (x32 Version: 14.0 - Embarcadero Technologies, Inc.) Hidden
Embarcadero InterBase XE3 [instance = gds_db] (HKLM-x32\...\Embarcadero InterBase XE3 [instance = gds_db]) (Version: Embarcadero InterBase XE3 - Embarcadero Technologies, Inc.)
Embarcadero RAD Studio XE6 (HKLM-x32\...\Embarcadero RAD Studio XE6) (Version: 14.0 - Embarcadero Technologies, Inc.)
Embarcadero RAD Studio XE6 (x32 Version: 14.0 - Embarcadero Technologies, Inc.) Hidden
Ext2Fsd 0.53 (HKLM\...\Ext2Fsd_is1) (Version: 0.53 - Matt Wu)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Java 7 Update 72 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417072FF}) (Version: 7.0.720 - Oracle)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java SE Development Kit 7 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0170250}) (Version: 1.7.0.250 - Oracle)
Java SE Development Kit 8 Update 25 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180250}) (Version: 8.0.250.18 - Oracle Corporation)
LibreOffice 4.3 Help Pack (German) (HKLM-x32\...\{1560A369-7C63-4D4E-AA09-494C4BD47256}) (Version: 4.3.1.2 - The Document Foundation)
LibreOffice 4.3.1.2 (HKLM-x32\...\{303C2B0D-03AF-4C25-A443-E62DE8AA36A8}) (Version: 4.3.1.2 - The Document Foundation)
Live Updater (HKLM-x32\...\{EE26E302-876A-48D9-9058-3129E5B99999}) (Version: 2.00.8100 - Acer Incorporated)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Go (HKLM-x32\...\{AF06B8FA-B916-4001-AE51-6645488DEF09}) (Version: 2.8.303 - Sony)
Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.12.102.06300 (HKLM-x32\...\{6E69B344-A081-487D-775B-F55A04DAF2E5}) (Version: 2.12.102.06300 - Sony)
Microsoft Document Explorer 2008 (HKLM-x32\...\Microsoft Document Explorer 2008) (Version: - Microsoft Corporation)
Microsoft Document Explorer 2008 Language Pack - DEU (HKLM-x32\...\Microsoft Document Explorer 2008 Language Pack - DEU) (Version: - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (HKLM-x32\...\Microsoft Visual J# 2.0 Redistributable Package) (Version: - Microsoft Corporation)
Mozilla Firefox 34.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
NVIDIA Grafiktreiber 332.35 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.35 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.0927 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0927 - NVIDIA Corporation)
NVIDIA Update 1.15.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.15.2 - NVIDIA Corporation)
Office Addin (HKLM-x32\...\{6D2BBE1D-E600-4695-BA37-0B0E605542CC}) (Version: 2.02.2009 - Acer)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.51.17865 - pdfforge GmbH)
PDF Architect 2 Create Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 Edit Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 View Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.314 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.23 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.28145 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7027 - Realtek Semiconductor Corp.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Sid Meier's Civilization V (HKLM-x32\...\Steam App 8930) (Version: - 2K Games, Inc.)
Sony PC Companion 2.10.236 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.236 - Sony)
Spotify (HKLM-x32\...\Spotify) (Version: 0.9.1.57.ge7405149 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
Sublime Text Build 3065 (HKLM\...\Sublime Text 3_is1) (Version: - Sublime HQ Pty Ltd)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.19.0 - Synaptics Incorporated)
Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft Corporation)
Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1 (KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258) (Version: 1 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1591653119-3682044142-3444803271-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\AR\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
18-11-2014 21:23:18 Windows Update
25-11-2014 18:33:12 Windows Update
02-12-2014 13:29:04 Installed PDF Architect 2 View Module
07-12-2014 21:27:19 Installed Java 7 Update 72 (64-bit)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {09BBE309-F7D4-4DDA-997C-377D9A0058ED} - System32\Tasks\Dolby Selector => C:\Program Files\Dolby Digital Plus\ddp.exe [2013-07-08] (Dolby Laboratories Inc.)
Task: {0DA88302-9E2A-4B45-A851-029D5AB58837} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2013-09-12] (Acer Incorporated)
Task: {1730C203-4F05-4B61-B799-4CA49718F75A} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-11-11] (Microsoft Corporation)
Task: {396B0A30-671D-4DF8-93D9-4F4BB8DB27D3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09] (Adobe Systems Incorporated)
Task: {87E7DC97-3275-4272-937F-6DDCD180A4B6} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2013-08-02] (Acer Incorporate)
Task: {BB1639FD-70AA-4BEE-82EB-16CBA38DBD93} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-21] (Google Inc.)
Task: {C0C4EF5B-BCCD-4E2C-AEE5-7797DD622E97} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2013-11-23] (Acer Incorporate)
Task: {C5B121ED-B7DE-4F63-BD31-0460430134EF} - System32\Tasks\ALU => C:\Program Files (x86)\Acer\Live Updater\updater.exe [2013-07-08] ()
Task: {C80BD694-C3E3-4954-B2D5-D7F6B6F861BA} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTray.exe [2013-12-04] (Acer Incorporated)
Task: {D1A4DE76-801D-4394-8767-DC1D4FB3BEEC} - System32\Tasks\ALUAgent => C:\Program Files (x86)\Acer\Live Updater\liveupdater_agent.exe [2013-01-22] ()
Task: {FAA83357-8061-4A40-A094-1E6D2DF3BB09} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-21] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-04-23 11:44 - 2014-01-08 01:48 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-09-22 11:49 - 2014-09-22 11:49 - 00034304 _____ () C:\Windows\System32\ssj2mlm.dll
2013-12-24 01:22 - 2013-12-24 01:22 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-12-24 01:20 - 2013-12-24 01:20 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2013-12-24 01:26 - 2013-12-24 01:26 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2013-07-08 17:53 - 2013-07-08 17:53 - 00052096 _____ () C:\Program Files\Dolby Digital Plus\Dolby.DDP.Controls_Desktop.dll
2014-09-20 17:36 - 2014-06-23 08:07 - 00113376 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
2014-09-20 17:36 - 2012-04-30 10:57 - 00039936 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
2014-09-20 17:36 - 2013-09-13 10:02 - 00208896 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 13:54 - 2011-07-07 13:54 - 00233984 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\Report.dll
2014-09-20 17:36 - 2013-05-20 11:58 - 00620718 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\sqlite3.dll
2014-09-20 17:36 - 2010-01-11 15:44 - 00053248 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\VObject.dll
2014-09-22 16:05 - 2014-09-22 16:05 - 00645632 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PhoneUpdate.dll
2014-12-09 23:37 - 2014-12-09 23:37 - 00043008 _____ () c:\users\ar\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppaxqoa.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\AR\AppData\Roaming\Dropbox\bin\libcef.dll
2014-04-23 11:38 - 2013-09-04 00:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-12-01 22:50 - 2014-12-01 22:50 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-1591653119-3682044142-3444803271-500 - Administrator - Disabled)
AR (S-1-5-21-1591653119-3682044142-3444803271-1002 - Administrator - Enabled) => C:\Users\AR
Gast (S-1-5-21-1591653119-3682044142-3444803271-501 - Limited - Disabled)
UpdatusUser (S-1-5-21-1591653119-3682044142-3444803271-1001 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-12-07 23:15:05.556
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Windows\System32\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:23.194
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:23.132
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:22.741
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:22.663
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:14.100
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:14.006
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:11.990
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:11.896
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2014-11-25 19:55:10.318
Description: Code Integrity determined that a process (\Device\HarddiskVolume9\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume9\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4702MQ CPU @ 2.20GHz
Percentage of memory in use: 24%
Total physical RAM: 8072.27 MB
Available physical RAM: 6103.54 MB
Total Pagefile: 9352.27 MB
Available Pagefile: 7264.73 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:912.7 GB) (Free:823.42 GB) NTFS
Drive d: (Lubuntu 14.04.1) (CDROM) (Total:0.68 GB) (Free:0 GB) CDFS
Drive e: (ACER) (Fixed) (Total:143.04 GB) (Free:10.78 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (DATA) (Fixed) (Total:99.85 GB) (Free:54.05 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 767E32CA)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=143 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=99.8 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=43.2 GB) - (Type=05)
========================================================
Disk: 1 (Size: 931.5 GB) (Disk ID: 0F6CD540)
Partition: GPT Partition Type.
==================== End Of Log ============================
Geändert von WinFail (10.12.2014 um 00:23 Uhr) |
|
10.12.2014, 19:13
| #6 |
| /// the machine /// TB-Ausbilder | Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" und die Meldung kommt also nur bei Verwendung von Classic Shell? Installier das mal neu.
__________________ --> Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" |
|
11.12.2014, 20:46
| #7 | |
| | Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren"Zitat:
Die suche von Classic shell verhält sich wie folgt: ->Windows+C+M+D+Enter Alles wie es soll Kommandozeile startet. dagegen ->Windows+caps+C+M+D er zeigt cmd icon an ->Enter er zeigt das suchfenster nicht mehr sucht aber weiter und führt das oberste suchergebnis aus. Wenn man nun ->Windows+caps+C+M+D ausführt und etwas wartete bis alle suchergebnisse angezeigt werden sieht man ganz oben in der liste $Acer$ mit batchfile icon... wennn man das bearbeitet steht da drinn Code:
ATTFilter shutdown.exe /s /f /t 5
warum tun die mir das an? Es tut mir leid deine Zeit in anspruch genommen zu haben ohne das not am mann war...aber ich hatte Panik. Jetzt Avast installieren und nen Virenscanner kaufen oder soll ich liber gleich Dualboot mit uefi versuchen einzurichten? |
|
12.12.2014, 17:36
| #8 |
| /// the machine /// TB-Ausbilder | Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" Wenn Du eh Ubuntu willst mach gleich den DualBoot 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 8.1 : Vermutlich mit ZBOT infiziert. Meldung: "Ihr Computer wird in unter einer Minute heruntergefahren" |
| adobe, adware, avg, beschädigung, computer, cpu, defender, device driver, downloader, firefox, firefox 34.0, flash player, ftp, homepage, installation, launch, lubuntu, mozilla, programm, realtek, registry, security, services.exe, siteadvisor, software, svchost.exe, system, udp, windows, windowsapps, wlan |
Linear-Darstellung
