Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Plagegeister aller Art und deren Bekämpfung: Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 17.03.2015, 10:20   #1
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Guten Morgen,

ich erhalte seit Sonntag unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>. XXX steht hier für einen Server meines Providers, wo ich webspace und Email-Adressen miete.
Ich habe daraufhin die Passwörter meiner Postfächer geändert, was auch umgehend zu Ruhe führte.
Gleichzeitig habe ich den Anbieter angeschrieben und mit dem Problem konfrontiert. Mir wurde gesagt, dass über wordpress Schaddateien eingeschleust wurden, die daraufhin in einen neutralen Ordner verschoben wurden. Ich habe diese Dateien umgehend per FTP-Zugang gelöscht.
Heute Nacht ging das Spiel dann von vorne los, ich erhielt abermals unzählige Emails mit o.g. Betreff. Ich schrieb deswegen heute Morgen wieder den Anbieter an. Ich bekam die Auskunft, dass heute Nacht per FTP Schaddateien auf meinen webspace geladen worden sind - die Dateien wurden umgehend entfernt. Gleichzeitig bekam ich neue Zugangsdaten, da davon ausgegangen wird, dass das Passwort über das FTP-Programm (FileZilla) ausgelesen wird. Ich habe daraufhin Filezilla deinstalliert - die neuen Zugangsdaten habe ich noch nicht verwendet.

Ich habe die Befürchtung, dass mein PC mit irgend etwas befallen ist. Untermauert wird dies dadurch, dass ich vom Telekom Abuse-Team seit Dezember 2014 bis Februar 2015 drei Emails bekam, dass mein System mit einem Trojaner befallen sei. Ich hatte jeweils nach Erhalt der Emails meine Systeme mit Kaspersky Internet Security gescannt. Zusätzlich nutzte ich Spybot und Malwarebytes Anti Malware - letzteres Programm fand auch etwas, was bereinigt wurde. Was es genau war, weiß ich leider nicht mehr.

Hier nun der FRST-Log:

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Sebastian (administrator) on SEBASTIAN-PC on 17-03-2015 10:12:21
Running from E:\Downloads
Loaded Profiles: Sebastian (Available profiles: Sebastian)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodag.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\plugin-nm-server.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\klwtblfs.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\wmi64.exe
(Google Inc.) C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [OODefragTray] => C:\Program Files\OO Software\Defrag\oodtray.exe
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\...\Run: [Google Update] => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\...\MountPoints2: F - F:\CDSAMPLE\AUTORUN\AUTORUN.EXE
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * OODBSsdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-12] (Oracle Corporation)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-12] (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-12] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-12] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4A85DBE0-BFB2-4119-8401-186A7C6EB653} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/mjss/MJSS.cab109791.cab
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\772itop0.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-12] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-12] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-12] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll [2013-03-12] (Amazon.com, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.faz.net/
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3314932&octid=EB_ORIGINAL_CTID&ISID=M37BB1CE2-8BD4-418B-AB2B-8E3E57D0C3AF&SearchSource=55&CUI=&UM=5&UP=SP7D0EFF40-7EA8-45F1-A390-B6BAD1FDE679&SSPV="
CHR Profile: C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]
CHR Extension: (Google Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]
CHR Extension: (Kaspersky Protection) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-08-24]
CHR Extension: (The Camelizer - Amazon Price Tracker) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghnomdcacenbmilgjigehppbamfndblo [2013-10-11]
CHR Extension: (AdBlock) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-02-17]
CHR Extension: (feedly) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2013-03-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]
CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2011-07-28]
CHR Extension: (Google Wallet) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
StartMenuInternet: Google Chrome - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-01-03] (Creative Labs) [File not signed]
S3 Creative Dolby Digital Live Pack Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe [79360 2011-07-28] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2011-07-28] () [File not signed]
R2 MSSQL$MYMOVIES; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
R2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [2555760 2012-11-01] (O&O Software GmbH)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2015-01-24] (Electronic Arts)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 SynoDrService; C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe [384072 2013-10-09] ()
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2014-02-25] ()
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2012-05-16] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-11-22] (AVM Berlin)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-09] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-17 10:08 - 2015-03-17 10:08 - 00000000 _____ () C:\Users\Sebastian\Desktop\Neues Textdokument.txt
2015-03-11 11:54 - 2015-03-11 11:54 - 06208736 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.10.2_win32-setup.exe
2015-03-11 08:38 - 2015-01-29 04:23 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 08:38 - 2015-01-29 04:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 08:38 - 2015-01-29 04:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 08:38 - 2015-01-29 04:19 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 08:38 - 2015-01-29 04:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 08:38 - 2015-01-29 04:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 08:38 - 2015-01-29 04:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 08:38 - 2015-01-29 04:05 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 08:38 - 2015-01-29 04:05 - 03917752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 08:38 - 2015-01-29 04:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 08:38 - 2015-01-29 03:57 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 08:37 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 08:37 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 08:37 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 08:37 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 08:37 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 08:37 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 08:37 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 08:37 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 08:37 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 08:37 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 08:37 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 08:37 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 08:37 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 08:37 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 08:36 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 08:36 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 08:36 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 08:36 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 08:36 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 08:36 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 08:36 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 08:36 - 2015-02-04 04:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 08:36 - 2015-02-04 03:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 08:36 - 2015-02-03 04:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 08:36 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 08:36 - 2015-02-03 04:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 08:36 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 08:36 - 2015-01-31 04:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-11 08:36 - 2015-01-31 04:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-11 08:36 - 2015-01-31 00:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-11 08:36 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 08:36 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-02 16:42 - 2015-03-02 16:43 - 00000000 ____D () C:\Users\Sebastian\Desktop\DSL Annex B
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\Program Files\iTunes
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\Program Files\iPod
2015-02-25 12:54 - 2015-02-25 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-02-25 08:38 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 08:38 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-23 15:36 - 2015-03-17 10:12 - 00000000 ____D () C:\FRST
2015-02-17 23:06 - 2015-02-17 23:06 - 00000085 _____ () C:\Windows\wininit.ini
2015-02-17 23:02 - 2015-03-17 09:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-17 23:02 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-17 23:02 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-17 23:02 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-17 18:59 - 2015-02-17 18:59 - 00089372 ____N () C:\Users\Sebastian\Desktop\JRT.txt
2015-02-17 18:46 - 2015-02-17 18:49 - 00000000 ____D () C:\AdwCleaner
2015-02-17 16:50 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-17 16:50 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-17 16:50 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-17 16:50 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-17 15:19 - 2015-02-17 15:19 - 01614496 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-17 10:10 - 2012-12-09 12:43 - 02906728 _____ () C:\Windows\system32\oodbs.lor
2015-03-17 10:10 - 2011-07-28 11:36 - 00146806 _____ () C:\Windows\PFRO.log
2015-03-17 10:10 - 2011-07-28 10:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-03-17 10:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-17 10:10 - 2009-07-14 05:51 - 00227219 _____ () C:\Windows\setupact.log
2015-03-17 10:09 - 2011-07-28 10:16 - 01842765 _____ () C:\Windows\WindowsUpdate.log
2015-03-17 10:08 - 2011-07-28 13:51 - 00000000 ____D () C:\Users\Sebastian\Documents\Outlook-Dateien
2015-03-17 10:04 - 2011-07-28 23:24 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Skype
2015-03-17 10:01 - 2011-07-28 10:18 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001UA.job
2015-03-17 09:59 - 2014-05-16 11:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-17 09:38 - 2013-09-21 08:53 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\A33D40CB-D7EE-4111-8C05-89A9CBCBE699.aplzod
2015-03-17 08:56 - 2009-07-14 05:45 - 00025552 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-17 08:56 - 2009-07-14 05:45 - 00025552 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-17 08:54 - 2009-07-14 18:58 - 15937438 _____ () C:\Windows\system32\perfh007.dat
2015-03-17 08:54 - 2009-07-14 18:58 - 04953480 _____ () C:\Windows\system32\perfc007.dat
2015-03-17 08:54 - 2009-07-14 06:13 - 00006470 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-16 19:47 - 2014-08-04 20:30 - 00000306 _____ () C:\Windows\Tasks\Synology Data Replicator 3-Sebastian-PC-Sebastian.job
2015-03-16 19:34 - 2011-07-28 10:16 - 00000000 ____D () C:\Users\Sebastian
2015-03-16 15:01 - 2011-07-28 10:18 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001Core.job
2015-03-16 14:58 - 2011-09-03 23:39 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\FileZilla
2015-03-16 10:52 - 2014-09-03 09:54 - 00000600 _____ () C:\Users\Sebastian\AppData\Local\PUTTY.RND
2015-03-13 12:45 - 2013-05-16 20:16 - 00000000 ____D () C:\Windows\rescache
2015-03-13 11:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-13 11:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-12 15:40 - 2014-11-29 17:14 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-12 15:39 - 2011-07-28 10:46 - 00000000 ____D () C:\Program Files\Java
2015-03-12 15:37 - 2015-01-21 14:47 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-03-12 15:36 - 2013-10-19 15:13 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-12 15:35 - 2014-11-29 17:14 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-11 11:48 - 2009-07-14 05:45 - 00341872 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-11 09:17 - 2011-07-28 11:20 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 09:10 - 2013-08-14 14:34 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-11 09:04 - 2011-07-28 11:17 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-11 09:03 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2015-03-06 13:52 - 2012-02-03 17:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\vlc
2015-03-02 19:05 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-25 13:01 - 2014-09-06 09:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-02-25 13:01 - 2011-12-24 16:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-25 13:01 - 2011-07-28 22:56 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-24 03:17 - 2011-07-28 10:36 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-20 16:36 - 2014-09-24 12:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-02-20 16:36 - 2011-07-28 23:24 - 00000000 ____D () C:\ProgramData\Skype
2015-02-17 23:17 - 2014-05-05 16:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-17 23:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2015-02-17 17:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing

==================== Files in the root of some directories =======

2011-12-30 09:29 - 2011-12-30 09:56 - 0001188 _____ () C:\Users\Sebastian\AppData\Local\crc32list11.txt
2012-07-08 21:01 - 2012-07-08 21:01 - 0004096 ____H () C:\Users\Sebastian\AppData\Local\keyfile3.drm
2014-09-03 09:54 - 2015-03-16 10:52 - 0000600 _____ () C:\Users\Sebastian\AppData\Local\PUTTY.RND
2011-11-03 12:06 - 2011-11-03 12:06 - 0000017 _____ () C:\Users\Sebastian\AppData\Local\resmon.resmoncfg
2011-07-28 10:55 - 2011-07-28 10:55 - 0017408 _____ () C:\Users\Sebastian\AppData\Local\WebpageIcons.db
2014-04-01 09:38 - 2014-04-01 09:38 - 0000040 ___SH () C:\ProgramData\.zreglib
2011-09-06 14:55 - 2011-09-06 15:08 - 0000360 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Sebastian\AppData\Local\Temp\AZ_1140718236679068156.exe
C:\Users\Sebastian\AppData\Local\Temp\AZ_2848461055147399262.exe
C:\Users\Sebastian\AppData\Local\Temp\AZ_4619401663501047626.exe
C:\Users\Sebastian\AppData\Local\Temp\AZ_5182792834848607432.exe
C:\Users\Sebastian\AppData\Local\Temp\AZ_5604360757481880141.exe
C:\Users\Sebastian\AppData\Local\Temp\AZ_748523700034962356.exe
C:\Users\Sebastian\AppData\Local\Temp\DivXSetup.exe
C:\Users\Sebastian\AppData\Local\Temp\drm_dyndata_7370007.dll
C:\Users\Sebastian\AppData\Local\Temp\drm_dyndata_7370010.dll
C:\Users\Sebastian\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1014091904589135351.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1041362728925970266.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1110531134364490410.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1137242879032184808.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1142309330889470670.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1152311054437696758.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1182104696751076401.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1215798202210810518.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1221253092439142209.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1248224179444790014.dll
C:\Users\Sebastian\AppData\Local\Temp\jna127458028090043647.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1288532973874588640.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1295889154616328663.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1296546557964891669.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1323637214673391.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1345844091801655466.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1346347952115270318.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1455440076662930840.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1458168450025072523.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1471264972418097368.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1593362208927483325.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1662951116951104816.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1668914530730633151.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1705767340224022250.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1731033830820518025.dll
C:\Users\Sebastian\AppData\Local\Temp\jna173450631999388552.dll
C:\Users\Sebastian\AppData\Local\Temp\jna17791384404544835.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1782707483037726906.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1804331349662335954.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1853445390928327028.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1871557020680964271.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1888331064639816766.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1922481927101364428.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1963896693732479126.dll
C:\Users\Sebastian\AppData\Local\Temp\jna1965968641347879053.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2002525541312534140.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2019083538771818186.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2074376742930690966.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2080757217061942514.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2132642328612969189.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2157657924673347748.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2244338900066759197.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2245895496069639663.dll
C:\Users\Sebastian\AppData\Local\Temp\jna230044156007061979.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2311636334311419706.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2323994938767487666.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2343336267189344368.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2350895639209801170.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2409768792393195649.dll
C:\Users\Sebastian\AppData\Local\Temp\jna241099576601131519.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2411982880679859094.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2424348212443485335.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2429309196968365863.dll
C:\Users\Sebastian\AppData\Local\Temp\jna243068636102388481.dll
C:\Users\Sebastian\AppData\Local\Temp\jna243493382892971639.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2446113315867419289.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2539672093240053944.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2598111008081658526.dll
C:\Users\Sebastian\AppData\Local\Temp\jna262595470656569501.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2757602724654535318.dll
C:\Users\Sebastian\AppData\Local\Temp\jna278673722463774617.dll
C:\Users\Sebastian\AppData\Local\Temp\jna278990510774604335.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2813043595067874843.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2860845172217059852.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2876838269509964290.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2895259330524274361.dll
C:\Users\Sebastian\AppData\Local\Temp\jna290513620367238403.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2927476662333709263.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2927545198471445573.dll
C:\Users\Sebastian\AppData\Local\Temp\jna2991136644191559560.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3032973392894173127.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3038614350472557080.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3057108137325041433.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3080148307054676256.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3102148467723818265.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3135988823605301481.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3138093607642110026.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3158683719909104981.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3173222067820990095.dll
C:\Users\Sebastian\AppData\Local\Temp\jna32078121416771444.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3294632825577563712.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3403986897056991428.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3495002400546921190.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3498816050508978016.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3509193678430302200.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3556797191068796152.dll
C:\Users\Sebastian\AppData\Local\Temp\jna359195598211668134.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3643877548839313008.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3694609042563823058.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3741766682682814316.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3772072142128068772.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3790178978098101609.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3847228536670056327.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3859572211101278001.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3870067857374018111.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3889443258451263215.dll
C:\Users\Sebastian\AppData\Local\Temp\jna390052523518075763.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3913002034136368397.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3931265550155805096.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3950788088393836449.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3953218962030830496.dll
C:\Users\Sebastian\AppData\Local\Temp\jna3964443489607685830.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4004719006446576502.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4058099991619438910.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4063491608636514031.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4100428742163720978.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4142343264603385286.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4175444069115243936.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4290997836229974005.dll
C:\Users\Sebastian\AppData\Local\Temp\jna435380624509936957.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4366258991408800062.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4382158403778041674.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4382460155773659715.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4402644900916381337.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4405153692661440434.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4410878568922156247.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4480428281518621216.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4493461540733973672.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4520555221111267529.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4539517421306765024.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4570341025813917848.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4581121885837801388.dll
C:\Users\Sebastian\AppData\Local\Temp\jna460546724196515208.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4646868682166381419.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4683557038847041692.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4763796946174435231.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4772796682110729563.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4773040304403941012.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4829053557417077110.dll
C:\Users\Sebastian\AppData\Local\Temp\jna484163673737577416.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4884083228525366655.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4904523765468216546.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4905458801205676972.dll
C:\Users\Sebastian\AppData\Local\Temp\jna4941673177227468287.dll
C:\Users\Sebastian\AppData\Local\Temp\jna495203010373873855.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5020654731134804637.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5061805516945155008.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5067550176855983890.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5090035711402279984.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5119526574068692779.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5133591216411850580.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5146271402845947482.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5147085351929402596.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5194510547378558302.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5215687703770026845.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5234029051607544669.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5236204993883183498.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5258054440410267856.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5261491456297464039.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5314970365152512861.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5345532678113466834.dll
C:\Users\Sebastian\AppData\Local\Temp\jna535333222526622766.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5362517365865974747.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5370600089148437191.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5377190059722851342.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5429641600997818374.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5449642079989055450.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5464443244354740163.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5520838876719316185.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5546994321031828915.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5656965774068067027.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5660975407348693344.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5733711313370825426.dll
C:\Users\Sebastian\AppData\Local\Temp\jna580639334948273353.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5820757852374330684.dll
C:\Users\Sebastian\AppData\Local\Temp\jna589325220271899638.dll
C:\Users\Sebastian\AppData\Local\Temp\jna5965567763940306326.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6068553636207140597.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6100420023313734080.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6116578915428043460.dll
C:\Users\Sebastian\AppData\Local\Temp\jna612127576608443899.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6123375287858142919.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6155261285734236298.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6180234379155332627.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6205146680222490417.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6206949991042516722.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6237595755860735103.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6287087284297897031.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6297329844277847166.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6306045427433309070.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6334907427681144237.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6345160211270099715.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6414868375309498647.dll
C:\Users\Sebastian\AppData\Local\Temp\jna642358030873747893.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6485714882526612782.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6514566952245554386.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6555269983007736704.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6606378222382047174.dll
C:\Users\Sebastian\AppData\Local\Temp\jna66434786172219068.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6699736396224086020.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6717182682127011923.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6772561864471374578.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6790768161410481368.dll
C:\Users\Sebastian\AppData\Local\Temp\jna679789294240841337.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6799936989068841535.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6805052673035990578.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6807095946355743527.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6812360163707489226.dll
C:\Users\Sebastian\AppData\Local\Temp\jna681520555803457022.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6821992400681975794.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6865765441477265464.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6874076571098454360.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6880617514038160930.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6901137847835588924.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6923686732833285036.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6936356567982347323.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6941617814764044345.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6944487907433345967.dll
C:\Users\Sebastian\AppData\Local\Temp\jna6980721469695301863.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7067216128708093947.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7068169416911999585.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7088742902071477863.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7089316958713088862.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7150509915042897460.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7168161171013080948.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7173394567912930697.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7175588448871455109.dll
C:\Users\Sebastian\AppData\Local\Temp\jna718493453306513764.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7191946206937995713.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7202128180534815483.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7231853834813905296.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7267404751550553496.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7275698367320902393.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7321120315541480483.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7330880199027611387.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7369682670387268973.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7372896896860480288.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7423604226083991881.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7470177882814686526.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7476112131135390953.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7482332329573562664.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7542620909207393519.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7570920506851060488.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7594547967238012127.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7600780440356073751.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7606158869576618413.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7644772858823315115.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7659723353594666577.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7676788633694886058.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7685288884747600791.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7691663135112550474.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7705358615773384386.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7717176779866977236.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7731084036181743675.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7764968245476034950.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7814411359558835404.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7825717795818322245.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7828686367091344865.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7830205187424159759.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7859792959114130002.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7865209532905395994.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7866862561880396166.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7941532404364710021.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7947836856026334720.dll
C:\Users\Sebastian\AppData\Local\Temp\jna7972164612367546840.dll
C:\Users\Sebastian\AppData\Local\Temp\jna798100712580697482.dll
C:\Users\Sebastian\AppData\Local\Temp\jna802686610484144040.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8077627064051273719.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8078199077454455614.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8081853399554580486.dll
C:\Users\Sebastian\AppData\Local\Temp\jna808207845941603860.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8086628242850069198.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8088242905402534747.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8161979188039568471.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8209445081219842109.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8225594166148853978.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8240964423538387488.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8242921406463831373.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8297586150196252572.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8308633607356368394.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8315239422309809872.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8355741458277797909.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8357936216000657047.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8410404070590053868.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8482353099727622145.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8511135655880105618.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8525241843395383488.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8569898715642840862.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8590472054202861275.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8632574498706508043.dll
C:\Users\Sebastian\AppData\Local\Temp\jna866612218520970115.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8667550557624448114.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8671594151378461332.dll
C:\Users\Sebastian\AppData\Local\Temp\jna870536371947556517.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8707771025472855475.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8716701761419599910.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8724907102676437277.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8755198869662503982.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8821294767761153366.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8857336522715971998.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8914916266128338817.dll
C:\Users\Sebastian\AppData\Local\Temp\jna892477106410103193.dll
C:\Users\Sebastian\AppData\Local\Temp\jna8945193989617812236.dll
C:\Users\Sebastian\AppData\Local\Temp\jna9009763705893134300.dll
C:\Users\Sebastian\AppData\Local\Temp\jna9128797393317881438.dll
C:\Users\Sebastian\AppData\Local\Temp\jna9138757509421811724.dll
C:\Users\Sebastian\AppData\Local\Temp\jna9169804243041626604.dll
C:\Users\Sebastian\AppData\Local\Temp\jna936244136852035916.dll
C:\Users\Sebastian\AppData\Local\Temp\jna959509992155076436.dll
C:\Users\Sebastian\AppData\Local\Temp\jna97394780800715547.dll
C:\Users\Sebastian\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Sebastian\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Sebastian\AppData\Local\Temp\nvStereoApiI64.dll
C:\Users\Sebastian\AppData\Local\Temp\nvStInst.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00000.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00001.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00002.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00003.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00004.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00005.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00006.exe
C:\Users\Sebastian\AppData\Local\Temp\ose00007.exe
C:\Users\Sebastian\AppData\Local\Temp\Quarantine.exe
C:\Users\Sebastian\AppData\Local\Temp\Samsung_Magician_Setup_v44.exe
C:\Users\Sebastian\AppData\Local\Temp\Setup.exe
C:\Users\Sebastian\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sebastian\AppData\Local\Temp\sqlite3.dll
C:\Users\Sebastian\AppData\Local\Temp\Uni000.exe
C:\Users\Sebastian\AppData\Local\Temp\vlc-2.0.1-win32.exe
C:\Users\Sebastian\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\Sebastian\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\Sebastian\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Sebastian\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\Users\Sebastian\AppData\Local\Temp\_isA084.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-16 10:24

==================== End Of Log ============================
Hier der Addition-Log:

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Sebastian at 2015-03-17 10:12:58
Running from E:\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (32-Bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4954 - CDBurnerXP)
Creative Audio-Systemsteuerung (HKLM-x32\...\AudioCS) (Version: 2.00 - Creative Technology Limited)
Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)
Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version:  - )
DDL und DTS Connect-Lizenzaktivierung (HKLM-x32\...\AcMgrDDL) (Version:  - )
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.84 - DivX, LLC)
Dolby Digital Live Pack (HKLM-x32\...\Dolby Digital Live Pack) (Version:  - )
Dropbox (HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\...\Dropbox) (Version: 1.4.17 - Dropbox, Inc.)
DTS Connect Pack (HKLM-x32\...\DTS Connect Pack) (Version:  - )
Google Chrome (HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
HP Photosmart Wireless B110 All-In-One Driver 14.0 Rel. 7 (HKLM\...\{014E482A-0C27-47E3-BA82-307E9DCA2F47}) (Version: 14.0 - HP)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
iTunes (HKLM\...\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)
Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
Logitech Harmony Remote Software 7 (HKLM-x32\...\{5C6F884D-680C-448B-B4C9-22296EE1B206}) (Version: 7.7.0.0 - Logitech)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MobileMe Control Panel (HKLM\...\{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}) (Version: 3.1.8.0 - Apple Inc.)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My Movies Collection Management (HKLM-x32\...\{B5FB1DFF-0631-4BD7-8C02-B6E388FAF963}) (Version: 4.0.5.106 - Binnerup Consult)
Network64 (Version: 140.0.212.000 - Hewlett-Packard) Hidden
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
O&O Defrag Professional (HKLM\...\{B0DB2914-726E-45D0-BA71-A39C10B6515F}) (Version: 16.0.183 - O&O Software GmbH)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 9.5.2.2829 - Electronic Arts, Inc.)
Photo Station Uploader (remove only) (HKLM-x32\...\Photo Station Uploader) (Version:  - Synology)
PokerStars (HKLM-x32\...\PokerStars) (Version:  - PokerStars)
PS_AIO_07_B110_SW_Min (x32 Version: 140.0.142.000 - Hewlett-Packard) Hidden
Remote Control USB Driver (HKLM-x32\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )
Scan (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SimCity 2000 Special Edition (HKLM-x32\...\{59D2C751-F7BE-4E9F-9C8C-1F16013802C7}) (Version: 2.0.0.1 - Electronic Arts)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: 1.5.3.23260 - Blizzard Entertainment)
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )
Synology Data Replicator  3 (HKLM-x32\...\{8E310838-457C-4269-B177-3EFB300CBDDC}) (Version: 1.0.0.0 - Synology Inc.)
Toolbox (x32 Version: 140.0.424.000 - Hewlett-Packard) Hidden
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1544781982-3593503346-2797692446-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-02-04 16:50 - 00450771 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {311EF194-0348-4FAB-9B11-C3DFA42B3F11} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001UA => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {9AFF665C-92A0-4F76-BEB9-BDAEBE4B8007} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {B064AC69-E783-4119-BA68-591C61B0D0EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {BD9BEE6B-409E-45C6-8F0F-97C3603EB8FF} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {E6A69B0A-718D-4534-8046-C798B362C997} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001Core => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)
Task: {F8CF83B1-7D52-4F2C-ACAC-2C0612544FE3} - System32\Tasks\Synology Data Replicator 3-Sebastian-PC-Sebastian => C:\Program Files (x86)\Synology\Data Replicator  3\Backup.exe [2013-10-09] (Synology Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001Core.job => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001UA.job => C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Synology Data Replicator 3-Sebastian-PC-Sebastian.job => C:\Program Files (x86)\Synology\Data Replicator  3\Backup.exe

==================== Loaded Modules (whitelisted) ==============

2015-01-16 19:14 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-02-13 04:20 - 2015-02-13 04:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-10-09 09:52 - 2013-10-09 09:52 - 00384072 _____ () C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe
2014-02-25 02:28 - 2014-02-25 02:28 - 00248736 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
2014-03-06 14:00 - 2014-03-06 14:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2015-03-11 20:07 - 2015-03-07 07:12 - 01174856 _____ () C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\41.0.2272.89\libglesv2.dll
2015-03-11 20:07 - 2015-03-07 07:12 - 00080200 _____ () C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\41.0.2272.89\libegl.dll
2015-03-11 20:07 - 2015-03-07 07:13 - 09279304 _____ () C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\41.0.2272.89\pdf.dll
2015-03-11 20:07 - 2015-03-07 07:13 - 14974280 _____ () C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\41.0.2272.89\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: ehRecvr => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^vpngui.exe.lnk => C:\Windows\pss\vpngui.exe.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk => C:\Windows\pss\WISO Mein Steuer-Sparbuch heute.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: CTxfiHlp => CTXFIHLP.EXE
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Google Update => "C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: MobileDocuments => C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: My Movies Tray => "C:\Program Files (x86)\Binnerup Consult\My Movies Collection Management\My Movies Tray.exe"
MSCONFIG\startupreg: OODefragTray => C:\Program Files\OO Software\Defrag\oodtray.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-1544781982-3593503346-2797692446-500 - Administrator - Disabled)
Gast (S-1-5-21-1544781982-3593503346-2797692446-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1544781982-3593503346-2797692446-1002 - Limited - Enabled)
Sebastian (S-1-5-21-1544781982-3593503346-2797692446-1001 - Administrator - Enabled) => C:\Users\Sebastian

==================== Faulty Device Manager Devices =============

Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/17/2015 10:10:17 AM) (Source: MSSQL$MYMOVIES) (EventID: 3409) (User: )
Description: Performance counter shared memory setup failed with error -1. Reinstall sqlctr.ini for this instance, and ensure that the instance login account has correct registry permissions.

Error: (03/17/2015 10:10:17 AM) (Source: MSSQL$MYMOVIES) (EventID: 8313) (User: )
Description: Error in mapping SQL Server performance object/counter indexes to object/counter names. SQL Server performance counters are disabled.

Error: (03/17/2015 08:54:14 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/17/2015 08:54:14 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/17/2015 08:54:14 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (03/17/2015 08:53:54 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).

Error: (03/17/2015 08:48:40 AM) (Source: MSSQL$MYMOVIES) (EventID: 3409) (User: )
Description: Performance counter shared memory setup failed with error -1. Reinstall sqlctr.ini for this instance, and ensure that the instance login account has correct registry permissions.

Error: (03/17/2015 08:48:40 AM) (Source: MSSQL$MYMOVIES) (EventID: 8313) (User: )
Description: Error in mapping SQL Server performance object/counter indexes to object/counter names. SQL Server performance counters are disabled.

Error: (03/16/2015 08:16:17 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (03/16/2015 08:16:17 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (03/13/2015 00:01:23 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80004005 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB3033929)

Error: (03/13/2015 10:36:16 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80004005 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB3033929)

Error: (03/12/2015 11:57:26 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80004005 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB3033929)

Error: (03/11/2015 07:29:29 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80004005 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB3033929)

Error: (03/11/2015 02:04:11 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80004005 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB3033929)

Error: (03/11/2015 11:52:37 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80004005 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB3033929)

Error: (03/11/2015 11:48:49 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Server" wurde mit folgendem Fehler beendet: 
%%13

Error: (03/11/2015 11:48:49 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: 
%%1115

Error: (03/11/2015 11:48:49 AM) (Source: BROWSER) (EventID: 8017) (User: )
Description: Der Suchdienst konnte nicht starten, da der abhängige Dienst "LanmanWorkstation" den ungültigen Status "4294967295" aufwies.
Status             Bedeutung
  1              Angehalten

  2              Warten begonnen

  3              Warten beendet

  4              Wird ausgeführt

  5              Warten fortgesetzt

  6              Warten unterbrochen

  7              Unterbrochen

Error: (03/03/2015 05:04:11 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.


Microsoft Office Sessions:
=========================
Error: (03/17/2015 10:10:17 AM) (Source: MSSQL$MYMOVIES) (EventID: 3409) (User: )
Description: -1

Error: (03/17/2015 10:10:17 AM) (Source: MSSQL$MYMOVIES) (EventID: 8313) (User: )
Description: 

Error: (03/17/2015 08:54:14 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/17/2015 08:54:14 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/17/2015 08:54:14 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (03/17/2015 08:53:54 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422

Error: (03/17/2015 08:48:40 AM) (Source: MSSQL$MYMOVIES) (EventID: 3409) (User: )
Description: -1

Error: (03/17/2015 08:48:40 AM) (Source: MSSQL$MYMOVIES) (EventID: 8313) (User: )
Description: 

Error: (03/16/2015 08:16:17 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (03/16/2015 08:16:17 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


CodeIntegrity Errors:
===================================
  Date: 2015-02-18 10:24:58.562
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 10:24:58.562
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 10:24:58.562
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 09:36:11.668
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 09:36:11.668
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-18 09:36:11.658
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 23:25:46.802
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 23:25:46.802
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-17 23:25:46.802
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-12 08:55:36.306
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Quad CPU Q8300 @ 2.50GHz
Percentage of memory in use: 45%
Total physical RAM: 4094.48 MB
Available physical RAM: 2228.54 MB
Total Pagefile: 8187.16 MB
Available Pagefile: 5953.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (SSD) (Fixed) (Total:232.78 GB) (Free:156.3 GB) NTFS
Drive d: (Zeug) (Fixed) (Total:232.88 GB) (Free:187.91 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Zeug) (Fixed) (Total:232.88 GB) (Free:55.25 GB) NTFS
Drive h: (Data) (Fixed) (Total:0.1 GB) (Free:0 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: D669199D)
Partition 1: (Not Active) - (Size=232.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 232.9 GB) (Disk ID: 78488018)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 08D408D4)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Im Netzwerk hängen noch ein NAS von Synology, zwei Iphones und ein Laptop. Den Laptop hatte ich ebenfalls mit o.g. Programmen gescannt. Der Log oben stammt von meinem Desktop-PC, von welchem aus ich über FTP auf meinen webspace zugriff. Den Laptop nutze ich dafür nicht.

Über Hilfe bin ich sehr dankbar!

Alt 17.03.2015, 10:25   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


hi,

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.
__________________

__________________
Alt 17.03.2015, 10:48   #3
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Hallo schrauber, danke für deine schnelle Antwort!

Hier die Logs:

Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.03.17.03
  rootkit: v2015.02.25.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Sebastian :: SEBASTIAN-PC [administrator]

17.03.2015 10:33:31
mbar-log-2015-03-17 (10-33-31).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 383388
Time elapsed: 10 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Code:
ATTFilter
10:45:25.0013 0x13c4  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
10:45:52.0939 0x13c4  KSN EULA was not accepted. For auto accept you could use -accepteulaksn command line parameter.
10:45:52.0939 0x13c4  ============================================================
10:45:52.0939 0x13c4  Current date / time: 2015/03/17 10:45:52.0939
10:45:52.0939 0x13c4  SystemInfo:
10:45:52.0939 0x13c4  
10:45:52.0939 0x13c4  OS Version: 6.1.7601 ServicePack: 1.0
10:45:52.0939 0x13c4  Product type: Workstation
10:45:52.0939 0x13c4  ComputerName: SEBASTIAN-PC
10:45:52.0939 0x13c4  UserName: Sebastian
10:45:52.0939 0x13c4  Windows directory: C:\Windows
10:45:52.0939 0x13c4  System windows directory: C:\Windows
10:45:52.0939 0x13c4  Running under WOW64
10:45:52.0939 0x13c4  Processor architecture: Intel x64
10:45:52.0939 0x13c4  Number of processors: 4
10:45:52.0939 0x13c4  Page size: 0x1000
10:45:52.0939 0x13c4  Boot type: Normal boot
10:45:52.0939 0x13c4  ============================================================
10:45:53.0309 0x13c4  KLMD registered as C:\Windows\system32\drivers\19800031.sys
10:45:53.0599 0x13c4  System UUID: {92D02F37-48AE-18D3-A3E6-7EBBC0F8F16D}
10:45:53.0601 0x13c4  Skipping KSN library initialization due to KSN EULA unacceptance
10:45:53.0868 0x13c4  Drive \Device\Harddisk0\DR0 - Size: 0x3A38A25E00 ( 232.88 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:45:53.0869 0x13c4  Drive \Device\Harddisk1\DR1 - Size: 0x3A38A25E00 ( 232.88 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:45:53.0869 0x13c4  Drive \Device\Harddisk2\DR2 - Size: 0x3A38A25E00 ( 232.88 Gb ), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:45:53.0875 0x13c4  ============================================================
10:45:53.0875 0x13c4  \Device\Harddisk0\DR0:
10:45:53.0875 0x13c4  MBR partitions:
10:45:53.0875 0x13c4  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681
10:45:53.0875 0x13c4  \Device\Harddisk1\DR1:
10:45:53.0875 0x13c4  MBR partitions:
10:45:53.0875 0x13c4  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
10:45:53.0875 0x13c4  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D191D81
10:45:53.0876 0x13c4  \Device\Harddisk2\DR2:
10:45:53.0876 0x13c4  MBR partitions:
10:45:53.0876 0x13c4  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C4542
10:45:53.0876 0x13c4  ============================================================
10:45:53.0895 0x13c4  E: <-> \Device\Harddisk0\DR0\Partition1
10:45:53.0900 0x13c4  D: <-> \Device\Harddisk2\DR2\Partition1
10:45:53.0905 0x13c4  C: <-> \Device\Harddisk1\DR1\Partition2
10:45:53.0905 0x13c4  H: <-> \Device\Harddisk1\DR1\Partition1
10:45:53.0905 0x13c4  ============================================================
10:45:53.0906 0x13c4  Initialize success
10:45:53.0906 0x13c4  ============================================================
10:46:29.0988 0x15c8  ============================================================
10:46:29.0988 0x15c8  Scan started
10:46:29.0988 0x15c8  Mode: Manual; SigCheck; TDLFS; 
10:46:29.0988 0x15c8  ============================================================
10:46:30.0257 0x15c8  ================ Scan system memory ========================
10:46:30.0257 0x15c8  System memory - ok
10:46:30.0257 0x15c8  ================ Scan services =============================
10:46:30.0309 0x15c8  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
10:46:30.0378 0x15c8  1394ohci - ok
10:46:30.0388 0x15c8  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
10:46:30.0408 0x15c8  ACPI - ok
10:46:30.0408 0x15c8  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
10:46:30.0438 0x15c8  AcpiPmi - ok
10:46:30.0438 0x15c8  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
10:46:30.0458 0x15c8  AdobeARMservice - ok
10:46:30.0488 0x15c8  [ 080255CDCB878813B481B8C348D47D8E, 75808821FBC732D0504795B8F85852E4C01D3B412989A1E597E1295CFF7B7A45 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
10:46:30.0510 0x15c8  AdobeFlashPlayerUpdateSvc - ok
10:46:30.0526 0x15c8  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
10:46:30.0552 0x15c8  adp94xx - ok
10:46:30.0565 0x15c8  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
10:46:30.0586 0x15c8  adpahci - ok
10:46:30.0597 0x15c8  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
10:46:30.0613 0x15c8  adpu320 - ok
10:46:30.0624 0x15c8  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
10:46:30.0690 0x15c8  AeLookupSvc - ok
10:46:30.0716 0x15c8  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
10:46:30.0746 0x15c8  AFD - ok
10:46:30.0753 0x15c8  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
10:46:30.0767 0x15c8  agp440 - ok
10:46:30.0773 0x15c8  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
10:46:30.0792 0x15c8  ALG - ok
10:46:30.0797 0x15c8  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
10:46:30.0810 0x15c8  aliide - ok
10:46:30.0814 0x15c8  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
10:46:30.0827 0x15c8  amdide - ok
10:46:30.0835 0x15c8  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
10:46:30.0852 0x15c8  AmdK8 - ok
10:46:30.0859 0x15c8  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
10:46:30.0877 0x15c8  AmdPPM - ok
10:46:30.0885 0x15c8  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
10:46:30.0901 0x15c8  amdsata - ok
10:46:30.0910 0x15c8  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
10:46:30.0930 0x15c8  amdsbs - ok
10:46:30.0937 0x15c8  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
10:46:30.0951 0x15c8  amdxata - ok
10:46:30.0959 0x15c8  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
10:46:31.0029 0x15c8  AppID - ok
10:46:31.0035 0x15c8  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
10:46:31.0074 0x15c8  AppIDSvc - ok
10:46:31.0080 0x15c8  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
10:46:31.0101 0x15c8  Appinfo - ok
10:46:31.0111 0x15c8  [ 612CB66D93ED0F2F21BB109840C7D813, 75484123DA27B8942B13148FCF061C75A08A50386A095143736B593E9C772173 ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
10:46:31.0122 0x15c8  Apple Mobile Device Service - ok
10:46:31.0130 0x15c8  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
10:46:31.0148 0x15c8  AppMgmt - ok
10:46:31.0154 0x15c8  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
10:46:31.0160 0x15c8  arc - ok
10:46:31.0170 0x15c8  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
10:46:31.0180 0x15c8  arcsas - ok
10:46:31.0200 0x15c8  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
10:46:31.0220 0x15c8  aspnet_state - ok
10:46:31.0220 0x15c8  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
10:46:31.0260 0x15c8  AsyncMac - ok
10:46:31.0260 0x15c8  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
10:46:31.0270 0x15c8  atapi - ok
10:46:31.0290 0x15c8  [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
10:46:31.0330 0x15c8  AudioEndpointBuilder - ok
10:46:31.0340 0x15c8  [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioSrv        C:\Windows\System32\Audiosrv.dll
10:46:31.0369 0x15c8  AudioSrv - ok
10:46:31.0379 0x15c8  [ BD39D7CFD9D6A73396B618113A8E8D57, E78FC40AE8107F9E65D484332B1AB3FE3BB21BE0D723B31EE869CA82D678CBE1 ] avmaudio        C:\Windows\system32\DRIVERS\avmaudio.sys
10:46:31.0399 0x15c8  avmaudio - ok
10:46:31.0399 0x15c8  [ 6A300AD0E23A155B2C3A7FAB0D4AABD1, AD283CC530482C0C155727C3234BFA4773C8C80B4C9912448196F83407C3CFD4 ] avmaura         C:\Windows\system32\DRIVERS\avmaura.sys
10:46:31.0419 0x15c8  avmaura - ok
10:46:31.0429 0x15c8  [ 058734C95991F6BEBF3D3075B8776234, D94A0E5893723C0F30D8215F001039AE9D903BF8EC3782D9583DEFD9B304B0CA ] AVP15.0.0       C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
10:46:31.0449 0x15c8  AVP15.0.0 - ok
10:46:31.0449 0x15c8  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
10:46:31.0479 0x15c8  AxInstSV - ok
10:46:31.0489 0x15c8  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
10:46:31.0519 0x15c8  b06bdrv - ok
10:46:31.0529 0x15c8  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
10:46:31.0549 0x15c8  b57nd60a - ok
10:46:31.0563 0x15c8  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
10:46:31.0578 0x15c8  BDESVC - ok
10:46:31.0578 0x15c8  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
10:46:31.0608 0x15c8  Beep - ok
10:46:31.0628 0x15c8  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
10:46:31.0668 0x15c8  BFE - ok
10:46:31.0692 0x15c8  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
10:46:31.0746 0x15c8  BITS - ok
10:46:31.0751 0x15c8  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
10:46:31.0765 0x15c8  blbdrive - ok
10:46:31.0782 0x15c8  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
10:46:31.0801 0x15c8  Bonjour Service - ok
10:46:31.0807 0x15c8  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
10:46:31.0817 0x15c8  bowser - ok
10:46:31.0827 0x15c8  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
10:46:31.0847 0x15c8  BrFiltLo - ok
10:46:31.0847 0x15c8  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
10:46:31.0867 0x15c8  BrFiltUp - ok
10:46:31.0877 0x15c8  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
10:46:31.0887 0x15c8  Browser - ok
10:46:31.0897 0x15c8  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
10:46:31.0927 0x15c8  Brserid - ok
10:46:31.0927 0x15c8  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
10:46:31.0947 0x15c8  BrSerWdm - ok
10:46:31.0947 0x15c8  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
10:46:31.0970 0x15c8  BrUsbMdm - ok
10:46:31.0975 0x15c8  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
10:46:31.0988 0x15c8  BrUsbSer - ok
10:46:31.0993 0x15c8  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
10:46:32.0004 0x15c8  BTHMODEM - ok
10:46:32.0021 0x15c8  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
10:46:32.0054 0x15c8  bthserv - ok
10:46:32.0054 0x15c8  [ 32B94975BF6F101C27C43E90FF8ABBEB, B5475D9A705894CBFA583D6E9DAF969527A75800E98D0288182BAB2F10136642 ] busenum         C:\Windows\system32\DRIVERS\busenum.sys
10:46:32.0064 0x15c8  busenum - ok
10:46:32.0079 0x15c8  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
10:46:32.0115 0x15c8  cdfs - ok
10:46:32.0115 0x15c8  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
10:46:32.0135 0x15c8  cdrom - ok
10:46:32.0135 0x15c8  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
10:46:32.0178 0x15c8  CertPropSvc - ok
10:46:32.0183 0x15c8  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
10:46:32.0194 0x15c8  circlass - ok
10:46:32.0204 0x15c8  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
10:46:32.0224 0x15c8  CLFS - ok
10:46:32.0234 0x15c8  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:46:32.0244 0x15c8  clr_optimization_v2.0.50727_32 - ok
10:46:32.0254 0x15c8  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
10:46:32.0274 0x15c8  clr_optimization_v2.0.50727_64 - ok
10:46:32.0284 0x15c8  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:46:32.0304 0x15c8  clr_optimization_v4.0.30319_32 - ok
10:46:32.0304 0x15c8  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
10:46:32.0324 0x15c8  clr_optimization_v4.0.30319_64 - ok
10:46:32.0334 0x15c8  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
10:46:32.0344 0x15c8  CmBatt - ok
10:46:32.0354 0x15c8  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
10:46:32.0364 0x15c8  cmdide - ok
10:46:32.0374 0x15c8  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG             C:\Windows\system32\Drivers\cng.sys
10:46:32.0403 0x15c8  CNG - ok
10:46:32.0413 0x15c8  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
10:46:32.0423 0x15c8  Compbatt - ok
10:46:32.0433 0x15c8  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
10:46:32.0443 0x15c8  CompositeBus - ok
10:46:32.0453 0x15c8  COMSysApp - ok
10:46:32.0453 0x15c8  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
10:46:32.0463 0x15c8  crcdisk - ok
10:46:32.0473 0x15c8  [ C0EAD9F8AB83D41FF07303C75589C2B8, C89CAC39BCD2FA2DCC56D7EE84FF66127BCECCAE400E119FE41BF4C4D769504B ] Creative Audio Engine Licensing Service C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
10:46:32.0483 0x15c8  Creative Audio Engine Licensing Service - detected UnsignedFile.Multi.Generic ( 1 )
10:46:32.0553 0x15c8  Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - warning
10:46:32.0553 0x15c8  [ 80F3D3A4C202CDA7CA886D126F9A39D9, F313761045376EEFADE00201B795D1DDE742FD2DF36BE0B6F0BBF939DC6FDB4D ] Creative Dolby Digital Live Pack Licensing Service C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe
10:46:32.0563 0x15c8  Creative Dolby Digital Live Pack Licensing Service - detected UnsignedFile.Multi.Generic ( 1 )
10:46:32.0563 0x15c8  Creative Dolby Digital Live Pack Licensing Service ( UnsignedFile.Multi.Generic ) - warning
10:46:32.0573 0x15c8  [ 19D511CC455C19DE1ADF60E6C39C85B6, 2A05DD5EF3D0BEC2C9F4EA186E0E2D0F7BE0BF6A473D51194B09D33773AC7FAA ] CryptSvc        C:\Windows\system32\cryptsvc.dll
10:46:32.0597 0x15c8  CryptSvc - ok
10:46:32.0614 0x15c8  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
10:46:32.0634 0x15c8  CSC - ok
10:46:32.0654 0x15c8  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
10:46:32.0689 0x15c8  CscService - ok
10:46:32.0698 0x15c8  [ 229E3B8F266ABDAFD54E4A372B9D5DDC, 2FA1518C12D6DB71FD88CE18BA0560D8D26379A3B97240187AA2F7FB7D3FAA87 ] CT20XUT         C:\Windows\system32\drivers\CT20XUT.SYS
10:46:32.0710 0x15c8  CT20XUT - ok
10:46:32.0720 0x15c8  [ 229E3B8F266ABDAFD54E4A372B9D5DDC, 2FA1518C12D6DB71FD88CE18BA0560D8D26379A3B97240187AA2F7FB7D3FAA87 ] CT20XUT.SYS     C:\Windows\System32\drivers\CT20XUT.SYS
10:46:32.0730 0x15c8  CT20XUT.SYS - ok
10:46:32.0750 0x15c8  [ EB3843A91A10150C9E05607CBCB44090, DCFA097E089A3710AD352373C3CC3484F2461D86AB53561618406815928C0227 ] ctac32k         C:\Windows\system32\drivers\ctac32k.sys
10:46:32.0770 0x15c8  ctac32k - ok
10:46:32.0790 0x15c8  [ BC06EFB59A2316537765462DFE40F764, EE4D439D659C4D12195202841F5CBD0C4F1529FBCD2DA73BE90D2F24300478C3 ] ctaud2k         C:\Windows\system32\drivers\ctaud2k.sys
10:46:32.0817 0x15c8  ctaud2k - ok
10:46:32.0827 0x15c8  [ 07BA6D17E66879018B30B6C3F976EBED, 1759CE25519358A47E1B1FA02A415DB5D3F6B511AD3820D0AE8A1533B5DC83CD ] CTAudSvcService C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
10:46:32.0837 0x15c8  CTAudSvcService - detected UnsignedFile.Multi.Generic ( 1 )
10:46:32.0837 0x15c8  CTAudSvcService ( UnsignedFile.Multi.Generic ) - warning
10:46:32.0877 0x15c8  [ 63B2B6CE9D3EF182981FB64BD5433DA4, D2ED11E38F3FD852844C2B184B903FBF1AE14EE93339114EAADBBA88A4AEDD9B ] CTEXFIFX        C:\Windows\system32\drivers\CTEXFIFX.SYS
10:46:32.0917 0x15c8  CTEXFIFX - ok
10:46:32.0958 0x15c8  [ 63B2B6CE9D3EF182981FB64BD5433DA4, D2ED11E38F3FD852844C2B184B903FBF1AE14EE93339114EAADBBA88A4AEDD9B ] CTEXFIFX.SYS    C:\Windows\System32\drivers\CTEXFIFX.SYS
10:46:32.0998 0x15c8  CTEXFIFX.SYS - ok
10:46:32.0998 0x15c8  [ 6D115CC80873B85FD80DDA1C41F75A2C, DF08AB8B2C621473E6B373159D57F365077738BFCE3C75D095FFBE44A271F591 ] CTHWIUT         C:\Windows\system32\drivers\CTHWIUT.SYS
10:46:33.0015 0x15c8  CTHWIUT - ok
10:46:33.0017 0x15c8  [ 6D115CC80873B85FD80DDA1C41F75A2C, DF08AB8B2C621473E6B373159D57F365077738BFCE3C75D095FFBE44A271F591 ] CTHWIUT.SYS     C:\Windows\System32\drivers\CTHWIUT.SYS
10:46:33.0027 0x15c8  CTHWIUT.SYS - ok
10:46:33.0027 0x15c8  [ EBC9548EF5838CB5AA8F18B3AC28AF12, BD7B6E203D03D44A1A5BCE79A8857B48E46EBF58320D7056AAB2186A88DE7E2D ] ctprxy2k        C:\Windows\system32\drivers\ctprxy2k.sys
10:46:33.0037 0x15c8  ctprxy2k - ok
10:46:33.0047 0x15c8  [ 459BEE1682121842285C162E2D98D81A, 6F7A8286B9F5A752487A54F37F5AA21757D0A4BDB7494E319E19C43C2D45A582 ] ctsfm2k         C:\Windows\system32\drivers\ctsfm2k.sys
10:46:33.0067 0x15c8  ctsfm2k - ok
10:46:33.0067 0x15c8  [ 44BDDEB03C84A1C993C992FFB5700357, 29080E9A434BB2A932783B0B5104BC9E3C514A0FFB387123B75F4F4045E353BC ] CVirtA          C:\Windows\system32\DRIVERS\CVirtA64.sys
10:46:33.0077 0x15c8  CVirtA - ok
10:46:33.0097 0x15c8  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
10:46:33.0137 0x15c8  DcomLaunch - ok
10:46:33.0157 0x15c8  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
10:46:33.0200 0x15c8  defragsvc - ok
10:46:33.0206 0x15c8  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
10:46:33.0241 0x15c8  DfsC - ok
10:46:33.0252 0x15c8  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
10:46:33.0274 0x15c8  Dhcp - ok
10:46:33.0280 0x15c8  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
10:46:33.0313 0x15c8  discache - ok
10:46:33.0319 0x15c8  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
10:46:33.0332 0x15c8  Disk - ok
10:46:33.0340 0x15c8  [ 05CB5910B3CA6019FC3CCA815EE06FFB, 8FA532ED500BB1F08E8034A6125BDD53B74D5E6AB0A83A6185B07AAFCD90AA82 ] DNE             C:\Windows\system32\DRIVERS\dne64x.sys
10:46:33.0354 0x15c8  DNE - ok
10:46:33.0362 0x15c8  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
10:46:33.0379 0x15c8  Dnscache - ok
10:46:33.0390 0x15c8  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
10:46:33.0428 0x15c8  dot3svc - ok
10:46:33.0436 0x15c8  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
10:46:33.0471 0x15c8  DPS - ok
10:46:33.0476 0x15c8  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
10:46:33.0489 0x15c8  drmkaud - ok
10:46:33.0514 0x15c8  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
10:46:33.0544 0x15c8  DXGKrnl - ok
10:46:33.0554 0x15c8  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
10:46:33.0594 0x15c8  EapHost - ok
10:46:33.0663 0x15c8  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
10:46:33.0763 0x15c8  ebdrv - ok
10:46:33.0763 0x15c8  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] EFS             C:\Windows\System32\lsass.exe
10:46:33.0783 0x15c8  EFS - ok
10:46:33.0803 0x15c8  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
10:46:33.0832 0x15c8  ehRecvr - ok
10:46:33.0842 0x15c8  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
10:46:33.0862 0x15c8  ehSched - ok
10:46:33.0872 0x15c8  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
10:46:33.0902 0x15c8  elxstor - ok
10:46:33.0902 0x15c8  [ C26133B6165928FBD156C6FE570F9ED2, E7DD3A187E493F4BBC604B553578C7BC68F7C9B8FC952BE2FDDB3794E993F43A ] emupia          C:\Windows\system32\drivers\emupia2k.sys
10:46:33.0922 0x15c8  emupia - ok
10:46:33.0922 0x15c8  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
10:46:33.0932 0x15c8  ErrDev - ok
10:46:33.0952 0x15c8  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
10:46:33.0992 0x15c8  EventSystem - ok
10:46:34.0002 0x15c8  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
10:46:34.0041 0x15c8  exfat - ok
10:46:34.0051 0x15c8  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
10:46:34.0091 0x15c8  fastfat - ok
10:46:34.0111 0x15c8  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
10:46:34.0141 0x15c8  Fax - ok
10:46:34.0141 0x15c8  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
10:46:34.0161 0x15c8  fdc - ok
10:46:34.0161 0x15c8  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
10:46:34.0201 0x15c8  fdPHost - ok
10:46:34.0201 0x15c8  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
10:46:34.0241 0x15c8  FDResPub - ok
10:46:34.0247 0x15c8  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
10:46:34.0260 0x15c8  FileInfo - ok
10:46:34.0260 0x15c8  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
10:46:34.0292 0x15c8  Filetrace - ok
10:46:34.0302 0x15c8  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
10:46:34.0312 0x15c8  flpydisk - ok
10:46:34.0322 0x15c8  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
10:46:34.0342 0x15c8  FltMgr - ok
10:46:34.0382 0x15c8  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
10:46:34.0432 0x15c8  FontCache - ok
10:46:34.0432 0x15c8  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
10:46:34.0449 0x15c8  FontCache3.0.0.0 - ok
10:46:34.0451 0x15c8  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
10:46:34.0461 0x15c8  FsDepends - ok
10:46:34.0471 0x15c8  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
10:46:34.0481 0x15c8  Fs_Rec - ok
10:46:34.0491 0x15c8  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
10:46:34.0511 0x15c8  fvevol - ok
10:46:34.0511 0x15c8  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
10:46:34.0531 0x15c8  gagp30kx - ok
10:46:34.0531 0x15c8  [ 7907E14F9BCF3A4689C9A74A1A873CB6, 17927B93B2D6AB4271C158F039CAE2D60591D6A14458F5A5690AEC86F5D54229 ] gdrv            C:\Windows\gdrv.sys
10:46:34.0541 0x15c8  gdrv - ok
10:46:34.0551 0x15c8  [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
10:46:34.0551 0x15c8  GEARAspiWDM - ok
10:46:34.0581 0x15c8  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
10:46:34.0631 0x15c8  gpsvc - ok
10:46:34.0670 0x15c8  [ A3F010D5DBFB589A3B3288C05C2EA3F9, 080EA07B0840D6922D37EDBAB61A24AD691B0E97C929FB9FFB929C134C30DFD4 ] ha20x2k         C:\Windows\system32\drivers\ha20x2k.sys
10:46:34.0720 0x15c8  ha20x2k - ok
10:46:34.0720 0x15c8  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
10:46:34.0740 0x15c8  hcw85cir - ok
10:46:34.0750 0x15c8  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
10:46:34.0770 0x15c8  HdAudAddService - ok
10:46:34.0780 0x15c8  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
10:46:34.0800 0x15c8  HDAudBus - ok
10:46:34.0800 0x15c8  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
10:46:34.0820 0x15c8  HidBatt - ok
10:46:34.0820 0x15c8  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
10:46:34.0840 0x15c8  HidBth - ok
10:46:34.0840 0x15c8  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
10:46:34.0865 0x15c8  HidIr - ok
10:46:34.0869 0x15c8  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
10:46:34.0899 0x15c8  hidserv - ok
10:46:34.0909 0x15c8  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
10:46:34.0919 0x15c8  HidUsb - ok
10:46:34.0919 0x15c8  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
10:46:34.0959 0x15c8  hkmsvc - ok
10:46:34.0969 0x15c8  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
10:46:34.0989 0x15c8  HomeGroupListener - ok
10:46:34.0999 0x15c8  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
10:46:35.0009 0x15c8  HomeGroupProvider - ok
10:46:35.0019 0x15c8  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
10:46:35.0029 0x15c8  HpSAMD - ok
10:46:35.0059 0x15c8  [ 5ECEC779312AD35B1B19951A4B53FAC1, 67F4D2603E233FA0C2957419BB196BE6273C02FF6AAA188BA613EF62E80BCBC1 ] HPSLPSVC        C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
10:46:35.0098 0x15c8  HPSLPSVC - ok
10:46:35.0118 0x15c8  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
10:46:35.0168 0x15c8  HTTP - ok
10:46:35.0168 0x15c8  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
10:46:35.0188 0x15c8  hwpolicy - ok
10:46:35.0188 0x15c8  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
10:46:35.0208 0x15c8  i8042prt - ok
10:46:35.0218 0x15c8  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
10:46:35.0238 0x15c8  iaStorV - ok
10:46:35.0268 0x15c8  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
10:46:35.0297 0x15c8  idsvc - ok
10:46:35.0307 0x15c8  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
10:46:35.0317 0x15c8  iirsp - ok
10:46:35.0337 0x15c8  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
10:46:35.0377 0x15c8  IKEEXT - ok
10:46:35.0377 0x15c8  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
10:46:35.0397 0x15c8  intelide - ok
10:46:35.0397 0x15c8  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
10:46:35.0417 0x15c8  intelppm - ok
10:46:35.0417 0x15c8  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
10:46:35.0457 0x15c8  IPBusEnum - ok
10:46:35.0457 0x15c8  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
10:46:35.0496 0x15c8  IpFilterDriver - ok
10:46:35.0506 0x15c8  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
10:46:35.0536 0x15c8  iphlpsvc - ok
10:46:35.0546 0x15c8  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
10:46:35.0556 0x15c8  IPMIDRV - ok
10:46:35.0566 0x15c8  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
10:46:35.0596 0x15c8  IPNAT - ok
10:46:35.0616 0x15c8  [ A4857E8B1DEB9740FB5ADEDF05ED69E0, 24FC7A188D32B08CE4F10EEEF17F37C45DB5433158A7A97A07D43F6BEE58DFFC ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
10:46:35.0646 0x15c8  iPod Service - ok
10:46:35.0646 0x15c8  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
10:46:35.0676 0x15c8  IRENUM - ok
10:46:35.0676 0x15c8  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
10:46:35.0686 0x15c8  isapnp - ok
10:46:35.0703 0x15c8  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
10:46:35.0715 0x15c8  iScsiPrt - ok
10:46:35.0725 0x15c8  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
10:46:35.0735 0x15c8  kbdclass - ok
10:46:35.0735 0x15c8  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
10:46:35.0755 0x15c8  kbdhid - ok
10:46:35.0755 0x15c8  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] KeyIso          C:\Windows\system32\lsass.exe
10:46:35.0765 0x15c8  KeyIso - ok
10:46:35.0785 0x15c8  [ 67D1F7FA1DF9502DE12027D7C7782863, BCB92C1C11A7576FD7E91B160CBC3FB5A0C31FE028305021D7C10EC40C4D5013 ] KL1             C:\Windows\system32\DRIVERS\kl1.sys
10:46:35.0805 0x15c8  KL1 - ok
10:46:35.0815 0x15c8  [ 2A88EFE87B5F23BA47FF7AF2DEAEB98F, 8D702249A462F8A233B594DF1B7C843A2C90F8A0D4FA7358B096020FF2C3E115 ] klflt           C:\Windows\system32\DRIVERS\klflt.sys
10:46:35.0825 0x15c8  klflt - ok
10:46:35.0835 0x15c8  [ 7ED6B6805B3E1BC9DC2418F1C5C920B4, 7FF90C32C95E2141A3D3B378DDE8035C8C6EB811C087A9AF7D20C735CB74142A ] klhk            C:\Windows\system32\DRIVERS\klhk.sys
10:46:35.0855 0x15c8  klhk - ok
10:46:35.0875 0x15c8  [ CD81447AB991F3E7F1FCF59CEA07D1E0, FB6EDDCA703952FAD7FEE24A75DB5C957C45C83B17D4871D1009CA24450CB040 ] KLIF            C:\Windows\system32\DRIVERS\klif.sys
10:46:35.0912 0x15c8  KLIF - ok
10:46:35.0914 0x15c8  [ FEAD1F401CBE9383A642877A6EA1398F, 0529A96D406DAB1C0715692441BDBC1C05123EB62005B806A8EFF5B0B6DCD5DB ] KLIM6           C:\Windows\system32\DRIVERS\klim6.sys
10:46:35.0924 0x15c8  KLIM6 - ok
10:46:35.0924 0x15c8  [ 3FAE739F2AFEA18BCBB9C5E7DC6E889D, 5990C074BCB8E2172AE0A2AC0A31E6636B3C3EF0A5BB1F593E62D22D53FC5BF0 ] klkbdflt        C:\Windows\system32\DRIVERS\klkbdflt.sys
10:46:35.0934 0x15c8  klkbdflt - ok
10:46:35.0944 0x15c8  [ 72CF64FBF38CD681FA7F37176047E967, BE5683C119DCEF7E678EE477D6CADF873E32D42372A253B7E86B8C335DF28E1C ] klmouflt        C:\Windows\system32\DRIVERS\klmouflt.sys
10:46:35.0954 0x15c8  klmouflt - ok
10:46:35.0954 0x15c8  [ 8C0EC95AD65A0DE3D6C040591D02BF02, 272FB83752B73684FA7BDBE256FAFD56138E4755AAEFED9E7EF8F0E3D0ACFAF2 ] klpd            C:\Windows\system32\DRIVERS\klpd.sys
10:46:35.0964 0x15c8  klpd - ok
10:46:35.0974 0x15c8  [ 5BB9E329FE48904108BBBF9C73073920, 402E88770C12C9E8D809D2A8C130CA9E5083CDB1D50C38D4CE2F0D24F2D32E82 ] kltdi           C:\Windows\system32\DRIVERS\kltdi.sys
10:46:35.0984 0x15c8  kltdi - ok
10:46:35.0994 0x15c8  KMService - ok
10:46:35.0994 0x15c8  [ D043624FE4AE0A4894A785097C02EF09, 2259CA9BAC73902D291176AB689C101CACE115A8A1C2E6824CC66E928FA27552 ] kneps           C:\Windows\system32\DRIVERS\kneps.sys
10:46:36.0014 0x15c8  kneps - ok
10:46:36.0024 0x15c8  [ 56ED3EE5FED6BF2FC1305CF872042868, 44F77AE3CD83284800FF106156ABCB63047327855E2535EE278289AF6F05579C ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
10:46:36.0034 0x15c8  KSecDD - ok
10:46:36.0044 0x15c8  [ 8BA90F480705D7153AD0060CCA62222A, B3E610DFAB382368114D026947084A72AFC4F5BF9C28317F411D4ED91E0B3192 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
10:46:36.0054 0x15c8  KSecPkg - ok
10:46:36.0064 0x15c8  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
10:46:36.0094 0x15c8  ksthunk - ok
10:46:36.0104 0x15c8  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
10:46:36.0153 0x15c8  KtmRm - ok
10:46:36.0163 0x15c8  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
10:46:36.0193 0x15c8  LanmanServer - ok
10:46:36.0203 0x15c8  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
10:46:36.0243 0x15c8  LanmanWorkstation - ok
10:46:36.0243 0x15c8  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
10:46:36.0283 0x15c8  lltdio - ok
10:46:36.0293 0x15c8  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
10:46:36.0332 0x15c8  lltdsvc - ok
10:46:36.0332 0x15c8  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
10:46:36.0372 0x15c8  lmhosts - ok
10:46:36.0382 0x15c8  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
10:46:36.0392 0x15c8  LSI_FC - ok
10:46:36.0402 0x15c8  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
10:46:36.0412 0x15c8  LSI_SAS - ok
10:46:36.0422 0x15c8  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
10:46:36.0432 0x15c8  LSI_SAS2 - ok
10:46:36.0442 0x15c8  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
10:46:36.0452 0x15c8  LSI_SCSI - ok
10:46:36.0462 0x15c8  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
10:46:36.0502 0x15c8  luafv - ok
10:46:36.0502 0x15c8  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
10:46:36.0522 0x15c8  Mcx2Svc - ok
10:46:36.0534 0x15c8  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
10:46:36.0551 0x15c8  megasas - ok
10:46:36.0571 0x15c8  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
10:46:36.0591 0x15c8  MegaSR - ok
10:46:36.0591 0x15c8  Microsoft SharePoint Workspace Audit Service - ok
10:46:36.0601 0x15c8  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
10:46:36.0641 0x15c8  MMCSS - ok
10:46:36.0641 0x15c8  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
10:46:36.0671 0x15c8  Modem - ok
10:46:36.0681 0x15c8  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
10:46:36.0691 0x15c8  monitor - ok
10:46:36.0701 0x15c8  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
10:46:36.0711 0x15c8  mouclass - ok
10:46:36.0721 0x15c8  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
10:46:36.0731 0x15c8  mouhid - ok
10:46:36.0741 0x15c8  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
10:46:36.0750 0x15c8  mountmgr - ok
10:46:36.0760 0x15c8  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
10:46:36.0770 0x15c8  mpio - ok
10:46:36.0780 0x15c8  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
10:46:36.0810 0x15c8  mpsdrv - ok
10:46:36.0840 0x15c8  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
10:46:36.0890 0x15c8  MpsSvc - ok
10:46:36.0900 0x15c8  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
10:46:36.0910 0x15c8  MRxDAV - ok
10:46:36.0920 0x15c8  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
10:46:36.0940 0x15c8  mrxsmb - ok
10:46:36.0954 0x15c8  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
10:46:36.0969 0x15c8  mrxsmb10 - ok
10:46:36.0979 0x15c8  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
10:46:36.0989 0x15c8  mrxsmb20 - ok
10:46:36.0999 0x15c8  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
10:46:37.0009 0x15c8  msahci - ok
10:46:37.0021 0x15c8  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
10:46:37.0034 0x15c8  msdsm - ok
10:46:37.0044 0x15c8  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
10:46:37.0054 0x15c8  MSDTC - ok
10:46:37.0064 0x15c8  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
10:46:37.0094 0x15c8  Msfs - ok
10:46:37.0104 0x15c8  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
10:46:37.0134 0x15c8  mshidkmdf - ok
10:46:37.0144 0x15c8  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
10:46:37.0158 0x15c8  msisadrv - ok
10:46:37.0166 0x15c8  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
10:46:37.0197 0x15c8  MSiSCSI - ok
10:46:37.0207 0x15c8  msiserver - ok
10:46:37.0207 0x15c8  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
10:46:37.0237 0x15c8  MSKSSRV - ok
10:46:37.0247 0x15c8  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
10:46:37.0277 0x15c8  MSPCLOCK - ok
10:46:37.0287 0x15c8  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
10:46:37.0314 0x15c8  MSPQM - ok
10:46:37.0324 0x15c8  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
10:46:37.0355 0x15c8  MsRPC - ok
10:46:37.0362 0x15c8  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
10:46:37.0373 0x15c8  mssmbios - ok
10:46:37.0373 0x15c8  MSSQL$MYMOVIES - ok
10:46:37.0383 0x15c8  [ 1D89EB4E2A99CABD4E81225F4F4C4B25, B9C4D956E3F74CB463A1A14287F4B550381FBB3E4B2DF9418E041E02A159E31E ] MSSQLServerADHelper C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe
10:46:37.0393 0x15c8  MSSQLServerADHelper - ok
10:46:37.0393 0x15c8  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
10:46:37.0423 0x15c8  MSTEE - ok
10:46:37.0433 0x15c8  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
10:46:37.0443 0x15c8  MTConfig - ok
10:46:37.0453 0x15c8  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
10:46:37.0463 0x15c8  Mup - ok
10:46:37.0483 0x15c8  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
10:46:37.0523 0x15c8  napagent - ok
10:46:37.0533 0x15c8  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
10:46:37.0564 0x15c8  NativeWifiP - ok
10:46:37.0582 0x15c8  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
10:46:37.0622 0x15c8  NDIS - ok
10:46:37.0632 0x15c8  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
10:46:37.0662 0x15c8  NdisCap - ok
10:46:37.0662 0x15c8  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
10:46:37.0702 0x15c8  NdisTapi - ok
10:46:37.0702 0x15c8  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
10:46:37.0732 0x15c8  Ndisuio - ok
10:46:37.0742 0x15c8  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
10:46:37.0785 0x15c8  NdisWan - ok
10:46:37.0791 0x15c8  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
10:46:37.0824 0x15c8  NDProxy - ok
10:46:37.0830 0x15c8  [ DC6530A291D4BDF6DF399F1F128E7F8F, 85123D802063383646EEBC60F4ABBCDBA2AE3180E99A8A99C024B1EBB0C6690E ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
10:46:37.0836 0x15c8  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
10:46:37.0836 0x15c8  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
10:46:37.0841 0x15c8  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
10:46:37.0875 0x15c8  NetBIOS - ok
10:46:37.0885 0x15c8  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
10:46:37.0923 0x15c8  NetBT - ok
10:46:37.0928 0x15c8  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] Netlogon        C:\Windows\system32\lsass.exe
10:46:37.0941 0x15c8  Netlogon - ok
10:46:37.0953 0x15c8  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
10:46:37.0996 0x15c8  Netman - ok
10:46:38.0004 0x15c8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:46:38.0025 0x15c8  NetMsmqActivator - ok
10:46:38.0031 0x15c8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:46:38.0047 0x15c8  NetPipeActivator - ok
10:46:38.0063 0x15c8  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
10:46:38.0108 0x15c8  netprofm - ok
10:46:38.0115 0x15c8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:46:38.0131 0x15c8  NetTcpActivator - ok
10:46:38.0131 0x15c8  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:46:38.0151 0x15c8  NetTcpPortSharing - ok
10:46:38.0151 0x15c8  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
10:46:38.0171 0x15c8  nfrd960 - ok
10:46:38.0184 0x15c8  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
10:46:38.0200 0x15c8  NlaSvc - ok
10:46:38.0210 0x15c8  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
10:46:38.0240 0x15c8  Npfs - ok
10:46:38.0250 0x15c8  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
10:46:38.0280 0x15c8  nsi - ok
10:46:38.0290 0x15c8  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
10:46:38.0322 0x15c8  nsiproxy - ok
10:46:38.0362 0x15c8  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
10:46:38.0421 0x15c8  Ntfs - ok
10:46:38.0421 0x15c8  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
10:46:38.0511 0x15c8  Null - ok
10:46:38.0819 0x15c8  [ 2232AE1BB51A96A7381A2CA17DF12E24, 4813E27BC14EB3CBD55AF89B098EA5C8DA4C7FF0B6CCB7AACFC43BC0E578C988 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
10:46:39.0158 0x15c8  nvlddmkm - ok
10:46:39.0168 0x15c8  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
10:46:39.0188 0x15c8  nvraid - ok
10:46:39.0198 0x15c8  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
10:46:39.0208 0x15c8  nvstor - ok
10:46:39.0237 0x15c8  [ 2C8DD5A34A81715865D66D7AF39362A6, 62F9D873127921EE2EAA80B73E8994C4BF6DA7EEDACAEA030B8D58E086FD3850 ] nvsvc           C:\Windows\system32\nvvsvc.exe
10:46:39.0267 0x15c8  nvsvc - ok
10:46:39.0277 0x15c8  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
10:46:39.0287 0x15c8  nv_agp - ok
10:46:39.0297 0x15c8  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
10:46:39.0307 0x15c8  ohci1394 - ok
10:46:39.0377 0x15c8  [ 7FAF1A9714B85A0C4101688779F9978E, B680D9FF72B85B3F269B8B82D98882C71FD8207B7A449098085ADBF1377D5EA5 ] OODefragAgent   C:\Program Files\OO Software\Defrag\oodag.exe
10:46:39.0436 0x15c8  OODefragAgent - ok
10:46:39.0486 0x15c8  [ EF8DA126239D08B7B4734256417AE702, 4BBA0577C20E851F5B30D0D0F19382AB32AF57EFF7AA5B394E0FF6358A7AB287 ] Origin Client Service C:\Program Files (x86)\Origin\OriginClientService.exe
10:46:39.0546 0x15c8  Origin Client Service - ok
10:46:39.0556 0x15c8  [ 4965B005492CBA7719E82B71E3245495, 52AD72C05FACC1E0E416A1FA25F34FDD3CB274FAB973BEAAE911A2FACA42B650 ] ose64           C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:46:39.0566 0x15c8  ose64 - ok
10:46:39.0678 0x15c8  [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
10:46:39.0797 0x15c8  osppsvc - ok
10:46:39.0817 0x15c8  [ 0E2DE427EBE106E7E5B52869D5C99F68, D61B1B8847BC561785B64507D1D551B0184B1ACED960AF629F7AF5D6C3A30BB1 ] ossrv           C:\Windows\system32\drivers\ctoss2k.sys
10:46:39.0827 0x15c8  ossrv - ok
10:46:39.0846 0x15c8  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
10:46:39.0866 0x15c8  p2pimsvc - ok
10:46:39.0876 0x15c8  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
10:46:39.0906 0x15c8  p2psvc - ok
10:46:39.0916 0x15c8  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
10:46:39.0926 0x15c8  Parport - ok
10:46:39.0936 0x15c8  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
10:46:39.0946 0x15c8  partmgr - ok
10:46:39.0956 0x15c8  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
10:46:39.0976 0x15c8  PcaSvc - ok
10:46:39.0986 0x15c8  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
10:46:40.0006 0x15c8  pci - ok
10:46:40.0006 0x15c8  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
10:46:40.0016 0x15c8  pciide - ok
10:46:40.0026 0x15c8  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
10:46:40.0051 0x15c8  pcmcia - ok
10:46:40.0055 0x15c8  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
10:46:40.0065 0x15c8  pcw - ok
10:46:40.0085 0x15c8  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
10:46:40.0135 0x15c8  PEAUTH - ok
10:46:40.0165 0x15c8  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
10:46:40.0215 0x15c8  PeerDistSvc - ok
10:46:40.0245 0x15c8  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
10:46:40.0264 0x15c8  PerfHost - ok
10:46:40.0304 0x15c8  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
10:46:40.0374 0x15c8  pla - ok
10:46:40.0384 0x15c8  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
10:46:40.0404 0x15c8  PlugPlay - ok
10:46:40.0414 0x15c8  [ 71F62C51DFDFBC04C83C5C64B2B8058E, CAB12E6D27BE421BD5A3CB04066EA50303A3210332ECC4B5C03B5F19735FC857 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
10:46:40.0424 0x15c8  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
10:46:40.0424 0x15c8  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
10:46:40.0424 0x15c8  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
10:46:40.0434 0x15c8  PNRPAutoReg - ok
10:46:40.0454 0x15c8  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
10:46:40.0473 0x15c8  PNRPsvc - ok
10:46:40.0483 0x15c8  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
10:46:40.0533 0x15c8  PolicyAgent - ok
10:46:40.0543 0x15c8  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
10:46:40.0583 0x15c8  Power - ok
10:46:40.0583 0x15c8  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
10:46:40.0623 0x15c8  PptpMiniport - ok
10:46:40.0623 0x15c8  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
10:46:40.0643 0x15c8  Processor - ok
10:46:40.0653 0x15c8  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
10:46:40.0663 0x15c8  ProfSvc - ok
10:46:40.0676 0x15c8  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] ProtectedStorage C:\Windows\system32\lsass.exe
10:46:40.0682 0x15c8  ProtectedStorage - ok
10:46:40.0692 0x15c8  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
10:46:40.0722 0x15c8  Psched - ok
10:46:40.0762 0x15c8  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
10:46:40.0812 0x15c8  ql2300 - ok
10:46:40.0822 0x15c8  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
10:46:40.0842 0x15c8  ql40xx - ok
10:46:40.0842 0x15c8  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
10:46:40.0872 0x15c8  QWAVE - ok
10:46:40.0872 0x15c8  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
10:46:40.0891 0x15c8  QWAVEdrv - ok
10:46:40.0901 0x15c8  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
10:46:40.0931 0x15c8  RasAcd - ok
10:46:40.0931 0x15c8  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
10:46:40.0971 0x15c8  RasAgileVpn - ok
10:46:40.0971 0x15c8  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
10:46:41.0011 0x15c8  RasAuto - ok
10:46:41.0021 0x15c8  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
10:46:41.0051 0x15c8  Rasl2tp - ok
10:46:41.0071 0x15c8  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
10:46:41.0103 0x15c8  RasMan - ok
10:46:41.0113 0x15c8  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
10:46:41.0143 0x15c8  RasPppoe - ok
10:46:41.0153 0x15c8  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
10:46:41.0193 0x15c8  RasSstp - ok
10:46:41.0203 0x15c8  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
10:46:41.0243 0x15c8  rdbss - ok
10:46:41.0243 0x15c8  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
10:46:41.0264 0x15c8  rdpbus - ok
10:46:41.0269 0x15c8  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
10:46:41.0301 0x15c8  RDPCDD - ok
10:46:41.0311 0x15c8  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
10:46:41.0321 0x15c8  RDPDR - ok
10:46:41.0331 0x15c8  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
10:46:41.0361 0x15c8  RDPENCDD - ok
10:46:41.0371 0x15c8  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
10:46:41.0401 0x15c8  RDPREFMP - ok
10:46:41.0411 0x15c8  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
10:46:41.0428 0x15c8  RdpVideoMiniport - ok
10:46:41.0436 0x15c8  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
10:46:41.0457 0x15c8  RDPWD - ok
10:46:41.0466 0x15c8  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
10:46:41.0483 0x15c8  rdyboost - ok
10:46:41.0489 0x15c8  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
10:46:41.0521 0x15c8  RemoteAccess - ok
10:46:41.0531 0x15c8  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
10:46:41.0571 0x15c8  RemoteRegistry - ok
10:46:41.0581 0x15c8  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
10:46:41.0621 0x15c8  RpcEptMapper - ok
10:46:41.0631 0x15c8  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
10:46:41.0641 0x15c8  RpcLocator - ok
10:46:41.0661 0x15c8  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
10:46:41.0700 0x15c8  RpcSs - ok
10:46:41.0710 0x15c8  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
10:46:41.0740 0x15c8  rspndr - ok
10:46:41.0760 0x15c8  [ EE082E06A82FF630351D1E0EBBD3D8D0, 537F1A4108BDA72E8DD271466E7B7FCF39D4D55E4129AB35A409AB7AF2E7D219 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
10:46:41.0780 0x15c8  RTL8167 - ok
10:46:41.0790 0x15c8  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
10:46:41.0800 0x15c8  s3cap - ok
10:46:41.0800 0x15c8  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] SamSs           C:\Windows\system32\lsass.exe
10:46:41.0820 0x15c8  SamSs - ok
10:46:41.0820 0x15c8  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
10:46:41.0840 0x15c8  sbp2port - ok
10:46:41.0840 0x15c8  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
10:46:41.0880 0x15c8  SCardSvr - ok
10:46:41.0890 0x15c8  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
10:46:41.0919 0x15c8  scfilter - ok
10:46:41.0949 0x15c8  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
10:46:42.0009 0x15c8  Schedule - ok
10:46:42.0019 0x15c8  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
10:46:42.0049 0x15c8  SCPolicySvc - ok
10:46:42.0059 0x15c8  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
10:46:42.0079 0x15c8  SDRSVC - ok
10:46:42.0079 0x15c8  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
10:46:42.0116 0x15c8  secdrv - ok
10:46:42.0118 0x15c8  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
10:46:42.0148 0x15c8  seclogon - ok
10:46:42.0158 0x15c8  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
10:46:42.0188 0x15c8  SENS - ok
10:46:42.0198 0x15c8  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
10:46:42.0208 0x15c8  SensrSvc - ok
10:46:42.0218 0x15c8  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
10:46:42.0228 0x15c8  Serenum - ok
10:46:42.0238 0x15c8  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
10:46:42.0248 0x15c8  Serial - ok
10:46:42.0248 0x15c8  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
10:46:42.0268 0x15c8  sermouse - ok
10:46:42.0278 0x15c8  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
10:46:42.0320 0x15c8  SessionEnv - ok
10:46:42.0325 0x15c8  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
10:46:42.0337 0x15c8  sffdisk - ok
10:46:42.0337 0x15c8  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
10:46:42.0357 0x15c8  sffp_mmc - ok
10:46:42.0357 0x15c8  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
10:46:42.0377 0x15c8  sffp_sd - ok
10:46:42.0377 0x15c8  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
10:46:42.0397 0x15c8  sfloppy - ok
10:46:42.0407 0x15c8  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
10:46:42.0451 0x15c8  SharedAccess - ok
10:46:42.0465 0x15c8  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
10:46:42.0511 0x15c8  ShellHWDetection - ok
10:46:42.0517 0x15c8  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
10:46:42.0532 0x15c8  SiSRaid2 - ok
10:46:42.0540 0x15c8  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
10:46:42.0557 0x15c8  SiSRaid4 - ok
10:46:42.0568 0x15c8  [ A9C057A9463C25490CF99EA8DF8A4B35, 8F4D1C40D0F17EDBF84ED455B8946F782C7552383F0A07E410A9B6CFF7F51D63 ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
10:46:42.0593 0x15c8  SkypeUpdate - ok
10:46:42.0600 0x15c8  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
10:46:42.0640 0x15c8  Smb - ok
10:46:42.0649 0x15c8  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
10:46:42.0665 0x15c8  SNMPTRAP - ok
10:46:42.0670 0x15c8  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
10:46:42.0686 0x15c8  spldr - ok
10:46:42.0704 0x15c8  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
10:46:42.0733 0x15c8  Spooler - ok
10:46:42.0820 0x15c8  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
10:46:42.0957 0x15c8  sppsvc - ok
10:46:42.0965 0x15c8  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
10:46:43.0003 0x15c8  sppuinotify - ok
10:46:43.0013 0x15c8  [ 86EBD8B1F23E743AAD21F4D5B4D40985, 8FA4DFDAE15712266B878C364FEFDB63CB30A3DCC25F83CDFE8C8AB3AE864BE6 ] SQLBrowser      C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
10:46:43.0030 0x15c8  SQLBrowser - ok
10:46:43.0037 0x15c8  [ 3C432A96363097870995E2A3C8B66ABD, AA0AE0935FC5317FE93D7D3C3B9A6B2E026915D07704AF3E36F14FEA8595F4A6 ] SQLWriter       C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
10:46:43.0049 0x15c8  SQLWriter - ok
10:46:43.0065 0x15c8  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
10:46:43.0089 0x15c8  srv - ok
10:46:43.0103 0x15c8  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
10:46:43.0127 0x15c8  srv2 - ok
10:46:43.0132 0x15c8  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
10:46:43.0142 0x15c8  srvnet - ok
10:46:43.0152 0x15c8  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
10:46:43.0192 0x15c8  SSDPSRV - ok
10:46:43.0202 0x15c8  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
10:46:43.0232 0x15c8  SstpSvc - ok
10:46:43.0242 0x15c8  Steam Client Service - ok
10:46:43.0242 0x15c8  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
10:46:43.0262 0x15c8  stexstor - ok
10:46:43.0262 0x15c8  [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
10:46:43.0279 0x15c8  StillCam - ok
10:46:43.0289 0x15c8  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
10:46:43.0332 0x15c8  stisvc - ok
10:46:43.0337 0x15c8  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
10:46:43.0348 0x15c8  storflt - ok
10:46:43.0348 0x15c8  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
10:46:43.0368 0x15c8  StorSvc - ok
10:46:43.0368 0x15c8  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
10:46:43.0378 0x15c8  storvsc - ok
10:46:43.0388 0x15c8  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
10:46:43.0398 0x15c8  swenum - ok
10:46:43.0418 0x15c8  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
10:46:43.0458 0x15c8  swprv - ok
10:46:43.0478 0x15c8  [ 1001FE2D332F7D82CBB62ABAF014948F, 3A9A5A9255DF876732D33126AF4579566C0CAF9BA2C5684E7D1D1F5F4F85A989 ] SynoDrService   C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe
10:46:43.0488 0x15c8  SynoDrService - ok
10:46:43.0541 0x15c8  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
10:46:43.0637 0x15c8  SysMain - ok
10:46:43.0647 0x15c8  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
10:46:43.0667 0x15c8  TabletInputService - ok
10:46:43.0677 0x15c8  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
10:46:43.0717 0x15c8  TapiSrv - ok
10:46:43.0727 0x15c8  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
10:46:43.0766 0x15c8  TBS - ok
10:46:43.0806 0x15c8  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
10:46:43.0866 0x15c8  Tcpip - ok
10:46:43.0916 0x15c8  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
10:46:43.0975 0x15c8  TCPIP6 - ok
10:46:43.0985 0x15c8  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
10:46:43.0995 0x15c8  tcpipreg - ok
10:46:44.0005 0x15c8  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
10:46:44.0015 0x15c8  TDPIPE - ok
10:46:44.0025 0x15c8  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
10:46:44.0035 0x15c8  TDTCP - ok
10:46:44.0035 0x15c8  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
10:46:44.0055 0x15c8  tdx - ok
10:46:44.0065 0x15c8  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
10:46:44.0075 0x15c8  TermDD - ok
10:46:44.0095 0x15c8  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
10:46:44.0125 0x15c8  TermService - ok
10:46:44.0125 0x15c8  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
10:46:44.0145 0x15c8  Themes - ok
10:46:44.0155 0x15c8  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
10:46:44.0184 0x15c8  THREADORDER - ok
10:46:44.0194 0x15c8  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
10:46:44.0234 0x15c8  TrkWks - ok
10:46:44.0234 0x15c8  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
10:46:44.0274 0x15c8  TrustedInstaller - ok
10:46:44.0284 0x15c8  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
10:46:44.0294 0x15c8  tssecsrv - ok
10:46:44.0304 0x15c8  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
10:46:44.0314 0x15c8  TsUsbFlt - ok
10:46:44.0324 0x15c8  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
10:46:44.0354 0x15c8  tunnel - ok
10:46:44.0364 0x15c8  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
10:46:44.0380 0x15c8  uagp35 - ok
10:46:44.0383 0x15c8  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
10:46:44.0423 0x15c8  udfs - ok
10:46:44.0433 0x15c8  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
10:46:44.0453 0x15c8  UI0Detect - ok
10:46:44.0453 0x15c8  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
10:46:44.0473 0x15c8  uliagpkx - ok
10:46:44.0473 0x15c8  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
10:46:44.0493 0x15c8  umbus - ok
10:46:44.0493 0x15c8  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
10:46:44.0503 0x15c8  UmPass - ok
10:46:44.0513 0x15c8  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
10:46:44.0533 0x15c8  UmRdpService - ok
10:46:44.0543 0x15c8  [ 9DC07E73A4ABB9ACF692113B36A5009F, CA7176FC219515D58DCFA66EC61880ECE5617275C9B83701BB74D8B60E733D34 ] UnlockerDriver5 C:\Program Files\Unlocker\UnlockerDriver5.sys
10:46:44.0553 0x15c8  UnlockerDriver5 - ok
10:46:44.0563 0x15c8  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
10:46:44.0602 0x15c8  upnphost - ok
10:46:44.0612 0x15c8  [ C9E9D59C0099A9FF51697E9306A44240, 78D9A7A5E5742962B6978F475BF06CB32262F1D214699D3D40538476A58012A1 ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys
10:46:44.0612 0x15c8  USBAAPL64 - detected UnsignedFile.Multi.Generic ( 1 )
10:46:44.0612 0x15c8  USBAAPL64 ( UnsignedFile.Multi.Generic ) - warning
10:46:44.0622 0x15c8  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
10:46:44.0642 0x15c8  usbaudio - ok
10:46:44.0642 0x15c8  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
10:46:44.0662 0x15c8  usbccgp - ok
10:46:44.0672 0x15c8  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
10:46:44.0682 0x15c8  usbcir - ok
10:46:44.0692 0x15c8  [ 635686E528F2C9CB916EC1BB04EE6AD1, 080A0F209773232860F510F17005EF92650BA831F69BB0006AEF11A2BB0A4906 ] UsbClientService C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
10:46:44.0702 0x15c8  UsbClientService - ok
10:46:44.0712 0x15c8  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
10:46:44.0722 0x15c8  usbehci - ok
10:46:44.0742 0x15c8  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
10:46:44.0762 0x15c8  usbhub - ok
10:46:44.0772 0x15c8  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
10:46:44.0782 0x15c8  usbohci - ok
10:46:44.0794 0x15c8  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
10:46:44.0801 0x15c8  usbprint - ok
10:46:44.0811 0x15c8  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
10:46:44.0831 0x15c8  USBSTOR - ok
10:46:44.0831 0x15c8  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys
10:46:44.0851 0x15c8  usbuhci - ok
10:46:44.0851 0x15c8  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
10:46:44.0891 0x15c8  UxSms - ok
10:46:44.0891 0x15c8  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] VaultSvc        C:\Windows\system32\lsass.exe
10:46:44.0911 0x15c8  VaultSvc - ok
10:46:44.0911 0x15c8  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
10:46:44.0931 0x15c8  vdrvroot - ok
10:46:44.0951 0x15c8  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
10:46:44.0991 0x15c8  vds - ok
10:46:45.0005 0x15c8  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
10:46:45.0020 0x15c8  vga - ok
10:46:45.0020 0x15c8  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
10:46:45.0060 0x15c8  VgaSave - ok
10:46:45.0070 0x15c8  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
10:46:45.0080 0x15c8  vhdmp - ok
10:46:45.0090 0x15c8  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
10:46:45.0100 0x15c8  viaide - ok
10:46:45.0110 0x15c8  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
10:46:45.0130 0x15c8  vmbus - ok
10:46:45.0130 0x15c8  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
10:46:45.0140 0x15c8  VMBusHID - ok
10:46:45.0150 0x15c8  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
10:46:45.0160 0x15c8  volmgr - ok
10:46:45.0180 0x15c8  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
10:46:45.0200 0x15c8  volmgrx - ok
10:46:45.0215 0x15c8  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
10:46:45.0229 0x15c8  volsnap - ok
10:46:45.0239 0x15c8  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
10:46:45.0259 0x15c8  vsmraid - ok
10:46:45.0299 0x15c8  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
10:46:45.0369 0x15c8  VSS - ok
10:46:45.0379 0x15c8  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
10:46:45.0389 0x15c8  vwifibus - ok
10:46:45.0409 0x15c8  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
10:46:45.0448 0x15c8  W32Time - ok
10:46:45.0458 0x15c8  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
10:46:45.0468 0x15c8  WacomPen - ok
10:46:45.0478 0x15c8  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
10:46:45.0518 0x15c8  WANARP - ok
10:46:45.0518 0x15c8  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
10:46:45.0558 0x15c8  Wanarpv6 - ok
10:46:45.0588 0x15c8  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
10:46:45.0637 0x15c8  WatAdminSvc - ok
10:46:45.0677 0x15c8  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
10:46:45.0727 0x15c8  wbengine - ok
10:46:45.0737 0x15c8  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
10:46:45.0767 0x15c8  WbioSrvc - ok
10:46:45.0777 0x15c8  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
10:46:45.0807 0x15c8  wcncsvc - ok
10:46:45.0807 0x15c8  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
10:46:45.0827 0x15c8  WcsPlugInService - ok
10:46:45.0827 0x15c8  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
10:46:45.0844 0x15c8  Wd - ok
10:46:45.0866 0x15c8  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
10:46:45.0896 0x15c8  Wdf01000 - ok
10:46:45.0906 0x15c8  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll
10:46:45.0916 0x15c8  WdiServiceHost - ok
10:46:45.0926 0x15c8  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\Windows\system32\wdi.dll
10:46:45.0946 0x15c8  WdiSystemHost - ok
10:46:45.0958 0x15c8  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
10:46:45.0977 0x15c8  WebClient - ok
10:46:45.0987 0x15c8  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
10:46:46.0027 0x15c8  Wecsvc - ok
10:46:46.0038 0x15c8  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
10:46:46.0066 0x15c8  wercplsupport - ok
10:46:46.0076 0x15c8  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
10:46:46.0116 0x15c8  WerSvc - ok
10:46:46.0116 0x15c8  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
10:46:46.0146 0x15c8  WfpLwf - ok
10:46:46.0156 0x15c8  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
10:46:46.0166 0x15c8  WIMMount - ok
10:46:46.0166 0x15c8  WinDefend - ok
10:46:46.0176 0x15c8  WinHttpAutoProxySvc - ok
10:46:46.0196 0x15c8  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
10:46:46.0226 0x15c8  Winmgmt - ok
10:46:46.0287 0x15c8  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll
10:46:46.0360 0x15c8  WinRM - ok
10:46:46.0372 0x15c8  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
10:46:46.0390 0x15c8  WinUsb - ok
10:46:46.0417 0x15c8  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
10:46:46.0459 0x15c8  Wlansvc - ok
10:46:46.0465 0x15c8  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
10:46:46.0479 0x15c8  WmiAcpi - ok
10:46:46.0490 0x15c8  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
10:46:46.0509 0x15c8  wmiApSrv - ok
10:46:46.0513 0x15c8  WMPNetworkSvc - ok
10:46:46.0520 0x15c8  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
10:46:46.0535 0x15c8  WPCSvc - ok
10:46:46.0544 0x15c8  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
10:46:46.0570 0x15c8  WPDBusEnum - ok
10:46:46.0577 0x15c8  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
10:46:46.0618 0x15c8  ws2ifsl - ok
10:46:46.0625 0x15c8  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
10:46:46.0645 0x15c8  wscsvc - ok
10:46:46.0650 0x15c8  WSearch - ok
10:46:46.0717 0x15c8  [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv        C:\Windows\system32\wuaueng.dll
10:46:46.0796 0x15c8  wuauserv - ok
10:46:46.0804 0x15c8  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
10:46:46.0821 0x15c8  WudfPf - ok
10:46:46.0832 0x15c8  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
10:46:46.0850 0x15c8  WUDFRd - ok
10:46:46.0857 0x15c8  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
10:46:46.0874 0x15c8  wudfsvc - ok
10:46:46.0884 0x15c8  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
10:46:46.0907 0x15c8  WwanSvc - ok
10:46:46.0930 0x15c8  [ 64F88AF327AA74E03658AE32B48CCB8B, 52C8941D96F2EF89BBC4A4268DC59E5BC89AE2DAB199C13BBFF11C2606BE7FFA ] yukonw7         C:\Windows\system32\DRIVERS\yk62x64.sys
10:46:46.0960 0x15c8  yukonw7 - ok
10:46:46.0966 0x15c8  ================ Scan global ===============================
10:46:46.0971 0x15c8  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
10:46:46.0982 0x15c8  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
10:46:46.0997 0x15c8  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
10:46:47.0007 0x15c8  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
10:46:47.0019 0x15c8  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
10:46:47.0029 0x15c8  [ Global ] - ok
10:46:47.0029 0x15c8  ================ Scan MBR ==================================
10:46:47.0032 0x15c8  [ 72B8CE41AF0DE751C946802B3ED844B4 ] \Device\Harddisk0\DR0
10:46:47.0071 0x15c8  \Device\Harddisk0\DR0 - ok
10:46:47.0073 0x15c8  [ B1F7D7F6E4FBE98E578562A22A94D02C ] \Device\Harddisk1\DR1
10:46:47.0143 0x15c8  \Device\Harddisk1\DR1 - ok
10:46:47.0143 0x15c8  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
10:46:47.0399 0x15c8  \Device\Harddisk2\DR2 - ok
10:46:47.0399 0x15c8  ================ Scan VBR ==================================
10:46:47.0409 0x15c8  [ 7D9082C5AC4CF9936B152099B98E11D1 ] \Device\Harddisk0\DR0\Partition1
10:46:47.0409 0x15c8  \Device\Harddisk0\DR0\Partition1 - ok
10:46:47.0409 0x15c8  [ 93416C4F4919DCB9E8913CB43345747D ] \Device\Harddisk1\DR1\Partition1
10:46:47.0409 0x15c8  \Device\Harddisk1\DR1\Partition1 - ok
10:46:47.0419 0x15c8  [ 82EAF6AA33CF086F9F14FC79280D6531 ] \Device\Harddisk1\DR1\Partition2
10:46:47.0419 0x15c8  \Device\Harddisk1\DR1\Partition2 - ok
10:46:47.0419 0x15c8  [ 35A0A92D20A1BCF46C5163A167F9A755 ] \Device\Harddisk2\DR2\Partition1
10:46:47.0419 0x15c8  \Device\Harddisk2\DR2\Partition1 - ok
10:46:47.0419 0x15c8  ================ Scan generic autorun ======================
10:46:47.0419 0x15c8  OODefragTray - ok
10:46:47.0464 0x15c8  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
10:46:47.0508 0x15c8  Sidebar - ok
10:46:47.0508 0x15c8  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
10:46:47.0528 0x15c8  mctadmin - ok
10:46:47.0566 0x15c8  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
10:46:47.0603 0x15c8  Sidebar - ok
10:46:47.0609 0x15c8  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
10:46:47.0627 0x15c8  mctadmin - ok
10:46:47.0645 0x15c8  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] C:\Users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe
10:46:47.0656 0x15c8  Google Update - ok
10:46:47.0657 0x15c8  ============================================================
10:46:47.0657 0x15c8  Scan finished
10:46:47.0657 0x15c8  ============================================================
10:46:47.0669 0x17e8  Detected object count: 6
10:46:47.0669 0x17e8  Actual detected object count: 6
10:47:37.0679 0x17e8  Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
10:47:37.0679 0x17e8  Creative Audio Engine Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
10:47:37.0681 0x17e8  Creative Dolby Digital Live Pack Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
10:47:37.0681 0x17e8  Creative Dolby Digital Live Pack Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
10:47:37.0683 0x17e8  CTAudSvcService ( UnsignedFile.Multi.Generic ) - skipped by user
10:47:37.0684 0x17e8  CTAudSvcService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
10:47:37.0686 0x17e8  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
10:47:37.0686 0x17e8  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
10:47:37.0687 0x17e8  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
10:47:37.0687 0x17e8  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
10:47:37.0689 0x17e8  USBAAPL64 ( UnsignedFile.Multi.Generic ) - skipped by user
10:47:37.0690 0x17e8  USBAAPL64 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
10:47:44.0486 0x12ec  Deinitialize success
__________________
Alt 17.03.2015, 15:52   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


hi,

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 17.03.2015, 19:31   #5
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Code:
ATTFilter
ComboFix 15-03-14.03 - Sebastian 17.03.2015  16:01:25.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4094.2621 [GMT 1:00]
ausgeführt von:: e:\downloads\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Temp\log.txt
c:\windows\wininit.ini
.
Infizierte Kopie von c:\windows\SysWow64\userinit.exe wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe wurde wiederhergestellt 
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-02-17 bis 2015-03-17  ))))))))))))))))))))))))))))))
.
.
2015-03-17 09:32 . 2015-03-17 09:43	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-03-17 07:53 . 2015-01-29 09:07	11910896	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{39E3E093-0F2D-46C6-88B2-F92A1F85E68E}\mpengine.dll
2015-03-12 14:37 . 2015-03-12 14:37	--------	d-----w-	c:\program files (x86)\Common Files\Java
2015-03-11 07:38 . 2015-01-29 03:23	5554104	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-03-11 07:38 . 2015-01-29 03:19	503808	----a-w-	c:\windows\system32\srcore.dll
2015-03-11 07:38 . 2015-01-29 03:19	50176	----a-w-	c:\windows\system32\srclient.dll
2015-03-11 07:38 . 2015-01-29 03:19	43520	----a-w-	c:\windows\system32\csrsrv.dll
2015-03-11 07:38 . 2015-01-29 03:18	112640	----a-w-	c:\windows\system32\smss.exe
2015-03-11 07:38 . 2015-01-29 03:18	296960	----a-w-	c:\windows\system32\rstrui.exe
2015-03-11 07:38 . 2015-01-29 03:05	3973048	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2015-03-11 07:38 . 2015-01-29 03:05	3917752	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2015-03-11 07:38 . 2015-01-29 03:01	43008	----a-w-	c:\windows\SysWow64\srclient.dll
2015-03-11 07:38 . 2015-01-29 03:16	6656	----a-w-	c:\windows\system32\apisetschema.dll
2015-03-11 07:38 . 2015-01-29 02:57	6656	----a-w-	c:\windows\SysWow64\apisetschema.dll
2015-03-11 07:36 . 2015-02-13 05:22	14177280	----a-w-	c:\windows\system32\shell32.dll
2015-02-25 12:01 . 2015-02-25 12:01	--------	d-----w-	c:\programdata\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-25 12:01 . 2015-02-25 12:01	--------	d-----w-	c:\program files\iTunes
2015-02-25 12:01 . 2015-02-25 12:01	--------	d-----w-	c:\program files\iPod
2015-02-23 14:36 . 2015-03-17 09:13	--------	d-----w-	C:\FRST
2015-02-17 22:02 . 2015-03-17 09:33	136408	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-02-17 22:02 . 2015-03-17 09:33	107736	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-02-17 22:02 . 2015-02-17 22:02	--------	d-----w-	c:\program files (x86)\ Malwarebytes Anti-Malware 
2015-02-17 22:02 . 2015-02-17 22:02	--------	d-----w-	c:\programdata\Malwarebytes
2015-02-17 22:02 . 2014-11-21 05:14	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2015-02-17 22:02 . 2014-11-21 05:14	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2015-02-17 18:07 . 2015-02-17 18:07	3238072	----a-w-	c:\program files\Common Files\Microsoft Shared\OFFICE14\1031\MSOINTL.DLL
2015-02-17 17:46 . 2015-02-17 17:49	--------	d-----w-	C:\AdwCleaner
2015-02-17 15:50 . 2015-01-09 03:14	91136	----a-w-	c:\windows\system32\wdi.dll
2015-02-17 15:50 . 2015-01-09 03:14	950272	----a-w-	c:\windows\system32\perftrack.dll
2015-02-17 15:50 . 2015-01-09 03:14	29696	----a-w-	c:\windows\system32\powertracker.dll
2015-02-17 15:50 . 2015-01-09 02:48	76800	----a-w-	c:\windows\SysWow64\wdi.dll
2015-02-17 14:19 . 2015-02-17 14:19	1614496	----a-w-	c:\windows\system32\FM20.DLL
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-12 14:37 . 2015-01-21 13:47	111016	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2015-03-12 14:35 . 2014-11-29 16:14	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-03-11 08:04 . 2011-07-28 10:17	122905848	----a-w-	c:\windows\system32\MRT.exe
2015-02-24 02:17 . 2011-07-28 09:36	295552	------w-	c:\windows\system32\MpSigStub.exe
2015-02-05 08:59 . 2014-05-16 10:15	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-02-05 08:59 . 2014-05-16 10:15	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-04 03:16 . 2015-02-11 11:17	609280	----a-w-	c:\windows\system32\generaltel.dll
2015-02-04 03:16 . 2015-02-11 11:17	762368	----a-w-	c:\windows\system32\invagent.dll
2015-02-04 03:16 . 2015-02-11 11:17	414720	----a-w-	c:\windows\system32\devinv.dll
2015-02-04 03:16 . 2015-02-11 11:17	894976	----a-w-	c:\windows\system32\appraiser.dll
2015-02-04 03:16 . 2015-02-11 11:17	227328	----a-w-	c:\windows\system32\aepdu.dll
2015-02-04 03:16 . 2015-02-11 11:17	192000	----a-w-	c:\windows\system32\aepic.dll
2015-02-04 03:13 . 2015-02-11 11:17	1098752	----a-w-	c:\windows\system32\aeinv.dll
2015-01-27 23:36 . 2015-02-11 11:17	1239720	----a-w-	c:\windows\system32\aitstatic.exe
2015-01-16 16:29 . 2015-01-16 16:29	25640	----a-w-	c:\windows\gdrv.sys
2014-12-19 03:06 . 2015-01-16 16:00	210432	----a-w-	c:\windows\system32\profsvc.dll
2014-12-19 01:46 . 2015-01-16 16:00	141312	----a-w-	c:\windows\system32\drivers\mrxdav.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	94208	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	94208	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	94208	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0OODBS\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe;c:\windows\SYSNATIVE\srvany.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 Creative Dolby Digital Live Pack Licensing Service;Creative Dolby Digital Live Pack Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe [x]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 AVP15.0.0;Kaspersky Anti-Virus Service 15.0.0;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [x]
S2 MSSQL$MYMOVIES;SQL Server (MYMOVIES);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe;c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [x]
S2 OODefragAgent;O&O Defrag;c:\program files\OO Software\Defrag\oodag.exe;c:\program files\OO Software\Defrag\oodag.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 SynoDrService;SynoDrService;c:\program files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe;c:\program files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe [x]
S2 UsbClientService;UsbClientService;c:\program files (x86)\Synology\Assistant\UsbClientService.exe;c:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys;c:\windows\SYSNATIVE\DRIVERS\avmaudio.sys [x]
S3 avmaura;AVM USB-Fernanschluss;c:\windows\system32\DRIVERS\avmaura.sys;c:\windows\SYSNATIVE\DRIVERS\avmaura.sys [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-16 08:59]
.
2015-03-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001Core.job
- c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-28 17:45]
.
2015-03-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001UA.job
- c:\users\Sebastian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-28 17:45]
.
2015-03-16 c:\windows\Tasks\Synology Data Replicator 3-Sebastian-PC-Sebastian.job
- c:\program files (x86)\Synology\Data Replicator  3\Backup.exe [2013-10-09 08:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mStart Page = about:blank
mDefault_Page_URL = hxxp://www.google.com
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-OODefragTray - c:\program files\OO Software\Defrag\oodtray.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1544781982-3593503346-2797692446-1001\Software\SecuROM\License information*]
"datasecu"=hex:fe,d9,ad,0c,c9,d1,4b,6d,c1,0a,32,48,3e,45,d0,01,a2,04,e6,07,89,
   2a,30,97,98,1c,8b,2d,bb,39,af,ec,6e,eb,da,9e,3e,97,87,a3,87,5a,18,90,06,71,\
"rkeysecu"=hex:c5,15,26,e4,0c,dc,3f,8d,6e,dc,14,d6,7f,26,fc,06
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="48EA86D91873AACD5E8007B50AB6ADA93C9D6569B9BAFBBEB275186447D9846259F729F8815BAE8EAF6EE82FDABB1C204D63B4FA5DB975F42A5B4D31B7B8C6C66B5B3F58D5ED6F67C842D7C491E4A440FD742B02E14E79284DCDAC13B09F80871472D17DAD06FAFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6A0AC4980AC7933FEBC9E127BECC74CFEBC9E127BECC74C531F0B34A25936417853798F76412BE387D420633E3EDA6EE27994B041990C34A0C86EBF0732D0F132878E43DDD5F976D4DF3E113FAFD869DB9390E9F4BF4B9042BC20CC1AE59F380E9E13E0E5FBC395070DF768C803475439DB6BCB57D9AB15CA6091AA0B8900199E865C8748A15AE84EF2A97B421E1095E5B025799E67C90901FD05AFFB57E5DEA892135F36D825590B8BFEDF070F2D5B02D88F1DF20FD7796142943282AED6172379B290505A9F955338FA306904B0925EFBD15F71191BB51C402A9128106D91BAD30E482F80D90F70BBF28C2B523DED81A6E672AA726C52136B07ACEBA0D6E3502148B9DCC9767CDFBD8F9705710DE5A6481C08252CB9A7DE9E3DE73F2CD76879C4DA1AD9D82DD8D3C85176A3FB6BB5BC36955858FA84514B95342D889F44BAFC0411221875C7E0AFCC075525B338DA6528CB9F33B760B0D6F3AAE8A08B073C58080F90FD89A6970F1D5862A0FBE899F73B069D945F7768B53DAD0BD7A81F133BE146A567A4BD42BF72BE4F9B5C057A7E706415529208E1CFDAA209ED4F9EA70C0302292479936C42E507531380284537AADA4D35966248BF1C405A1B7DAAA662BF5D6375DFC3E3CB77D4A9F639840D9432AE147B556B0B55B092FC87557E8189D5482294D0FCB9468C1C11AB79DC223EB57CB6D4599D6114AEF8F1D11D686E83618A36A96C834450E9274B0859899C0EC2310B66D485C0340F293C8B3D4B6504E53A77D5762D1FB9BC949FD895775791508FE64A9D4465A02F28643CC49C25F449463DAC5366A68892D5D75F0EA5728D34AFA68CAA8FD079D0D3785C65E6ACEF57ED673390ADFE7761AF444EC4AA50762D7CA9AE1B30C69199DA09DAF547C1C8BB46D565DB978B72FE3DB6CC632C1877DAB2D4A52E84CE7013422A996E716E038A37ED3287C9F99B266B05783668B4EE41E68D5A487CB551295FF4ED6EAB7F56B9009AFD8B803548F77C0BE02BAED570C7FEC129741E8A25AE6106A236CF85AFA4AEC89D828BF003F605A6895864EEC23DB65F645E82230E5945FCF5AD4BD52F882AEBDCAB4D24888AF0B9EA747F36DDD09B5BCFD65795E3C0DFFE19DDA20B2A882AF6FBE83D86CA7EFBADF0DA8FA67296122D26D2DC403364D8B5B273E980292ABBE4ABC1E5186E813AEAFB0DB18062874FCF926BE9C23AA3AB4DDCC14C5767"
"OODEFRAG16.00.00.01PROFESSIONAL"="787401444D599C3E603A29800980ECE1F9267EE2A5A72F72CF59628978B377628B636C3EE3B85E6223457D48E7BD39BAD4F69B468A0BA536F182271F888EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6171C11EC38DE3DA6171C11EC38DE3DA9C6AECB7A5D14075BEB6B0CE413F11441650DC7E3BEAE75D291C15FE727A376FBADD8408571317E6AF83477818405609C1612CE01F8CA3DB507A7F38892B6F529B08FB4CDD4D22FAF720A46599CAA61144C81A87351BA7FC693EC0569A038264BBB7AAF1B53A15B6EAE8EB3DB24A7E84EAC0967A03160B9B24CEC9C077DC64AB57541D7A0F819324004D61B90A7F4AECA624E430548CE4AFB4C786DF115B50E0F8A01F5A016E9448E4FED01127A3FCAD71BE516AF88D174783353C8CD1E8B7B522ACBF5763E76081B72D00A8DAEE6BD9B07DB5F4427E55FD023B4A8520E01834E08A5E80ECA56557850F37E47A07EE70FDCAEC1799E3D1784C2C828CD9F867A245C8784EA56566B0ED3BB4F936AD1127ED5D20499AE3C8A64BC31851ED3BD194CE15EA09F41746A1968810D5D70DA6489AF2E9185567E8D164080A7396BFC7C11D78CBA57B06457287E946DA3D4CBEEA72C1CF8305FCE5714FEBF15A6EE50A29183E5F3CE8C0F9C200B364AF60288239F906A6CA0513104AA2F6AF882A974F13F2C349057808E87B7861D227FA529D70E275F4572FAD991FD0DEFA47E2B5D32631CB27956FC32497B6EF21676B07BC7653D2E7BD3EE32E381D6B48ADC45AF9096A4943D44B57EF6C943556CAAD77E0F6925042F8A03D8C3804E11C4F60FC71C48987E8AAEA3AA8AD808D60FFD94E633B1337F24EAD11ED9983B518C39E434CABBCF0838B702A2E02E467D0CE6231E9AAC42333FE1B808B83BE735C2A2E5B5F38726BFBC94D185BB268CC2956F06400D9A2FA78D6E5A50D12DA16F6B4A744453957A27B70E57274071E71580B6821E3A115CD53D231D64FB8ABD2AAF55380A0B25B1B06880990EF793F05748ED203BB4F72EAD9F282A65743F908159811BE59E4A32C7335E6676D063BCDD09DBACD1730B8F122E39F029D98DF5825A9F4E6A76E86848232DCBD01B0E6AF306DA3BCCCFDD6EDA02A4A3B92F8ACB34C49243DCDE3F430463069F3F0D12995724589DCE08D23B52DA4DB6D35C22750ED15432B987D937BFC516F81940436EB96E58EF2940A3EC389B2C66E9AC10D87ADC6F96AC089B3BB33E9E35EB32CA1341126F0DE67CDC7BBECA4AAEA04FE761DBE5052E1CD43CCB0D6673F3F44222B38861C8184429DEE50D13C9D351570DFC0490C97D1B4CC5686EFA009829B81C001DD023F430145FACBDC35B5A0A3D3B1F3D24854A762E97146BDCC0CCAF3DD92D80FBCECC516F67D6E0CFC78D0D5C7E3E"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-03-17  16:11:59 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-03-17 15:11
.
Vor Suchlauf: 11 Verzeichnis(se), 167.620.382.720 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 173.585.952.768 Bytes frei
.
- - End Of File - - 8669AA7F01A617C8D3F3B5BA463A476C
72B8CE41AF0DE751C946802B3ED844B4
Mir ist etwas aufgefallen:

Ich bekomme im Outlook eine Meldung, dass mein Passwort bei einer Email-Adresse falsch sei. In dem Passwort-Feld sehe ich nun sehr viele "***", also das Kennwort wäre demnach viel länger, als es tatsächlich ist. Ich selbst habe daran nichts geändert.
Es ist die Email-Adresse, an die ich die ganzen Nachrichten gesendet bekam.


Alt 18.03.2015, 11:43   #6
schrauber
/// the machine
/// TB-Ausbilder
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Das ist normal dass da mehr * drin stehen als es wirklich sind.


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
--> Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten

Alt 18.03.2015, 12:17   #7
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 18.03.2015
Suchlauf-Zeit: 11:52:19
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.03.18.02
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Sebastian

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 366367
Verstrichene Zeit: 7 Min, 5 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
Code:
ATTFilter
# AdwCleaner v4.112 - Bericht erstellt 18/03/2015 um 12:03:05
# Aktualisiert 09/03/2015 von Xplode
# Datenbank : 2015-03-15.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Sebastian - SEBASTIAN-PC
# Gestarted von : E:\Downloads\AdwCleaner_4.112.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v0.0.0.0


-\\ Mozilla Firefox v


-\\ Google Chrome v

[C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.softonic.de/s/{searchTerms}
[C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3314932&octid=EB_ORIGINAL_CTID&ISID=M37BB1CE2-8BD4-418B-AB2B-8E3E57D0C3AF&SearchSource=58&CUI=&UM=5&UP=SP7D0EFF40-7EA8-45F1-A390-B6BAD1FDE679&q={searchTerms}&SSPV=

*************************

AdwCleaner[R0].txt - [2194 Bytes] - [17/02/2015 18:46:45]
AdwCleaner[R1].txt - [1379 Bytes] - [18/03/2015 12:01:21]
AdwCleaner[S0].txt - [2108 Bytes] - [17/02/2015 18:49:04]
AdwCleaner[S1].txt - [1301 Bytes] - [18/03/2015 12:03:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1360  Bytes] ##########
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.5 (03.17.2015:1)
OS: Windows 7 Professional x64
Ran by Sebastian on 18.03.2015 at 12:06:38,68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18.03.2015 at 12:10:58,15
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Sebastian (administrator) on SEBASTIAN-PC on 18-03-2015 12:13:11
Running from C:\Users\Sebastian\Desktop
Loaded Profiles: Sebastian (Available profiles: Sebastian)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodag.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [OODefragTray] => C:\Program Files\OO Software\Defrag\oodtray.exe
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * OODBSsdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-12] (Oracle Corporation)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-12] (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-12] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-12] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4A85DBE0-BFB2-4119-8401-186A7C6EB653} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/mjss/MJSS.cab109791.cab
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\772itop0.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-12] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-12] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-12] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll [2013-03-12] (Amazon.com, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.faz.net/
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3314932&octid=EB_ORIGINAL_CTID&ISID=M37BB1CE2-8BD4-418B-AB2B-8E3E57D0C3AF&SearchSource=55&CUI=&UM=5&UP=SP7D0EFF40-7EA8-45F1-A390-B6BAD1FDE679&SSPV="
CHR Profile: C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]
CHR Extension: (Google Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]
CHR Extension: (Kaspersky Protection) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-08-24]
CHR Extension: (The Camelizer - Amazon Price Tracker) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghnomdcacenbmilgjigehppbamfndblo [2013-10-11]
CHR Extension: (AdBlock) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-02-17]
CHR Extension: (feedly) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2013-03-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]
CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2011-07-28]
CHR Extension: (Google Wallet) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
StartMenuInternet: Google Chrome - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-01-03] (Creative Labs) [File not signed]
S3 Creative Dolby Digital Live Pack Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe [79360 2011-07-28] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2011-07-28] () [File not signed]
R2 MSSQL$MYMOVIES; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
R2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [2555760 2012-11-01] (O&O Software GmbH)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2015-01-24] (Electronic Arts)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 SynoDrService; C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe [384072 2013-10-09] ()
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2014-02-25] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2012-05-16] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-11-22] (AVM Berlin)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-09] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 12:13 - 2015-03-18 12:13 - 00020323 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2015-03-18 12:10 - 2015-03-18 12:10 - 00000629 _____ () C:\Users\Sebastian\Desktop\JRT.txt
2015-03-18 12:05 - 2015-03-18 12:06 - 01388672 _____ (Thisisu) C:\Users\Sebastian\Desktop\JRT.exe
2015-03-18 11:59 - 2015-03-18 11:59 - 00001203 _____ () C:\Users\Sebastian\Desktop\MBAM.txt
2015-03-18 11:49 - 2015-03-18 11:49 - 00025104 _____ () C:\ComboFix.txt
2015-03-18 11:40 - 2015-03-17 15:58 - 05615380 ____R (Swearware) C:\Users\Sebastian\Desktop\ComboFix.exe
2015-03-17 16:00 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-17 16:00 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-17 16:00 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-17 15:59 - 2015-03-18 11:49 - 00000000 ____D () C:\Qoobox
2015-03-17 15:59 - 2015-03-17 16:10 - 00000000 ____D () C:\Windows\erdnt
2015-03-17 10:32 - 2015-03-17 10:43 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-17 10:30 - 2015-03-17 10:30 - 00000000 ____D () C:\Users\Sebastian\Desktop\MBAR
2015-03-17 10:08 - 2015-03-17 10:08 - 00000000 ____N () C:\Users\Sebastian\Desktop\Neues Textdokument.txt
2015-03-17 09:40 - 2015-03-17 09:41 - 02095616 _____ (Farbar) C:\Users\Sebastian\Desktop\FRST64.exe
2015-03-11 11:54 - 2015-03-11 11:54 - 06208736 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.10.2_win32-setup.exe
2015-03-11 08:38 - 2015-01-29 04:23 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 08:38 - 2015-01-29 04:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 08:38 - 2015-01-29 04:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 08:38 - 2015-01-29 04:19 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 08:38 - 2015-01-29 04:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 08:38 - 2015-01-29 04:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 08:38 - 2015-01-29 04:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 08:38 - 2015-01-29 04:05 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 08:38 - 2015-01-29 04:05 - 03917752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 08:38 - 2015-01-29 04:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 08:38 - 2015-01-29 03:57 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 08:37 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 08:37 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 08:37 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 08:37 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 08:37 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 08:37 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 08:37 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 08:37 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 08:37 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 08:37 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 08:37 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 08:37 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 08:37 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 08:37 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 08:36 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 08:36 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 08:36 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 08:36 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 08:36 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 08:36 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 08:36 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 08:36 - 2015-02-04 04:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 08:36 - 2015-02-04 03:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 08:36 - 2015-02-03 04:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 08:36 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 08:36 - 2015-02-03 04:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 08:36 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 08:36 - 2015-01-31 04:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-11 08:36 - 2015-01-31 04:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-11 08:36 - 2015-01-31 00:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-11 08:36 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 08:36 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-02 16:42 - 2015-03-02 16:43 - 00000000 ____D () C:\Users\Sebastian\Desktop\DSL Annex B
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\Program Files\iTunes
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\Program Files\iPod
2015-02-25 12:54 - 2015-02-25 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-02-25 08:38 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 08:38 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-23 15:36 - 2015-03-18 12:13 - 00000000 ____D () C:\FRST
2015-02-17 23:02 - 2015-03-18 11:51 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-17 23:02 - 2015-03-17 10:33 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-17 23:02 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-17 23:02 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-17 18:46 - 2015-03-18 12:03 - 00000000 ____D () C:\AdwCleaner
2015-02-17 16:50 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-17 16:50 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-17 16:50 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-17 16:50 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-17 15:19 - 2015-02-17 15:19 - 01614496 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 12:11 - 2009-07-14 05:45 - 00025552 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-18 12:11 - 2009-07-14 05:45 - 00025552 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-18 12:09 - 2009-07-14 18:58 - 16025698 _____ () C:\Windows\system32\perfh007.dat
2015-03-18 12:09 - 2009-07-14 18:58 - 04981596 _____ () C:\Windows\system32\perfc007.dat
2015-03-18 12:09 - 2009-07-14 06:13 - 00006470 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-18 12:04 - 2011-07-28 10:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-03-18 12:03 - 2012-12-09 12:43 - 02913108 _____ () C:\Windows\system32\oodbs.lor
2015-03-18 12:03 - 2011-07-28 11:36 - 00148076 _____ () C:\Windows\PFRO.log
2015-03-18 12:03 - 2011-07-28 10:16 - 01910681 _____ () C:\Windows\WindowsUpdate.log
2015-03-18 12:03 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-18 12:03 - 2009-07-14 05:51 - 00227499 _____ () C:\Windows\setupact.log
2015-03-18 12:01 - 2011-07-28 10:18 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001UA.job
2015-03-18 11:59 - 2014-05-16 11:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-18 11:52 - 2011-07-28 23:24 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Skype
2015-03-18 11:47 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-17 21:26 - 2013-09-21 08:53 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\A33D40CB-D7EE-4111-8C05-89A9CBCBE699.aplzod
2015-03-17 21:26 - 2011-07-28 13:51 - 00000000 ____D () C:\Users\Sebastian\Documents\Outlook-Dateien
2015-03-17 19:53 - 2014-08-04 20:30 - 00000306 _____ () C:\Windows\Tasks\Synology Data Replicator 3-Sebastian-PC-Sebastian.job
2015-03-17 16:12 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-03-17 15:01 - 2011-07-28 10:18 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001Core.job
2015-03-16 19:34 - 2011-07-28 10:16 - 00000000 ____D () C:\Users\Sebastian
2015-03-16 14:58 - 2011-09-03 23:39 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\FileZilla
2015-03-16 10:52 - 2014-09-03 09:54 - 00000600 _____ () C:\Users\Sebastian\AppData\Local\PUTTY.RND
2015-03-13 12:45 - 2013-05-16 20:16 - 00000000 ____D () C:\Windows\rescache
2015-03-13 11:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-13 11:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-12 15:40 - 2014-11-29 17:14 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-12 15:39 - 2011-07-28 10:46 - 00000000 ____D () C:\Program Files\Java
2015-03-12 15:37 - 2015-01-21 14:47 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-03-12 15:36 - 2013-10-19 15:13 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-12 15:35 - 2014-11-29 17:14 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-11 11:48 - 2009-07-14 05:45 - 00341872 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-11 09:17 - 2011-07-28 11:20 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 09:10 - 2013-08-14 14:34 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-11 09:04 - 2011-07-28 11:17 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-11 09:03 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2015-03-06 13:52 - 2012-02-03 17:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\vlc
2015-03-02 19:05 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-25 13:01 - 2014-09-06 09:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-02-25 13:01 - 2011-12-24 16:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-25 13:01 - 2011-07-28 22:56 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-24 03:17 - 2011-07-28 10:36 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-20 16:36 - 2014-09-24 12:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-02-20 16:36 - 2011-07-28 23:24 - 00000000 ____D () C:\ProgramData\Skype
2015-02-17 23:17 - 2014-05-05 16:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-17 23:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2015-02-17 17:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing

==================== Files in the root of some directories =======

2011-12-30 09:29 - 2011-12-30 09:56 - 0001188 _____ () C:\Users\Sebastian\AppData\Local\crc32list11.txt
2012-07-08 21:01 - 2012-07-08 21:01 - 0004096 ____H () C:\Users\Sebastian\AppData\Local\keyfile3.drm
2014-09-03 09:54 - 2015-03-16 10:52 - 0000600 _____ () C:\Users\Sebastian\AppData\Local\PUTTY.RND
2011-11-03 12:06 - 2011-11-03 12:06 - 0000017 _____ () C:\Users\Sebastian\AppData\Local\resmon.resmoncfg
2011-07-28 10:55 - 2011-07-28 10:55 - 0017408 _____ () C:\Users\Sebastian\AppData\Local\WebpageIcons.db
2014-04-01 09:38 - 2014-04-01 09:38 - 0000040 ___SH () C:\ProgramData\.zreglib
2011-09-06 14:55 - 2011-09-06 15:08 - 0000360 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Sebastian\AppData\Local\Temp\Quarantine.exe
C:\Users\Sebastian\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-16 10:24

==================== End Of Log ============================
--- --- ---
Alt 18.03.2015, 17:39   #8
schrauber
/// the machine
/// TB-Ausbilder
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 18.03.2015, 23:34   #9
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e0d271bdeb366541bc70813a831925e7
# engine=22968
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-18 09:14:06
# local_time=2015-03-18 10:14:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1296 16777213 100 100 15882 30789528 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 130101 178343096 0 0
# scanned=407358
# found=0
# cleaned=0
# scan_time=15519
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.97  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Internet Security   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 8 Update 40  
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Flash Player 16.0.0.305  
 Adobe Reader XI  
 Google Chrome (40.0.2214.115) 
 Google Chrome (41.0.2272.89) 
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Sebastian (administrator) on SEBASTIAN-PC on 18-03-2015 23:18:21
Running from C:\Users\Sebastian\Desktop
Loaded Profiles: Sebastian (Available profiles: Sebastian)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodag.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [OODefragTray] => C:\Program Files\OO Software\Defrag\oodtray.exe
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * OODBSsdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1544781982-3593503346-2797692446-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-12] (Oracle Corporation)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-12] (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-12] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-12] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
DPF: HKLM-x32 {4A85DBE0-BFB2-4119-8401-186A7C6EB653} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/mjss/MJSS.cab109791.cab
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/121022/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\772itop0.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-12] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-12] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-12] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Sebastian\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin HKU\S-1-5-21-1544781982-3593503346-2797692446-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll [2013-03-12] (Amazon.com, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.faz.net/
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3314932&octid=EB_ORIGINAL_CTID&ISID=M37BB1CE2-8BD4-418B-AB2B-8E3E57D0C3AF&SearchSource=55&CUI=&UM=5&UP=SP7D0EFF40-7EA8-45F1-A390-B6BAD1FDE679&SSPV="
CHR Profile: C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]
CHR Extension: (Google Search) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]
CHR Extension: (Kaspersky Protection) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-08-24]
CHR Extension: (The Camelizer - Amazon Price Tracker) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghnomdcacenbmilgjigehppbamfndblo [2013-10-11]
CHR Extension: (AdBlock) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-02-17]
CHR Extension: (feedly) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2013-03-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-12]
CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2011-07-28]
CHR Extension: (Google Wallet) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Gmail) - C:\Users\Sebastian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
StartMenuInternet: Google Chrome - C:\Users\Sebastian\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-01-03] (Creative Labs) [File not signed]
S3 Creative Dolby Digital Live Pack Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\DDLLicensing.exe [79360 2011-07-28] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2011-07-28] () [File not signed]
R2 MSSQL$MYMOVIES; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
R2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [2555760 2012-11-01] (O&O Software GmbH)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2015-01-24] (Electronic Arts)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 SynoDrService; C:\Program Files (x86)\Synology\Data Replicator  3\SynoDrServicex64.exe [384072 2013-10-09] ()
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2014-02-25] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116096 2012-05-16] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-11-22] (AVM Berlin)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-09] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 17:51 - 2015-03-18 17:51 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-18 17:50 - 2015-03-18 17:50 - 02347384 ____N (ESET) C:\Users\Sebastian\Desktop\esetsmartinstaller_deu.exe
2015-03-18 17:50 - 2015-03-18 17:50 - 00852604 ____N () C:\Users\Sebastian\Desktop\SecurityCheck.exe
2015-03-18 12:27 - 2015-03-18 12:27 - 00000629 ____N () C:\Users\Sebastian\Desktop\JRT.txt
2015-03-18 12:13 - 2015-03-18 23:18 - 00020494 _____ () C:\Users\Sebastian\Desktop\FRST.txt
2015-03-18 12:05 - 2015-03-18 12:06 - 01388672 ____N (Thisisu) C:\Users\Sebastian\Desktop\JRT.exe
2015-03-18 11:59 - 2015-03-18 11:59 - 00001203 ____N () C:\Users\Sebastian\Desktop\MBAM.txt
2015-03-18 11:49 - 2015-03-18 11:49 - 00025104 _____ () C:\ComboFix.txt
2015-03-18 11:40 - 2015-03-17 15:58 - 05615380 ____R (Swearware) C:\Users\Sebastian\Desktop\ComboFix.exe
2015-03-17 16:00 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-17 16:00 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-17 16:00 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-17 16:00 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-17 15:59 - 2015-03-18 11:49 - 00000000 ____D () C:\Qoobox
2015-03-17 15:59 - 2015-03-17 16:10 - 00000000 ____D () C:\Windows\erdnt
2015-03-17 10:32 - 2015-03-17 10:43 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-17 10:30 - 2015-03-17 10:30 - 00000000 ____D () C:\Users\Sebastian\Desktop\MBAR
2015-03-17 09:40 - 2015-03-17 09:41 - 02095616 ____N (Farbar) C:\Users\Sebastian\Desktop\FRST64.exe
2015-03-11 11:54 - 2015-03-11 11:54 - 06208736 _____ (Tim Kosse) C:\Users\Sebastian\Downloads\FileZilla_3.10.2_win32-setup.exe
2015-03-11 08:38 - 2015-01-29 04:23 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 08:38 - 2015-01-29 04:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 08:38 - 2015-01-29 04:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 08:38 - 2015-01-29 04:19 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 08:38 - 2015-01-29 04:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 08:38 - 2015-01-29 04:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 08:38 - 2015-01-29 04:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 08:38 - 2015-01-29 04:05 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 08:38 - 2015-01-29 04:05 - 03917752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 08:38 - 2015-01-29 04:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 08:38 - 2015-01-29 03:57 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 08:37 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 08:37 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 08:37 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 08:37 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 08:37 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 08:37 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 08:37 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 08:37 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 08:37 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 08:37 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 08:37 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 08:37 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 08:37 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 08:37 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 08:37 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 08:37 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 08:36 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 08:36 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 08:36 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 08:36 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 08:36 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 08:36 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 08:36 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 08:36 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 08:36 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 08:36 - 2015-02-04 04:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 08:36 - 2015-02-04 03:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 08:36 - 2015-02-03 04:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 08:36 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 08:36 - 2015-02-03 04:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 08:36 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 08:36 - 2015-01-31 04:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-11 08:36 - 2015-01-31 04:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-11 08:36 - 2015-01-31 00:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-11 08:36 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 08:36 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-02 16:42 - 2015-03-02 16:43 - 00000000 ____D () C:\Users\Sebastian\Desktop\DSL Annex B
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\Program Files\iTunes
2015-02-25 13:01 - 2015-02-25 13:01 - 00000000 ____D () C:\Program Files\iPod
2015-02-25 12:54 - 2015-02-25 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-02-25 08:38 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-25 08:38 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-23 15:36 - 2015-03-18 23:18 - 00000000 ____D () C:\FRST
2015-02-17 23:02 - 2015-03-18 11:51 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-17 23:02 - 2015-03-17 10:33 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-17 23:02 - 2015-02-17 23:02 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-17 23:02 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-17 23:02 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-17 18:46 - 2015-03-18 12:03 - 00000000 ____D () C:\AdwCleaner
2015-02-17 16:50 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-17 16:50 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-17 16:50 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-17 16:50 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-17 15:19 - 2015-02-17 15:19 - 01614496 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 23:01 - 2011-07-28 10:18 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001UA.job
2015-03-18 22:59 - 2014-05-16 11:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-18 20:18 - 2011-07-28 23:24 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\Skype
2015-03-18 19:59 - 2014-08-04 20:30 - 00000306 _____ () C:\Windows\Tasks\Synology Data Replicator 3-Sebastian-PC-Sebastian.job
2015-03-18 17:56 - 2009-07-14 05:45 - 00025552 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-18 17:56 - 2009-07-14 05:45 - 00025552 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-18 17:54 - 2009-07-14 18:58 - 16058704 _____ () C:\Windows\system32\perfh007.dat
2015-03-18 17:54 - 2009-07-14 18:58 - 04992054 _____ () C:\Windows\system32\perfc007.dat
2015-03-18 17:54 - 2009-07-14 06:13 - 00006666 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-18 17:52 - 2011-07-28 10:16 - 01924656 _____ () C:\Windows\WindowsUpdate.log
2015-03-18 17:49 - 2012-12-09 12:43 - 02916936 _____ () C:\Windows\system32\oodbs.lor
2015-03-18 17:49 - 2011-07-28 10:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-03-18 17:49 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-18 17:49 - 2009-07-14 05:51 - 00227667 _____ () C:\Windows\setupact.log
2015-03-18 17:17 - 2011-07-28 13:51 - 00000000 ____D () C:\Users\Sebastian\Documents\Outlook-Dateien
2015-03-18 17:15 - 2013-09-21 08:53 - 00000000 ____D () C:\Users\Sebastian\AppData\Local\A33D40CB-D7EE-4111-8C05-89A9CBCBE699.aplzod
2015-03-18 12:03 - 2011-07-28 11:36 - 00148076 _____ () C:\Windows\PFRO.log
2015-03-18 11:47 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-03-17 16:12 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-03-17 15:01 - 2011-07-28 10:18 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1544781982-3593503346-2797692446-1001Core.job
2015-03-16 19:34 - 2011-07-28 10:16 - 00000000 ____D () C:\Users\Sebastian
2015-03-16 14:58 - 2011-09-03 23:39 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\FileZilla
2015-03-16 10:52 - 2014-09-03 09:54 - 00000600 _____ () C:\Users\Sebastian\AppData\Local\PUTTY.RND
2015-03-13 12:45 - 2013-05-16 20:16 - 00000000 ____D () C:\Windows\rescache
2015-03-13 11:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-13 11:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-12 15:40 - 2014-11-29 17:14 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-12 15:39 - 2011-07-28 10:46 - 00000000 ____D () C:\Program Files\Java
2015-03-12 15:37 - 2015-01-21 14:47 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-03-12 15:36 - 2013-10-19 15:13 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-12 15:35 - 2014-11-29 17:14 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-11 11:48 - 2009-07-14 05:45 - 00341872 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-11 09:17 - 2011-07-28 11:20 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 09:10 - 2013-08-14 14:34 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-11 09:04 - 2011-07-28 11:17 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-11 09:03 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini
2015-03-06 13:52 - 2012-02-03 17:29 - 00000000 ____D () C:\Users\Sebastian\AppData\Roaming\vlc
2015-03-02 19:05 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-25 13:01 - 2014-09-06 09:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2015-02-25 13:01 - 2011-12-24 16:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-02-25 13:01 - 2011-07-28 22:56 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-02-24 03:17 - 2011-07-28 10:36 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-20 16:36 - 2014-09-24 12:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-02-20 16:36 - 2011-07-28 23:24 - 00000000 ____D () C:\ProgramData\Skype
2015-02-17 23:17 - 2014-05-05 16:22 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-02-17 23:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Vss
2015-02-17 17:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing

==================== Files in the root of some directories =======

2011-12-30 09:29 - 2011-12-30 09:56 - 0001188 _____ () C:\Users\Sebastian\AppData\Local\crc32list11.txt
2012-07-08 21:01 - 2012-07-08 21:01 - 0004096 ____H () C:\Users\Sebastian\AppData\Local\keyfile3.drm
2014-09-03 09:54 - 2015-03-16 10:52 - 0000600 _____ () C:\Users\Sebastian\AppData\Local\PUTTY.RND
2011-11-03 12:06 - 2011-11-03 12:06 - 0000017 _____ () C:\Users\Sebastian\AppData\Local\resmon.resmoncfg
2011-07-28 10:55 - 2011-07-28 10:55 - 0017408 _____ () C:\Users\Sebastian\AppData\Local\WebpageIcons.db
2014-04-01 09:38 - 2014-04-01 09:38 - 0000040 ___SH () C:\ProgramData\.zreglib
2011-09-06 14:55 - 2011-09-06 15:08 - 0000360 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Sebastian\AppData\Local\Temp\Quarantine.exe
C:\Users\Sebastian\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-16 10:24

==================== End Of Log ============================
--- --- ---

--- --- ---



Probleme habe ich keine, hatte ich aber, bis auf die vielen Emails, auch nie gehabt. Einzig das Telekom Abuse-Team hatte mich mehrmals angeschrieben. Nichtsdestotrotz schien etwas mit meinem System nicht zu stimmen, da wohl zumindest das FTP-Passwort von meinem webspace-Zugang ausgespäht wurde.
Die Email-Flut ist jedoch behoben, was aber wohl an der abermaligen Entfernung von Schaddateien auf meinem webspace liegt.

Bzgl. Java: Ich habe sowohl die 32 als auch die 64bit-Version von Java in der Version 8 Update 40 installiert. Warum das oben anders angegeben ist, weiß ich nicht. Vielleicht sollte ich Java noch einmal de- und dann neuinstallieren.


Schon einmal vielen Dank für deine Hilfe!

Alt 19.03.2015, 13:00   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Hast Du auch die alten Java Versionen deinstalliert?

Alle Passwörter ändern, vor allem Email und FTP, falls noch nicht geschehen.



Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.


Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
 Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 19.03.2015, 13:24   #11
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Vielen Dank für deine Antwort.

Ich hatte Java 8 Update 31 vorher installiert und nicht vor dem Update deinstalliert. Ich dachte, dass das bei den neueren Java-Versionen nicht mehr nötig ist.
In der Systemsteuerung unter installierte Programme waren dann sowohl Update 31 als auch 40 installiert, woraufhin ich beide (32 und 64bit) von Java Update 31 deinstallierte.
Ich habe gestern Java Update 40 de- und neu installiert. Nichtsdestotrotz zeigt mir SecurityCheck an, ich hätte Update 31 installiert. Lasse ich es über java.com überprüfen, wird mir angezeigt, ich hätte Update 40 installiert - welche bit-Version weiß ich allerdings nicht. Jetzt bin ich natürlich unsicher.

Eine Frage habe ich noch: War denn nun mein PC mit irgend etwas infiziert, was dazu führt, dass sich das Telekom Abuse-Team bei mir meldet? Wenn nicht, muss ich nämlich noch meinen Laptop überprüfen.

Alt 19.03.2015, 21:16   #12
schrauber
/// the machine
/// TB-Ausbilder
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


SecurityCheck ignorieren.

Ja war es, aber wir sollten ihn auf jeden Fall checken. Poste mal FRST Logs von dem Laptop.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 19.03.2015, 23:04   #13
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Ok, danke. Hier die Logs des Laptops:


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Renate (administrator) on RENATE-LAPTOP on 19-03-2015 22:54:25
Running from C:\Users\Renate\Desktop
Loaded Profiles: Renate  (Available profiles: Renate)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\Synology\Data Replicator  3\SynoDrService.exe
() C:\Program Files\Synology\Assistant\UsbClientService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7862816 2009-10-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1578280 2009-10-09] (Synaptics Incorporated)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-04-21] (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-988395652-768190920-3123769999-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-988395652-768190920-3123769999-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-988395652-768190920-3123769999-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-18] (Microsoft Corporation)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-08] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-15] (Oracle Corporation)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-15] (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Renate\AppData\Roaming\Mozilla\Firefox\Profiles\5kx7agfz.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-15] (Oracle Corporation)
FF Plugin: @kaspersky.com/content_blocker -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-08] ()
FF Plugin: @kaspersky.com/online_banking -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-08] ()
FF Plugin: @kaspersky.com/virtual_keyboard -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-08] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\bing (1).xml [2014-02-15]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de (1).xml [2014-02-15]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de (1).xml [2014-02-15]
FF Extension: Adblock Plus - C:\Users\Renate\AppData\Roaming\Mozilla\Firefox\Profiles\5kx7agfz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-19]
FF HKLM\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-21]
FF HKLM\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-21]
FF HKLM\...\Firefox\Extensions:  - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-21]
FF HKLM\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-21]
FF HKLM\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-21]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.faz.net/
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3314932&octid=EB_ORIGINAL_CTID&ISID=M37BB1CE2-8BD4-418B-AB2B-8E3E57D0C3AF&SearchSource=55&CUI=&UM=5&UP=SP7D0EFF40-7EA8-45F1-A390-B6BAD1FDE679&SSPV="
CHR Profile: C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-25]
CHR Extension: (Google Drive) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-25]
CHR Extension: (YouTube) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-25]
CHR Extension: (Google Search) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-25]
CHR Extension: (Kaspersky Protection) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-08-21]
CHR Extension: (The Camelizer - Amazon Price Tracker) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghnomdcacenbmilgjigehppbamfndblo [2014-04-25]
CHR Extension: (AdBlock) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-25]
CHR Extension: (feedly) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob [2014-04-25]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15]
CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd [2014-04-25]
CHR Extension: (Google Wallet) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-25]
CHR Extension: (Gmail) - C:\Users\Renate\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-25]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 LMS; C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-11-01] (Intel Corporation) [File not signed]
S3 MozillaMaintenance; C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe [119408 2014-05-11] (Mozilla Foundation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2009-05-14] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2009-05-14] (Hewlett-Packard) [File not signed]
R2 SynoDrService; C:\Program Files\Synology\Data Replicator  3\SynoDrService.exe [251464 2014-07-31] ()
R2 UNS; C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-11-01] (Intel Corporation) [File not signed]
R2 UsbClientService; C:\Program Files\Synology\Assistant\UsbClientService.exe [248736 2014-02-25] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 busenum; C:\Windows\System32\DRIVERS\busenum.sys [45792 2012-08-03] (Windows (R) Win 7 DDK provider)
R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [5888 2006-11-01] (FUJITSU LIMITED)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135264 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112136 2014-10-08] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [34400 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [644808 2014-10-08] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [24672 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145888 2014-03-26] (Kaspersky Lab ZAO)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\RENATE~1\AppData\Local\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-19 22:54 - 2015-03-19 22:54 - 00014552 _____ () C:\Users\Renate\Desktop\FRST.txt
2015-03-19 22:54 - 2015-03-19 22:54 - 00000000 ____D () C:\FRST
2015-03-19 22:53 - 2015-03-19 22:53 - 01135104 _____ (Farbar) C:\Users\Renate\Desktop\FRST.exe
2015-03-17 22:03 - 2015-03-17 22:03 - 00010624 _____ () C:\ComboFix.txt
2015-03-17 21:53 - 2015-03-17 23:14 - 00000000 ____D () C:\Windows\erdnt
2015-03-17 21:34 - 2015-03-17 21:46 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-17 21:33 - 2015-03-17 21:33 - 00000000 ____D () C:\Users\Renate\Desktop\MBRK
2015-03-17 21:32 - 2015-03-17 21:33 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Renate\Downloads\mbar-1.09.1.1004.exe
2015-03-15 21:15 - 2015-03-15 21:15 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-15 21:03 - 2015-03-15 21:06 - 37064104 _____ (Oracle Corporation) C:\Users\Renate\Downloads\jre-8u40-windows-i586.exe
2015-03-12 18:19 - 2015-03-12 18:19 - 00000000 ____D () C:\Users\Renate\Tracing
2015-03-10 22:05 - 2015-02-24 03:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-10 22:05 - 2015-02-21 01:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-10 22:05 - 2015-02-21 01:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-10 22:05 - 2015-02-21 01:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-10 22:05 - 2015-02-21 00:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-10 22:05 - 2015-02-20 03:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-10 22:05 - 2015-02-20 03:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-10 22:05 - 2015-02-20 03:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-10 22:05 - 2015-02-20 03:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-10 22:05 - 2015-02-20 03:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-10 22:05 - 2015-02-20 03:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-10 22:05 - 2015-02-20 03:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-10 22:05 - 2015-02-20 02:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-10 22:05 - 2015-02-20 02:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-10 22:05 - 2015-02-20 02:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-10 22:05 - 2015-02-20 02:56 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-10 22:05 - 2015-02-20 02:50 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-10 22:05 - 2015-02-20 02:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-10 22:05 - 2015-02-20 02:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-10 22:05 - 2015-02-20 02:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-10 22:05 - 2015-02-20 02:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-10 22:05 - 2015-02-20 02:24 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-10 22:05 - 2015-02-20 02:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-10 22:05 - 2015-02-20 02:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-10 22:05 - 2015-02-20 01:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-10 22:05 - 2015-02-20 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-10 22:04 - 2015-03-06 06:15 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-10 22:04 - 2015-03-06 06:15 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-10 22:04 - 2015-03-06 06:10 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-10 22:04 - 2015-03-06 06:10 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-10 22:04 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-10 22:04 - 2015-03-06 06:09 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-10 22:04 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-10 22:04 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-10 22:04 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-10 22:04 - 2015-02-21 01:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-10 22:04 - 2015-02-20 03:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-10 22:04 - 2015-02-20 03:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-10 22:04 - 2015-02-20 02:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-10 22:04 - 2015-02-03 04:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-03-10 22:04 - 2015-02-03 04:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-10 22:04 - 2015-02-03 04:16 - 00078784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-10 22:04 - 2015-02-03 04:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-10 22:04 - 2015-02-03 04:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-10 22:04 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-10 22:04 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-10 22:04 - 2015-02-03 04:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-10 22:04 - 2015-02-03 04:11 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-10 22:04 - 2015-02-03 04:11 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-10 22:04 - 2015-02-03 04:11 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-10 22:04 - 2015-02-03 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-10 22:04 - 2015-02-03 04:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-10 22:04 - 2015-02-03 04:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-10 22:04 - 2015-02-03 04:11 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-10 22:04 - 2015-02-03 04:11 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-10 22:04 - 2015-02-03 04:10 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-10 22:04 - 2015-02-03 04:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-10 22:04 - 2015-02-03 04:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-10 22:04 - 2015-02-03 04:00 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-10 22:04 - 2015-02-03 03:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-10 22:04 - 2015-01-31 00:56 - 00370488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-10 22:04 - 2014-10-31 23:22 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-10 22:03 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-10 22:03 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-10 22:03 - 2015-02-20 05:13 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-10 22:03 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-10 22:03 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-10 22:03 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-10 22:03 - 2015-02-03 04:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-10 22:02 - 2015-02-26 04:11 - 02381312 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-10 22:02 - 2015-02-04 03:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-10 22:02 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-10 22:02 - 2015-01-31 04:33 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-10 22:02 - 2015-01-31 04:33 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-10 22:02 - 2015-01-31 01:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-10 22:02 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-01 23:49 - 2015-03-01 23:49 - 00000079 _____ () C:\Windows\wininit.ini
2015-02-26 00:45 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-18 12:21 - 2015-03-17 22:12 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-18 12:21 - 2015-03-17 21:33 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-18 12:21 - 2015-02-18 12:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-18 12:21 - 2015-02-18 12:21 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-02-18 12:21 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-18 12:21 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-17 20:37 - 2015-02-17 20:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-17 20:35 - 2015-02-17 20:36 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Renate\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-17 19:09 - 2015-02-17 19:10 - 02347384 _____ (ESET) C:\Users\Renate\Downloads\esetsmartinstaller_deu.exe
2015-02-17 18:57 - 2015-02-17 18:58 - 01388274 _____ (Thisisu) C:\Users\Renate\Downloads\JRT.exe
2015-02-17 18:56 - 2015-02-17 18:56 - 02112512 _____ () C:\Users\Renate\Downloads\AdwCleaner_4.110.exe
2015-02-17 15:26 - 2015-02-17 15:26 - 01217184 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-19 22:53 - 2014-04-19 17:29 - 01143764 _____ () C:\Windows\WindowsUpdate.log
2015-03-19 22:51 - 2014-04-25 21:11 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-19 22:51 - 2014-04-19 18:38 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-03-19 22:50 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-19 22:50 - 2009-07-14 05:39 - 00082845 _____ () C:\Windows\setupact.log
2015-03-19 20:51 - 2009-07-14 05:34 - 00027584 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-19 20:51 - 2009-07-14 05:34 - 00027584 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-19 20:50 - 2014-12-07 11:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-19 20:50 - 2014-04-25 21:11 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-19 19:13 - 2014-08-04 20:51 - 00000300 _____ () C:\Windows\Tasks\Synology Data Replicator 3-Renate-Laptop-Renate.job
2015-03-19 19:13 - 2014-04-19 17:32 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-18 20:33 - 2014-04-19 18:41 - 00081940 _____ () C:\Windows\PFRO.log
2015-03-17 23:50 - 2014-05-11 21:05 - 00000000 ____D () C:\Users\Renate\AppData\Roaming\Skype
2015-03-17 22:03 - 2011-08-27 11:44 - 00000000 __RHD () C:\Users\Default
2015-03-17 22:03 - 2011-08-27 11:10 - 00000000 __SHD () C:\Users\LocalService
2015-03-17 22:03 - 2011-08-27 11:09 - 00000000 __SHD () C:\Users\NetworkService
2015-03-17 22:03 - 2009-07-14 03:37 - 00000000 ___RD () C:\Users\Public
2015-03-17 22:01 - 2009-07-14 03:04 - 00000215 _____ () C:\Windows\system.ini
2015-03-15 21:13 - 2013-07-05 18:59 - 00000000 ____D () C:\Program Files\Java
2015-03-15 21:12 - 2014-04-25 21:21 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-15 21:11 - 2014-11-20 20:38 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-03-15 14:17 - 2009-07-14 05:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-12 18:19 - 2014-09-17 18:50 - 00000000 ___RD () C:\Program Files\Skype
2015-03-12 18:19 - 2014-05-11 21:05 - 00000000 ____D () C:\ProgramData\Skype
2015-03-12 18:19 - 2014-04-19 17:29 - 00000000 ____D () C:\Users\Renate
2015-03-12 18:13 - 2009-07-14 05:33 - 00339576 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-10 23:22 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-03-10 22:37 - 2014-04-19 19:39 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-10 22:36 - 2009-07-14 03:04 - 00000478 _____ () C:\Windows\win.ini
2015-03-09 19:40 - 2014-04-19 20:48 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-09 19:36 - 2014-04-19 20:48 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-09 19:33 - 2014-08-05 08:42 - 00000634 _____ () C:\Windows\wiso.ini
2015-03-01 23:50 - 2015-01-07 14:14 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2015-03-01 23:49 - 2015-01-07 14:14 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-02-24 03:23 - 2014-04-19 17:53 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-18 13:40 - 2014-04-19 19:44 - 00000000 ____D () C:\os_x86
2015-02-18 13:40 - 2014-04-19 18:38 - 00000000 ____D () C:\Windows\ELAMBKUP

==================== Files in the root of some directories =======

2011-08-27 13:09 - 2011-08-27 13:09 - 0017408 _____ () C:\Users\Renate\AppData\Local\WebpageIcons.db
2011-08-28 18:31 - 2014-07-21 10:58 - 0000700 _____ () C:\ProgramData\hpzinstall.log

Files to move or delete:
====================
C:\Users\Default\NTUSER (1).DAT
C:\Users\Renate\NTUSER (1).DAT


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 14:49

==================== End Of Log ============================
--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Renate at 2015-03-19 22:55:05
Running from C:\Users\Renate\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 6.1.2 - Hewlett-Packard) Hidden
Adobe Flash Player 10 ActiveX (HKLM\...\{B7B3E9B3-FB14-4927-894B-E9124509AF5A}) (Version: 10.0.32.18 - Adobe Systems, Inc.)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
B110 (Version: 140.0.142.000 - Hewlett-Packard) Hidden
BufferChm (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Google Chrome (HKLM\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7 (HKLM\...\{014E482A-0C27-47E3-BA82-307E9DCA2F47}) (Version: 14.0 - HP)
HPAppStudio (Version: 140.0.95.000 - Hewlett-Packard) Hidden
HPPhotoGadget (Version: 140.0.524.000 - Hewlett-Packard) Hidden
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Java 8 Update 40 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Kaspersky Internet Security (HKLM\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (Version: 15.0.0.463 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 36.0.1 (x86 de) (HKLM\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Network (Version: 140.0.212.000 - Hewlett-Packard) Hidden
PS_AIO_07_B110_SW_Min (Version: 140.0.142.000 - Hewlett-Packard) Hidden
QuickTransfer (Version: 140.0.98.000 - Hewlett-Packard) Hidden
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
Scan (Version: 140.0.77.000 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 7.2 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.2.103 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.10.0 - Synaptics Incorporated)
Synology Assistant (remove only) (HKLM\...\Synology Assistant) (Version:  - )
Synology Data Replicator  3 (HKLM\...\{8E310838-457C-4269-B177-3EFB300CBDDC}) (Version: 1.0.0.0 - Synology Inc.)
Toolbox (Version: 140.0.424.000 - Hewlett-Packard) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WebReg (Version: 140.0.212.017 - Hewlett-Packard) Hidden
WISO Steuer-Sparbuch 2015 (HKLM\...\{B33A6F25-DAC4-40F1-A229-30398E8A53ED}) (Version: 22.00.8811 - Buhl Data Service GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

17-03-2015 23:14:31 ComboFix created restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2015-03-17 22:01 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {12F87C95-EE15-462E-B2C5-D2A84BB728BC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-25] (Google Inc.)
Task: {1E2879AA-B1C8-42AF-A111-F6140775DFCD} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {1F405700-85A4-40BB-B29A-27E7C75D12E9} - System32\Tasks\Synology Data Replicator 3-Renate-Laptop-Renate => C:\Program Files\Synology\Data Replicator  3\Backup.exe [2014-07-31] (Synology Inc.)
Task: {263FA81D-0DEB-4740-A1A5-527149999F67} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {977F32E3-5BF1-465B-8757-3208F588C063} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A1125AF6-A1D5-4308-A79E-F31777B01F3D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-04-25] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Synology Data Replicator 3-Renate-Laptop-Renate.job => C:\Program Files\Synology\Data Replicator  3\Backup.exe

==================== Loaded Modules (whitelisted) ==============

2013-09-04 23:14 - 2013-09-04 23:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-03-06 14:00 - 2014-03-06 14:00 - 01269952 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2012-01-10 20:12 - 2012-01-10 20:12 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll
2014-07-31 19:11 - 2014-07-31 19:11 - 00251464 _____ () C:\Program Files\Synology\Data Replicator  3\SynoDrService.exe
2014-02-25 02:28 - 2014-02-25 02:28 - 00248736 _____ () C:\Program Files\Synology\Assistant\UsbClientService.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-988395652-768190920-3123769999-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Renate\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-988395652-768190920-3123769999-500 - Administrator - Disabled)
Gast (S-1-5-21-988395652-768190920-3123769999-501 - Limited - Disabled)
Renate (S-1-5-21-988395652-768190920-3123769999-1000 - Administrator - Enabled) => C:\Users\Renate

==================== Faulty Device Manager Devices =============

Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: FH13FF-238
Description: USB-Videogerät
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/16/2015 11:09:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 41.0.2272.89, Zeitstempel: 0x54fa819a
Name des fehlerhaften Moduls: chrome.exe, Version: 41.0.2272.89, Zeitstempel: 0x54fa819a
Ausnahmecode: 0x80000003
Fehleroffset: 0x0001003a
ID des fehlerhaften Prozesses: 0xb8c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (03/15/2015 09:01:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 41.0.2272.89, Zeitstempel: 0x54fa819a
Name des fehlerhaften Moduls: chrome.dll, Version: 41.0.2272.89, Zeitstempel: 0x54fa7de6
Ausnahmecode: 0x80000003
Fehleroffset: 0x0083fa64
ID des fehlerhaften Prozesses: 0xe50
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (03/15/2015 07:47:54 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fade9bc2-9f52-4ba0-bc30-e0eabde062b8}

Error: (03/15/2015 07:47:47 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fade9bc2-9f52-4ba0-bc30-e0eabde062b8}

Error: (03/08/2015 06:24:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3aecf
Name des fehlerhaften Moduls: chrome.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3aecf
Ausnahmecode: 0x80000003
Fehleroffset: 0x000162a0
ID des fehlerhaften Prozesses: 0xb5c
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (03/06/2015 07:00:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {3469fc5f-f25b-4d21-b16a-2b6d473a8190}

Error: (03/06/2015 07:00:23 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {3469fc5f-f25b-4d21-b16a-2b6d473a8190}

Error: (03/04/2015 10:50:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: chrome.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3aecf
Name des fehlerhaften Moduls: chrome.exe, Version: 40.0.2214.115, Zeitstempel: 0x54e3aecf
Ausnahmecode: 0x80000003
Fehleroffset: 0x000162a0
ID des fehlerhaften Prozesses: 0x4d4
Startzeit der fehlerhaften Anwendung: 0xchrome.exe0
Pfad der fehlerhaften Anwendung: chrome.exe1
Pfad des fehlerhaften Moduls: chrome.exe2
Berichtskennung: chrome.exe3

Error: (03/04/2015 07:00:12 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {82dce23d-6d4f-4d2d-93be-32c3adb0e4c6}

Error: (03/04/2015 07:00:06 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {82dce23d-6d4f-4d2d-93be-32c3adb0e4c6}


System errors:
=============
Error: (03/17/2015 11:14:41 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (03/17/2015 10:01:33 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (03/17/2015 09:58:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (03/17/2015 09:55:08 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (02/23/2015 08:33:06 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AVP15.0.0 erreicht.

Error: (02/22/2015 07:04:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "HP Network Devices Support" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/21/2015 09:43:38 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (02/18/2015 01:39:39 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Wlansvc erreicht.

Error: (02/17/2015 07:36:10 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (03/16/2015 11:09:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe41.0.2272.8954fa819achrome.exe41.0.2272.8954fa819a800000030001003ab8c01d06023d07bc2ccC:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe1f462ddf-cc29-11e4-afb1-e0ca94152c66

Error: (03/15/2015 09:01:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe41.0.2272.8954fa819achrome.dll41.0.2272.8954fa7de6800000030083fa64e5001d05f50ba0b904fC:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\41.0.2272.89\chrome.dll07ef06ef-cb4e-11e4-9b84-e0ca94152c66

Error: (03/15/2015 07:47:54 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fade9bc2-9f52-4ba0-bc30-e0eabde062b8}

Error: (03/15/2015 07:47:47 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fade9bc2-9f52-4ba0-bc30-e0eabde062b8}

Error: (03/08/2015 06:24:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe40.0.2214.11554e3aecfchrome.exe40.0.2214.11554e3aecf80000003000162a0b5c01d059c424319336C:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe052c00a8-c5b8-11e4-bb03-e0ca94152c66

Error: (03/06/2015 07:00:27 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {3469fc5f-f25b-4d21-b16a-2b6d473a8190}

Error: (03/06/2015 07:00:23 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {3469fc5f-f25b-4d21-b16a-2b6d473a8190}

Error: (03/04/2015 10:50:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: chrome.exe40.0.2214.11554e3aecfchrome.exe40.0.2214.11554e3aecf80000003000162a04d401d056bbff130db1C:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exe803449a3-c2b8-11e4-b1b1-e0ca94152c66

Error: (03/04/2015 07:00:12 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {82dce23d-6d4f-4d2d-93be-32c3adb0e4c6}

Error: (03/04/2015 07:00:06 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {82dce23d-6d4f-4d2d-93be-32c3adb0e4c6}


CodeIntegrity Errors:
===================================
  Date: 2014-10-15 18:52:18.459
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.459
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.459
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.459
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.444
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.444
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.444
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.444
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.428
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-15 18:52:18.428
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX86\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) CPU P6200 @ 2.13GHz
Percentage of memory in use: 47%
Total physical RAM: 1908.55 MB
Available physical RAM: 1006.93 MB
Total Pagefile: 3817.11 MB
Available Pagefile: 2749.21 MB
Total Virtual: 2047.88 MB
Available Virtual: 1899.08 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:55.9 GB) (Free:21.06 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 55.9 GB) (Disk ID: E8092BB9)
Partition 1: (Active) - (Size=55.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Alt 20.03.2015, 06:53   #14
schrauber
/// the machine
/// TB-Ausbilder
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Looks good, schnell noch nen Tiefen-Scan:

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 20.03.2015, 07:37   #15
sibster
 
Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Standard

Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.03.20.01
  rootkit: v2015.02.25.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.17691
Renate :: RENATE-LAPTOP [administrator]

20.03.2015 07:25:58
mbar-log-2015-03-20 (07-25-58).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 367680
Time elapsed: 6 minute(s), 25 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Code:
ATTFilter
07:33:37.0582 0x10f8  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
07:33:47.0194 0x10f8  KSN EULA was not accepted. For auto accept you could use -accepteulaksn command line parameter.
07:33:47.0196 0x10f8  ============================================================
07:33:47.0197 0x10f8  Current date / time: 2015/03/20 07:33:47.0196
07:33:47.0197 0x10f8  SystemInfo:
07:33:47.0197 0x10f8  
07:33:47.0197 0x10f8  OS Version: 6.1.7601 ServicePack: 1.0
07:33:47.0197 0x10f8  Product type: Workstation
07:33:47.0197 0x10f8  ComputerName: RENATE-LAPTOP
07:33:47.0197 0x10f8  UserName: Renate
07:33:47.0197 0x10f8  Windows directory: C:\Windows
07:33:47.0197 0x10f8  System windows directory: C:\Windows
07:33:47.0198 0x10f8  Processor architecture: Intel x86
07:33:47.0198 0x10f8  Number of processors: 2
07:33:47.0198 0x10f8  Page size: 0x1000
07:33:47.0198 0x10f8  Boot type: Normal boot
07:33:47.0198 0x10f8  ============================================================
07:33:47.0787 0x10f8  KLMD registered as C:\Windows\system32\drivers\95326178.sys
07:33:47.0989 0x10f8  System UUID: {DE033B05-AA6B-BEE6-4F02-2C5678771E19}
07:33:47.0991 0x10f8  Skipping KSN library initialization due to KSN EULA unacceptance
07:33:48.0277 0x10f8  Drive \Device\Harddisk0\DR0 - Size: 0xDF98DDE00 ( 55.90 Gb ), SectorSize: 0x200, Cylinders: 0x1C81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
07:33:48.0279 0x10f8  ============================================================
07:33:48.0279 0x10f8  \Device\Harddisk0\DR0:
07:33:48.0279 0x10f8  MBR partitions:
07:33:48.0279 0x10f8  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x6FCBB02
07:33:48.0279 0x10f8  ============================================================
07:33:48.0281 0x10f8  C: <-> \Device\Harddisk0\DR0\Partition1
07:33:48.0281 0x10f8  ============================================================
07:33:48.0281 0x10f8  Initialize success
07:33:48.0281 0x10f8  ============================================================
07:33:58.0911 0x1200  ============================================================
07:33:58.0912 0x1200  Scan started
07:33:58.0912 0x1200  Mode: Manual; SigCheck; TDLFS; 
07:33:58.0912 0x1200  ============================================================
07:33:59.0100 0x1200  ================ Scan system memory ========================
07:33:59.0100 0x1200  System memory - ok
07:33:59.0101 0x1200  ================ Scan services =============================
07:33:59.0156 0x1200  [ 1B133875B8AA8AC48969BD3458AFE9F5, 01753BDD47F3F9BC0E0D23A069B9C56D4AE6A6B6295BC19B95AE245D25B12744 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
07:33:59.0235 0x1200  1394ohci - ok
07:33:59.0246 0x1200  [ CEA80C80BED809AA0DA6FEBC04733349, AE69C142DC2210A4AE657C23CEA4A6E7CB32C4F4EBA039414123CAC52157509B ] ACPI            C:\Windows\system32\drivers\ACPI.sys
07:33:59.0270 0x1200  ACPI - ok
07:33:59.0275 0x1200  [ 1EFBC664ABFF416D1D07DB115DCB264F, BF94D069D692140B792DBF4FD3CB0127D27C26CC5BFB6B0C28A8B6346767EE58 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
07:33:59.0300 0x1200  AcpiPmi - ok
07:33:59.0308 0x1200  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
07:33:59.0323 0x1200  AdobeARMservice - ok
07:33:59.0335 0x1200  [ 080255CDCB878813B481B8C348D47D8E, 75808821FBC732D0504795B8F85852E4C01D3B412989A1E597E1295CFF7B7A45 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
07:33:59.0356 0x1200  AdobeFlashPlayerUpdateSvc - ok
07:33:59.0373 0x1200  [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
07:33:59.0403 0x1200  adp94xx - ok
07:33:59.0417 0x1200  [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
07:33:59.0441 0x1200  adpahci - ok
07:33:59.0450 0x1200  [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
07:33:59.0469 0x1200  adpu320 - ok
07:33:59.0478 0x1200  [ 8B5EEFEEC1E6D1A72A06C526628AD161, 026CDF4C96F4D493E7BABF79A14C4B0B5ADCCEF0B081FFFA2E3B243B2414167F ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
07:33:59.0498 0x1200  AeLookupSvc - ok
07:33:59.0511 0x1200  [ D0B388DA1D111A34366E04EB4A5DD156, 60D226F027F4025CC032CAFF73A80FAFB5FA75445654FDCF80CA8C0419C6E938 ] AFD             C:\Windows\system32\drivers\afd.sys
07:33:59.0538 0x1200  AFD - ok
07:33:59.0545 0x1200  [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440          C:\Windows\system32\drivers\agp440.sys
07:33:59.0560 0x1200  agp440 - ok
07:33:59.0567 0x1200  [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx         C:\Windows\system32\DRIVERS\djsvs.sys
07:33:59.0583 0x1200  aic78xx - ok
07:33:59.0589 0x1200  [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG             C:\Windows\System32\alg.exe
07:33:59.0609 0x1200  ALG - ok
07:33:59.0614 0x1200  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide          C:\Windows\system32\drivers\aliide.sys
07:33:59.0628 0x1200  aliide - ok
07:33:59.0634 0x1200  [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
07:33:59.0650 0x1200  amdagp - ok
07:33:59.0654 0x1200  [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide          C:\Windows\system32\drivers\amdide.sys
07:33:59.0670 0x1200  amdide - ok
07:33:59.0676 0x1200  [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
07:33:59.0696 0x1200  AmdK8 - ok
07:33:59.0701 0x1200  [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
07:33:59.0720 0x1200  AmdPPM - ok
07:33:59.0727 0x1200  [ D320BF87125326F996D4904FE24300FC, F767D8C5C58D57202905D829F7AE1B1FF33937F407FDCE4C90E32A6638F27416 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
07:33:59.0743 0x1200  amdsata - ok
07:33:59.0753 0x1200  [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
07:33:59.0772 0x1200  amdsbs - ok
07:33:59.0778 0x1200  [ 46387FB17B086D16DEA267D5BE23A2F2, 8B8AC61B91F154B4EB5CC6DECB5FCCEBA8B42EFE94859947136AD06681EA8ED0 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
07:33:59.0792 0x1200  amdxata - ok
07:33:59.0798 0x1200  [ 81F97D8F8B3FB94A451CC6F7CF8B2965, 8DEBA4E47E1016D69740C0BB7CDD23852D86E0D42C1C1EA5A847ECB115C38CB1 ] AppID           C:\Windows\system32\drivers\appid.sys
07:33:59.0818 0x1200  AppID - ok
07:33:59.0823 0x1200  [ F5090F8FA6757C58E17BAEAA86093636, 5E14CF3032DF5801240F45C59AA93962EA41AA5648A0C6458D16D9B9D95A131F ] AppIDSvc        C:\Windows\System32\appidsvc.dll
07:33:59.0840 0x1200  AppIDSvc - ok
07:33:59.0846 0x1200  [ EACFDF31921F51C097629F1F3C9129B4, 24138755D823E69760579ECBD672421192457CDC9941B2BC499C2D34D83E86C3 ] Appinfo         C:\Windows\System32\appinfo.dll
07:33:59.0865 0x1200  Appinfo - ok
07:33:59.0873 0x1200  [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc             C:\Windows\system32\DRIVERS\arc.sys
07:33:59.0889 0x1200  arc - ok
07:33:59.0898 0x1200  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
07:33:59.0915 0x1200  arcsas - ok
07:33:59.0931 0x1200  [ 537B2948976F5D9B5767B74A63EBB395, 1A14F8B582E74AD15B612EDA5B707AA3CB0B2A107ED14572B4232EAA7383B634 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
07:33:59.0949 0x1200  aspnet_state - ok
07:33:59.0954 0x1200  [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
07:34:00.0018 0x1200  AsyncMac - ok
07:34:00.0023 0x1200  [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi           C:\Windows\system32\drivers\atapi.sys
07:34:00.0038 0x1200  atapi - ok
07:34:00.0076 0x1200  [ 0F4B6B99D6CDC1D93DF1FA690796B2F7, 4D3CF6301B10E02C5B9B6C62FCA66BC86863DF58BA7CF88E523271A2F85118D7 ] athr            C:\Windows\system32\DRIVERS\athr.sys
07:34:00.0134 0x1200  athr - ok
07:34:00.0151 0x1200  [ C1619A13B10CAC5038BF7129F57D8DE3, 9F71EA6C844650658938E68CCC1383F92D37C68E46E08461A8351491185BA791 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
07:34:00.0182 0x1200  AudioEndpointBuilder - ok
07:34:00.0198 0x1200  [ C1619A13B10CAC5038BF7129F57D8DE3, 9F71EA6C844650658938E68CCC1383F92D37C68E46E08461A8351491185BA791 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
07:34:00.0226 0x1200  Audiosrv - ok
07:34:00.0241 0x1200  [ 058734C95991F6BEBF3D3075B8776234, D94A0E5893723C0F30D8215F001039AE9D903BF8EC3782D9583DEFD9B304B0CA ] AVP15.0.0       C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
07:34:00.0267 0x1200  AVP15.0.0 - ok
07:34:00.0273 0x1200  [ 6E30D02AAC9CAC84F421622E3A2F6178, 229DC527C1D6C778BCA2C855A2A6F6D2C4B0F4F6DE56C886B3AAD26E3347952C ] AxInstSV        C:\Windows\System32\AxInstSV.dll
07:34:00.0301 0x1200  AxInstSV - ok
07:34:00.0318 0x1200  [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbdx.sys
07:34:00.0348 0x1200  b06bdrv - ok
07:34:00.0359 0x1200  [ BD8869EB9CDE6BBE4508D869929869EE, F4363A12EBFDBB89C69FD59B22F9EE05BADA07D477A1DF2DE01F59D6EE496543 ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
07:34:00.0381 0x1200  b57nd60x - ok
07:34:00.0390 0x1200  [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC          C:\Windows\System32\bdesvc.dll
07:34:00.0409 0x1200  BDESVC - ok
07:34:00.0413 0x1200  [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep            C:\Windows\system32\drivers\Beep.sys
07:34:00.0447 0x1200  Beep - ok
07:34:00.0465 0x1200  [ 1E2BAC209D184BB851E1A187D8A29136, 53933C938DA5126986FFF2918C1F522ABE93ABAB460AE32E4453161C2F7B68DF ] BFE             C:\Windows\System32\bfe.dll
07:34:00.0497 0x1200  BFE - ok
07:34:00.0518 0x1200  [ E585445D5021971FAE10393F0F1C3961, 178C008A9A0A6BFDA65EB0B98C510271360AD4474F22F13594F5EB60AA4E1CF5 ] BITS            C:\Windows\System32\qmgr.dll
07:34:00.0596 0x1200  BITS - ok
07:34:00.0601 0x1200  [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
07:34:00.0618 0x1200  blbdrive - ok
07:34:00.0623 0x1200  [ 8F2DA3028D5FCBD1A060A3DE64CD6506, E234672E9CFE1A95AD2E78E306E41E010B870221E6EBBC0E2B0BE2FA5CE0CD76 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
07:34:00.0644 0x1200  bowser - ok
07:34:00.0649 0x1200  [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
07:34:00.0672 0x1200  BrFiltLo - ok
07:34:00.0676 0x1200  [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
07:34:00.0695 0x1200  BrFiltUp - ok
07:34:00.0701 0x1200  [ 77361D72A04F18809D0EFB6CCEB74D4B, 55E7DB65BB29FF421F138CDFF05E5ECFFC7C8862FAA68F6179A3BA9D6B69AE64 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
07:34:00.0737 0x1200  BridgeMP - ok
07:34:00.0743 0x1200  [ 3DAA727B5B0A45039B0E1C9A211B8400, 903B51E75F0C503A0E255120F53BF51B047B219FEC1E15F2F1D02DDD562FC73B ] Browser         C:\Windows\System32\browser.dll
07:34:00.0763 0x1200  Browser - ok
07:34:00.0775 0x1200  [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
07:34:00.0801 0x1200  Brserid - ok
07:34:00.0807 0x1200  [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
07:34:00.0827 0x1200  BrSerWdm - ok
07:34:00.0831 0x1200  [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
07:34:00.0850 0x1200  BrUsbMdm - ok
07:34:00.0854 0x1200  [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
07:34:00.0870 0x1200  BrUsbSer - ok
07:34:00.0876 0x1200  [ 2865A5C8E98C70C605F417908CEBB3A4, B1C5AC228BD7072AF8668C009C6CDC13EE9FCB9481F57524300F37C40BF1E935 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys
07:34:00.0894 0x1200  BthEnum - ok
07:34:00.0900 0x1200  [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
07:34:00.0919 0x1200  BTHMODEM - ok
07:34:00.0927 0x1200  [ AD1872E5829E8A2C3B5B4B641C3EAB0E, 8C2DBCAC08DDB41E2B44E257C55FA2D0272959B308EFF9EAF5FF9AE1E4A0AA39 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
07:34:00.0947 0x1200  BthPan - ok
07:34:00.0962 0x1200  [ 1153DE2E4F5941E10C399CB5592F78A1, 2B88AF246D62F72FA9F5B921B0375AE59A0F263672472D5EC9FDB5CA5EF51C31 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys
07:34:00.0990 0x1200  BTHPORT - ok
07:34:00.0996 0x1200  [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv         C:\Windows\system32\bthserv.dll
07:34:01.0031 0x1200  bthserv - ok
07:34:01.0037 0x1200  [ C81E9413A25A439F436B1D4B6A0CF9E9, A4C290163207AED22C70C7F90B28F6FC24892889643D60D915059405AC5A4A72 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
07:34:01.0053 0x1200  BTHUSB - ok
07:34:01.0059 0x1200  [ C4A3AF25CA352B22046033A0088C1563, 57D5CDB8323F673D00D4486F5BFDBA0950C6D4EE1AA5D12AB68324C5517B272C ] busenum         C:\Windows\system32\DRIVERS\busenum.sys
07:34:01.0073 0x1200  busenum - ok
07:34:01.0078 0x1200  catchme - ok
07:34:01.0085 0x1200  [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
07:34:01.0120 0x1200  cdfs - ok
07:34:01.0128 0x1200  [ BE167ED0FDB9C1FA1133953C18D5A6C9, E26A851CA13E7300F977E5B20FA5D25FD0E1442AB6AD5DB58BBDB2DAAD87027C ] cdrom           C:\Windows\system32\drivers\cdrom.sys
07:34:01.0146 0x1200  cdrom - ok
07:34:01.0152 0x1200  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] CertPropSvc     C:\Windows\System32\certprop.dll
07:34:01.0186 0x1200  CertPropSvc - ok
07:34:01.0192 0x1200  [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
07:34:01.0210 0x1200  circlass - ok
07:34:01.0222 0x1200  [ 635181E0E9BBF16871BF5380D71DB02D, 58D5150C6F3B9F1730FFDF3A8A2ABF5FF207F9785BD66C0C1E03A0F1C223A26A ] CLFS            C:\Windows\system32\CLFS.sys
07:34:01.0244 0x1200  CLFS - ok
07:34:01.0252 0x1200  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
07:34:01.0268 0x1200  clr_optimization_v2.0.50727_32 - ok
07:34:01.0275 0x1200  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
07:34:01.0295 0x1200  clr_optimization_v4.0.30319_32 - ok
07:34:01.0302 0x1200  [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
07:34:01.0318 0x1200  CmBatt - ok
07:34:01.0322 0x1200  [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
07:34:01.0337 0x1200  cmdide - ok
07:34:01.0351 0x1200  [ 3051724F223EA48968B19567DE2A81F4, DCC27DE1B2B35866FC6DBDE95A368E7D0D346B6C3F31D0BACA63DD39B0A8874E ] CNG             C:\Windows\system32\Drivers\cng.sys
07:34:01.0382 0x1200  CNG - ok
07:34:01.0386 0x1200  [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
07:34:01.0401 0x1200  Compbatt - ok
07:34:01.0406 0x1200  [ CBE8C58A8579CFE5FCCF809E6F114E89, AC083A1C649EBA18C59FCC1772D0784B10E2B8C63094E3C14388E147DBC3F6DF ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
07:34:01.0425 0x1200  CompositeBus - ok
07:34:01.0428 0x1200  COMSysApp - ok
07:34:01.0435 0x1200  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
07:34:01.0449 0x1200  crcdisk - ok
07:34:01.0459 0x1200  [ 49474B3E37969AF4B5C076F42B623AFF, BDA6B57E9B60EF1B67C74099263D33A367AAA035667239F76AB8B268FD3E8F23 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
07:34:01.0479 0x1200  CryptSvc - ok
07:34:01.0496 0x1200  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch      C:\Windows\system32\rpcss.dll
07:34:01.0541 0x1200  DcomLaunch - ok
07:34:01.0552 0x1200  [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc       C:\Windows\System32\defragsvc.dll
07:34:01.0591 0x1200  defragsvc - ok
07:34:01.0598 0x1200  [ F024449C97EC1E464AAFFDA18593DB88, 7EF1E241892E098A472BCA14C724DFF1AACCF190954AF1C4A38B6D542CC74BD2 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
07:34:01.0631 0x1200  DfsC - ok
07:34:01.0642 0x1200  [ E9E01EB683C132F7FA27CD607B8A2B63, 4D9037B458C522874619143A4176BCED42472C68933E6E83D37B67242706F3C4 ] Dhcp            C:\Windows\system32\dhcpcore.dll
07:34:01.0668 0x1200  Dhcp - ok
07:34:01.0673 0x1200  [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache        C:\Windows\system32\drivers\discache.sys
07:34:01.0708 0x1200  discache - ok
07:34:01.0714 0x1200  [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
07:34:01.0729 0x1200  Disk - ok
07:34:01.0737 0x1200  [ 33EF4861F19A0736B11314AAD9AE28D0, 4C4B84365D85758E3263B88F157D8B086B392C6F1EA5F0F3DB6BF87EF90248EC ] Dnscache        C:\Windows\System32\dnsrslvr.dll
07:34:01.0758 0x1200  Dnscache - ok
07:34:01.0768 0x1200  [ 366BA8FB4B7BB7435E3B9EACB3843F67, 65B7C61ACF34F1F0149045AA9E09A3F917A927963237A385A914D0B80551DC31 ] dot3svc         C:\Windows\System32\dot3svc.dll
07:34:01.0806 0x1200  dot3svc - ok
07:34:01.0815 0x1200  [ 8EC04CA86F1D68DA9E11952EB85973D6, 2E3FBC2D683D1274E8BC45EEEA87D43B77EDDCAAF0D453296D9FDA6B9D717071 ] DPS             C:\Windows\system32\dps.dll
07:34:01.0852 0x1200  DPS - ok
07:34:01.0856 0x1200  [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
07:34:01.0873 0x1200  drmkaud - ok
07:34:01.0897 0x1200  [ 3583A5A8CC2E682BFFBD4630D0FEC08B, FD0F184B358FCECAA763444B414074BEF4E871EB7527D88385519FC158435C72 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
07:34:01.0934 0x1200  DXGKrnl - ok
07:34:01.0941 0x1200  [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost         C:\Windows\System32\eapsvc.dll
07:34:01.0977 0x1200  EapHost - ok
07:34:02.0067 0x1200  [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv           C:\Windows\system32\DRIVERS\evbdx.sys
07:34:02.0184 0x1200  ebdrv - ok
07:34:02.0190 0x1200  [ F65F365AC0D1657917EFDB52445C848B, 1BDCEFED2799B5507B28B4D72D13D2DD7A1102B21F3938E98BA65737985A4ED9 ] EFS             C:\Windows\System32\lsass.exe
07:34:02.0207 0x1200  EFS - ok
07:34:02.0228 0x1200  [ A8C362018EFC87BEB013EE28F29C0863, 07971C681FBD391C0BA0172618AF8AD77520182207F1C57F134B34D6A113857F ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
07:34:02.0265 0x1200  ehRecvr - ok
07:34:02.0271 0x1200  [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched         C:\Windows\ehome\ehsched.exe
07:34:02.0291 0x1200  ehSched - ok
07:34:02.0308 0x1200  [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
07:34:02.0337 0x1200  elxstor - ok
07:34:02.0341 0x1200  [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
07:34:02.0358 0x1200  ErrDev - ok
07:34:02.0374 0x1200  [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem     C:\Windows\system32\es.dll
07:34:02.0417 0x1200  EventSystem - ok
07:34:02.0426 0x1200  [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat           C:\Windows\system32\drivers\exfat.sys
07:34:02.0464 0x1200  exfat - ok
07:34:02.0473 0x1200  [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
07:34:02.0511 0x1200  fastfat - ok
07:34:02.0530 0x1200  [ 967EA5B213E9984CBE270205DF37755B, 43153E23210B03FAE16897D62D55B8742F834EDC695F8401EAB5DE307F62602D ] Fax             C:\Windows\system32\fxssvc.exe
07:34:02.0568 0x1200  Fax - ok
07:34:02.0573 0x1200  [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
07:34:02.0590 0x1200  fdc - ok
07:34:02.0595 0x1200  [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost         C:\Windows\system32\fdPHost.dll
07:34:02.0630 0x1200  fdPHost - ok
07:34:02.0635 0x1200  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub        C:\Windows\system32\fdrespub.dll
07:34:02.0670 0x1200  FDResPub - ok
07:34:02.0676 0x1200  [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
07:34:02.0692 0x1200  FileInfo - ok
07:34:02.0697 0x1200  [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
07:34:02.0733 0x1200  Filetrace - ok
07:34:02.0737 0x1200  [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
07:34:02.0754 0x1200  flpydisk - ok
07:34:02.0764 0x1200  [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
07:34:02.0788 0x1200  FltMgr - ok
07:34:02.0820 0x1200  [ E12C4928B32ACE04610259647F072635, B71B9C2DF45F33C4DAC88435129B08B0BCDBBE82E8C3AD0A95F00137CC8B619F ] FontCache       C:\Windows\system32\FntCache.dll
07:34:02.0870 0x1200  FontCache - ok
07:34:02.0876 0x1200  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
07:34:02.0889 0x1200  FontCache3.0.0.0 - ok
07:34:02.0894 0x1200  [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
07:34:02.0909 0x1200  FsDepends - ok
07:34:02.0914 0x1200  [ 7DAE5EBCC80E45D3253F4923DC424D05, 8A2C4D5591509B0B0A44583520617A9AE34F32BB6E68A012A7D7870ED24F703A ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
07:34:02.0929 0x1200  Fs_Rec - ok
07:34:02.0934 0x1200  [ 49E588AC7D2B57F057756A91C6F36D25, 618E2CB3704C5F2681FA0FDA3ED701789DCC5322063B0EDFB3DA1272485E18A9 ] FUJ02B1         C:\Windows\system32\DRIVERS\FUJ02B1.sys
07:34:02.0948 0x1200  FUJ02B1 - ok
07:34:02.0952 0x1200  [ D45474A7E5E2F35150C29A3193747884, B97D8A769D2315E493CF3A161AE0BFA51127E81B5125F4936DE42747BC6A0C7F ] FUJ02E3         C:\Windows\system32\DRIVERS\FUJ02E3.sys
07:34:02.0966 0x1200  FUJ02E3 - ok
07:34:02.0975 0x1200  [ E306A24D9694C724FA2491278BF50FDB, 1D246B9C28550640EACBF8CF9DC980FD75106B92832D392FEBEF0C7012353091 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
07:34:03.0000 0x1200  fvevol - ok
07:34:03.0006 0x1200  [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
07:34:03.0022 0x1200  gagp30kx - ok
07:34:03.0045 0x1200  [ E897EAF5ED6BA41E081060C9B447A673, A428DC68516F19C6C53A8B62E4BDB2587E70FB751B9D77700B6B147D347DA157 ] gpsvc           C:\Windows\System32\gpsvc.dll
07:34:03.0096 0x1200  gpsvc - ok
07:34:03.0103 0x1200  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate         C:\Program Files\Google\Update\GoogleUpdate.exe
07:34:03.0118 0x1200  gupdate - ok
07:34:03.0124 0x1200  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
07:34:03.0138 0x1200  gupdatem - ok
07:34:03.0145 0x1200  [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
07:34:03.0162 0x1200  hcw85cir - ok
07:34:03.0175 0x1200  [ A5EF29D5315111C80A5C1ABAD14C8972, A181DA72E946F121C3F4A19438C547B0BFD15138AB1DB5465945EC89DF1F6B0A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
07:34:03.0203 0x1200  HdAudAddService - ok
07:34:03.0210 0x1200  [ 9036377B8A6C15DC2EEC53E489D159B5, 1E56D2ACFE92E6DF96D755B05C63D580EED82C210F075C8623E138BEE6BCD41B ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
07:34:03.0232 0x1200  HDAudBus - ok
07:34:03.0238 0x1200  [ A88485DC6A7136C10D9A6C7E38FDFE3C, B651823E5F6D13B086B00440AD17C7C2756F079DD9290E0FEB1A3A48D0104F8C ] HECI            C:\Windows\system32\DRIVERS\HECI.sys
07:34:03.0252 0x1200  HECI - ok
07:34:03.0257 0x1200  [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
07:34:03.0274 0x1200  HidBatt - ok
07:34:03.0280 0x1200  [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
07:34:03.0302 0x1200  HidBth - ok
07:34:03.0307 0x1200  [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
07:34:03.0325 0x1200  HidIr - ok
07:34:03.0331 0x1200  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv         C:\Windows\System32\hidserv.dll
07:34:03.0367 0x1200  hidserv - ok
07:34:03.0371 0x1200  [ 10C19F8290891AF023EAEC0832E1EB4D, E208553029488A6EE2F5216CC9FE5F93E9931A94C0D0625253BB159E30642853 ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
07:34:03.0388 0x1200  HidUsb - ok
07:34:03.0394 0x1200  [ 196B4E3F4CCCC24AF836CE58FACBB699, 7A2E1F603A073421FA0987EFB96647F1F0F2D4E0C82AA62EBC041585DA811DAF ] hkmsvc          C:\Windows\system32\kmsvc.dll
07:34:03.0428 0x1200  hkmsvc - ok
07:34:03.0443 0x1200  [ 6658F4404DE03D75FE3BA09F7ABA6A30, E51D9C1580A283EB862F09B73AAE1B647DD683A53F3DD99834222F12DD15E40F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
07:34:03.0467 0x1200  HomeGroupListener - ok
07:34:03.0477 0x1200  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8, 02121800D9062692C102475876AE8143EBE46D855E8328B8CDCFE6A2F0D19696 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
07:34:03.0499 0x1200  HomeGroupProvider - ok
07:34:03.0505 0x1200  [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
07:34:03.0521 0x1200  HpSAMD - ok
07:34:03.0550 0x1200  [ 9D23402D305869844BC6004A05CC74BA, E7291966528555206859CD1AEBB8F12C6B2A4A0E17F8F3FF307A9AE2310B21CB ] HPSLPSVC        C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL
07:34:03.0583 0x1200  HPSLPSVC - ok
07:34:03.0602 0x1200  [ 871917B07A141BFF43D76D8844D48106, 30C702008D0EE57D63F74864967DD19A55A268E77E42B5B3CC73037AD51D2987 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
07:34:03.0653 0x1200  HTTP - ok
07:34:03.0657 0x1200  [ 0C4E035C7F105F1299258C90886C64C5, CFB4FBE7B28058E6D3E6E508CF3C1645F6AAE0AFEB4C5364835B9C42311DF0D4 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
07:34:03.0672 0x1200  hwpolicy - ok
07:34:03.0678 0x1200  [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
07:34:03.0697 0x1200  i8042prt - ok
07:34:03.0713 0x1200  [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E, 72870092A80C6DAE0105025B0ED8B607E98BA81E59298364A7FE4C9C56C68FF0 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
07:34:03.0738 0x1200  iaStorV - ok
07:34:03.0766 0x1200  [ 3E9213A2A050BF429E91898C90F8B4E3, D80ABE5691087661B19F01927B631CB8C5291120B814B6F863F046E0D643E9E4 ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
07:34:03.0810 0x1200  idsvc - ok
07:34:03.0814 0x1200  IEEtwCollectorService - ok
07:34:04.0145 0x1200  [ 40F8A0F85BCE94F766808AEEE8F96FA8, 7D80BA9501F42CD5B41337F7C69B8CD7E57D1EC1C516ECAC2002DF66A8826C78 ] igfx            C:\Windows\system32\DRIVERS\igdkmd32.sys
07:34:04.0538 0x1200  igfx - ok
07:34:04.0546 0x1200  [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
07:34:04.0562 0x1200  iirsp - ok
07:34:04.0585 0x1200  [ B9C54120F46392100478F58F374E5709, A28EE8B0988F580D5984E815FC78DF41B169260814234AA0E453375542D0957B ] IKEEXT          C:\Windows\System32\ikeext.dll
07:34:04.0622 0x1200  IKEEXT - ok
07:34:04.0713 0x1200  [ 0A0E3C041C20C4175E1CC6580138CA38, 39B990022C3536D51D979E5D2A9321162EAD327F08A3A98A2C56FEED280ACE40 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
07:34:04.0818 0x1200  IntcAzAudAddService - ok
07:34:04.0829 0x1200  [ 2D79C681CE6D53A0C6C725A84594DF4C, 282AE9AFB6DEECD0C551FA7EB4F16BFBCCB8EB3AB1D32414AD8CBD336C37AF49 ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
07:34:04.0849 0x1200  IntcDAud - ok
07:34:04.0854 0x1200  [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide        C:\Windows\system32\drivers\intelide.sys
07:34:04.0869 0x1200  intelide - ok
07:34:04.0875 0x1200  [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
07:34:04.0893 0x1200  intelppm - ok
07:34:04.0899 0x1200  [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
07:34:04.0936 0x1200  IPBusEnum - ok
07:34:04.0942 0x1200  [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
07:34:04.0977 0x1200  IpFilterDriver - ok
07:34:04.0995 0x1200  [ 58F67245D041FBE7AF88F4EAF79DF0FA, 67468D6A46FF4D87AD321BFEA42F2FC843D09AA292A119C76D4D795D06028F96 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
07:34:05.0028 0x1200  iphlpsvc - ok
07:34:05.0034 0x1200  [ 4BD7134618C1D2A27466A099062547BF, 20284ABEF4433A59E2981F4143CAEC67DC990864FE0B9E3DC70EE0B88539E964 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
07:34:05.0052 0x1200  IPMIDRV - ok
07:34:05.0060 0x1200  [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
07:34:05.0097 0x1200  IPNAT - ok
07:34:05.0101 0x1200  [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM          C:\Windows\system32\drivers\irenum.sys
07:34:05.0125 0x1200  IRENUM - ok
07:34:05.0130 0x1200  [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp          C:\Windows\system32\drivers\isapnp.sys
07:34:05.0145 0x1200  isapnp - ok
07:34:05.0156 0x1200  [ EB34CE31FABD4DC4343FD2AD16D2CAF9, D21C91227A15DA89ECF522345D0AB80B3B7FC24A230596DABDB8BD3B7554CE8C ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
07:34:05.0177 0x1200  iScsiPrt - ok
07:34:05.0182 0x1200  [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
07:34:05.0198 0x1200  kbdclass - ok
07:34:05.0207 0x1200  [ 9E3CED91863E6EE98C24794D05E27A71, 90CF59F20E14E4A5A793266805E82BF7AE1F0CF4C7BAB1FD2EEF3B53C5DF770F ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
07:34:05.0225 0x1200  kbdhid - ok
07:34:05.0229 0x1200  [ F65F365AC0D1657917EFDB52445C848B, 1BDCEFED2799B5507B28B4D72D13D2DD7A1102B21F3938E98BA65737985A4ED9 ] KeyIso          C:\Windows\system32\lsass.exe
07:34:05.0245 0x1200  KeyIso - ok
07:34:05.0254 0x1200  [ 6022F174CEB149650DCB5BE445A0E72A, D5BD12A5220311A60BEFBE34D9F324EE845AFBBC2630F97AA27E1C1CF0189978 ] kl1             C:\Windows\system32\DRIVERS\kl1.sys
07:34:05.0271 0x1200  kl1 - ok
07:34:05.0279 0x1200  [ 3EAA179537FF9A3C9071E868C07275FA, 4412D57E2BECA9871B8BE6EC4EB7EACB33761D999BC69D85B8E84959BA6D4795 ] klflt           C:\Windows\system32\DRIVERS\klflt.sys
07:34:05.0295 0x1200  klflt - ok
07:34:05.0300 0x1200  [ C02EC9EEE4E3CFEF82478B9C345F94FE, C86CD0AAE4C9B5AD53FE3CAA60CC957BBBBA8F67A073C1B74A89A93EF2596B85 ] klhk            C:\Windows\system32\DRIVERS\klhk.sys
07:34:05.0314 0x1200  klhk - ok
07:34:05.0337 0x1200  [ 894A09BF826E79C1971ADE0121F2B607, E88E87D75E6EB2DBB48DFD50F6B9191F9279E39DD503EF926DE5497D14B44D20 ] KLIF            C:\Windows\system32\DRIVERS\klif.sys
07:34:05.0374 0x1200  KLIF - ok
07:34:05.0379 0x1200  [ D1FC14342F8CAD20A0764305AD62483D, FC3010AAD57C7CEB987AE930C1B7A7C1AD9291B98F92F5C9448D56C92270C9F1 ] KLIM6           C:\Windows\system32\DRIVERS\klim6.sys
07:34:05.0393 0x1200  KLIM6 - ok
07:34:05.0398 0x1200  [ 9C7132A2E609E0BACF2A54AC13C9BDCB, E7E3949C6FA35CC06A1B010DA04462824BC7F3EE6A498F64CB2457C901F999F7 ] klkbdflt        C:\Windows\system32\DRIVERS\klkbdflt.sys
07:34:05.0411 0x1200  klkbdflt - ok
07:34:05.0416 0x1200  [ 035724BA6D5676B76FD3AFB66AB4F1E3, 81B30112B96DD3E7250420EEFF2ACECD424A2BE155E83C44434321CEA7DBE117 ] klmouflt        C:\Windows\system32\DRIVERS\klmouflt.sys
07:34:05.0430 0x1200  klmouflt - ok
07:34:05.0434 0x1200  [ EB0D72D2844C57F5F146D7A15B04FBF9, 3DFEDA024AD5D54EEAF7D4411153CFA8AD95FCF217E09F2B7AFD2D91EE623BF2 ] klpd            C:\Windows\system32\DRIVERS\klpd.sys
07:34:05.0448 0x1200  klpd - ok
07:34:05.0453 0x1200  [ 3EA7D183499C7C5824AA13DA1A7CDA26, E47B6B1A4050D135CE3CD3EC1076A221E4995798B21B1534A3CDB7E050FB0F65 ] kltdi           C:\Windows\system32\DRIVERS\kltdi.sys
07:34:05.0467 0x1200  kltdi - ok
07:34:05.0475 0x1200  [ E111A2947A4D26CC4A30D2BF2E7A8D69, DF63FF0AB60C9894EF1302A2155EBAF25177811069A9CEFF1504D10C28A48380 ] kneps           C:\Windows\system32\DRIVERS\kneps.sys
07:34:05.0492 0x1200  kneps - ok
07:34:05.0498 0x1200  [ 4DAC97CF81FAE4B2988AEF0DF40D04AE, 5560304972693DE5D5B21CE010A76067FA5B64AD5968122EE9F8248B3EA4878E ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
07:34:05.0514 0x1200  KSecDD - ok
07:34:05.0524 0x1200  [ 9EED5E0B7BF784C491C2289A09920BDA, 9E82EB777A01AB32EDA2AE0420546602A82C850D68D2C0AEDB4EA5ADEDF835E6 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
07:34:05.0542 0x1200  KSecPkg - ok
07:34:05.0555 0x1200  [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm           C:\Windows\system32\msdtckrm.dll
07:34:05.0599 0x1200  KtmRm - ok
07:34:05.0609 0x1200  [ D64AF876D53ECA3668BB97B51B4E70AB, D5C07C019BFEAFBEDC29AB5060356A3B07449712B21B50E03378BEF04AF180F9 ] LanmanServer    C:\Windows\System32\srvsvc.dll
07:34:05.0647 0x1200  LanmanServer - ok
07:34:05.0653 0x1200  [ 58405E4F68BA8E4057C6E914F326ABA2, C3E6519A1A38F1B3597D4391E42ABFE8F1F5E86256C4B3BD876CDAD9BB68B0A6 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
07:34:05.0689 0x1200  LanmanWorkstation - ok
07:34:05.0696 0x1200  [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
07:34:05.0731 0x1200  lltdio - ok
07:34:05.0740 0x1200  [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc         C:\Windows\System32\lltdsvc.dll
07:34:05.0781 0x1200  lltdsvc - ok
07:34:05.0785 0x1200  [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts         C:\Windows\System32\lmhsvc.dll
07:34:05.0818 0x1200  lmhosts - ok
07:34:05.0830 0x1200  [ A1C148801B4AF64847AEB9F3AD9594EF, FF6ED89EA47DF74C33CD8BFAC48FAED1B979348ABA6B6D94EE07CBD21810F37B ] LMS             C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
07:34:05.0844 0x1200  LMS - detected UnsignedFile.Multi.Generic ( 1 )
07:34:05.0905 0x1200  LMS ( UnsignedFile.Multi.Generic ) - warning
07:34:05.0914 0x1200  [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
07:34:05.0931 0x1200  LSI_FC - ok
07:34:05.0938 0x1200  [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
07:34:05.0954 0x1200  LSI_SAS - ok
07:34:05.0960 0x1200  [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
07:34:05.0977 0x1200  LSI_SAS2 - ok
07:34:05.0984 0x1200  [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
07:34:06.0001 0x1200  LSI_SCSI - ok
07:34:06.0007 0x1200  [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv           C:\Windows\system32\drivers\luafv.sys
07:34:06.0042 0x1200  luafv - ok
07:34:06.0048 0x1200  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1, D2A84EBF0C0B7A14AD432FD2EF43CC12300027AEA3FA4075659FB088AB62B588 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
07:34:06.0067 0x1200  Mcx2Svc - ok
07:34:06.0072 0x1200  [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
07:34:06.0087 0x1200  megasas - ok
07:34:06.0099 0x1200  [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
07:34:06.0120 0x1200  MegaSR - ok
07:34:06.0128 0x1200  Microsoft SharePoint Workspace Audit Service - ok
07:34:06.0133 0x1200  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS           C:\Windows\system32\mmcss.dll
07:34:06.0168 0x1200  MMCSS - ok
07:34:06.0173 0x1200  [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem           C:\Windows\system32\drivers\modem.sys
07:34:06.0206 0x1200  Modem - ok
07:34:06.0210 0x1200  [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
07:34:06.0229 0x1200  monitor - ok
07:34:06.0235 0x1200  [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass        C:\Windows\system32\drivers\mouclass.sys
07:34:06.0250 0x1200  mouclass - ok
07:34:06.0255 0x1200  [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
07:34:06.0272 0x1200  mouhid - ok
07:34:06.0279 0x1200  [ 644905A19D0F37F2233DFCE53BC4BC19, F52CB40AA0FD1EBF8CBF0F3BFB20C47142C637719840877FB93F10D085EB8C2B ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
07:34:06.0295 0x1200  mountmgr - ok
07:34:06.0302 0x1200  [ E1B6FCAE82474FC071155263E2841D54, 341E2CEB1A86586730130311C4FAF86851151D5F08EF915A5F89B6C4094AE1F4 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice_tmp.exe
07:34:06.0320 0x1200  MozillaMaintenance - ok
07:34:06.0328 0x1200  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0, D3D903EEA465D77345AAC9B9F02CDEADF4831212EA2DE4FCA33BEE26EBB47420 ] mpio            C:\Windows\system32\drivers\mpio.sys
07:34:06.0345 0x1200  mpio - ok
07:34:06.0351 0x1200  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
07:34:06.0383 0x1200  mpsdrv - ok
07:34:06.0404 0x1200  [ 9835584E999D25004E1EE8E5F3E3B881, 71798B0CBE9AE69F1F29B845319019C69EC7F415CBABB3B87DDE92C360675021 ] MpsSvc          C:\Windows\system32\mpssvc.dll
07:34:06.0454 0x1200  MpsSvc - ok
07:34:06.0462 0x1200  [ 03F899F521D2AAED1C55008F734DF252, 4E56A51476A13F5630719018037B1F63DF9ACEA1CFE782AF04E669BD696954C5 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
07:34:06.0481 0x1200  MRxDAV - ok
07:34:06.0489 0x1200  [ 5D16C921E3671636C0EBA3BBAAC5FD25, 5BC107B95CAFC88F51FBB9F657B99944B20627A2B618F263093D7045E4FFD65C ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
07:34:06.0508 0x1200  mrxsmb - ok
07:34:06.0518 0x1200  [ 6D17A4791ACA19328C685D256349FEFC, 012AA3D84EEAAF53780D06D2D11B9727DFC3441F3FAD75BC9E751FB814403668 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
07:34:06.0541 0x1200  mrxsmb10 - ok
07:34:06.0548 0x1200  [ B81F204D146000BE76651A50670A5E9E, 78193D0F967BE9829E53F9B500342934B4B1E1F4CEFC444382959E2061BC3B17 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
07:34:06.0566 0x1200  mrxsmb20 - ok
07:34:06.0571 0x1200  [ 012C5F4E9349E711E11E0F19A8589F0A, 208B92DFCF7AD43202660FBBC9FF5E03AEDBEE38178FF3628EB74CB6CD37C584 ] msahci          C:\Windows\system32\drivers\msahci.sys
07:34:06.0586 0x1200  msahci - ok
07:34:06.0593 0x1200  [ 55055F8AD8BE27A64C831322A780A228, C2C9FD1F61302997117B1CD0835E8234405BB80084065ED05363B77868397304 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
07:34:06.0610 0x1200  msdsm - ok
07:34:06.0619 0x1200  [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC           C:\Windows\System32\msdtc.exe
07:34:06.0641 0x1200  MSDTC - ok
07:34:06.0650 0x1200  [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs            C:\Windows\system32\drivers\Msfs.sys
07:34:06.0683 0x1200  Msfs - ok
07:34:06.0687 0x1200  [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
07:34:06.0720 0x1200  mshidkmdf - ok
07:34:06.0727 0x1200  [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
07:34:06.0741 0x1200  msisadrv - ok
07:34:06.0749 0x1200  [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
07:34:06.0784 0x1200  MSiSCSI - ok
07:34:06.0787 0x1200  msiserver - ok
07:34:06.0793 0x1200  [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
07:34:06.0826 0x1200  MSKSSRV - ok
07:34:06.0830 0x1200  [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
07:34:06.0864 0x1200  MSPCLOCK - ok
07:34:06.0868 0x1200  [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
07:34:06.0901 0x1200  MSPQM - ok
07:34:06.0909 0x1200  [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
07:34:06.0928 0x1200  MsRPC - ok
07:34:06.0936 0x1200  [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
07:34:06.0950 0x1200  mssmbios - ok
07:34:06.0955 0x1200  [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
07:34:06.0988 0x1200  MSTEE - ok
07:34:06.0993 0x1200  [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
07:34:07.0009 0x1200  MTConfig - ok
07:34:07.0014 0x1200  [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup             C:\Windows\system32\Drivers\mup.sys
07:34:07.0030 0x1200  Mup - ok
07:34:07.0043 0x1200  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E, D252248532142E9E2332DA693BC51B795102CA938B568FF04981E98B19BFBC5C ] napagent        C:\Windows\system32\qagentRT.dll
07:34:07.0086 0x1200  napagent - ok
07:34:07.0099 0x1200  [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
07:34:07.0127 0x1200  NativeWifiP - ok
07:34:07.0151 0x1200  [ 8C9C922D71F1CD4DEF73F186416B7896, 15FF43CD90C7913F83B35F2E7986561584588E8A45196EBD965C3A355836A9C7 ] NDIS            C:\Windows\system32\drivers\ndis.sys
07:34:07.0188 0x1200  NDIS - ok
07:34:07.0193 0x1200  [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
07:34:07.0227 0x1200  NdisCap - ok
07:34:07.0232 0x1200  [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
07:34:07.0264 0x1200  NdisTapi - ok
07:34:07.0269 0x1200  [ D8A65DAFB3EB41CBB622745676FCD072, 874D3C3D247C4A309DA813DB1D2EDB0037D3C489824BD5FE95B0C20699764EF7 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
07:34:07.0301 0x1200  Ndisuio - ok
07:34:07.0309 0x1200  [ 38FBE267E7E6983311179230FACB1017, CFD1CBCA59650795C030DB30E5795B37C11C736E14003AE1DAB081BA5C0C9B14 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
07:34:07.0344 0x1200  NdisWan - ok
07:34:07.0350 0x1200  [ A4BDC541E69674FBFF1A8FF00BE913F2, 18CCFD063E9870B8B6958715BC0414C4D920AE63528EA1E9D7E30F7138918FFA ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
07:34:07.0383 0x1200  NDProxy - ok
07:34:07.0388 0x1200  [ 69C503C004F49AEE8B8E3067CC047BA7, 0E7A2FB0CC7669E6400EDA4D2220BBB1A85CF3D3529739DA5AE2C073FFA08313 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
07:34:07.0395 0x1200  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
07:34:07.0396 0x1200  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
07:34:07.0401 0x1200  [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
07:34:07.0435 0x1200  NetBIOS - ok
07:34:07.0445 0x1200  [ 280122DDCF04B378EDD1AD54D71C1E54, F98B2ADE34F7E67C7C06C1D0FFB80ECBC353D044D4B4784CD952910345DC2ED0 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
07:34:07.0482 0x1200  NetBT - ok
07:34:07.0487 0x1200  [ F65F365AC0D1657917EFDB52445C848B, 1BDCEFED2799B5507B28B4D72D13D2DD7A1102B21F3938E98BA65737985A4ED9 ] Netlogon        C:\Windows\system32\lsass.exe
07:34:07.0503 0x1200  Netlogon - ok
07:34:07.0515 0x1200  [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman          C:\Windows\System32\netman.dll
07:34:07.0558 0x1200  Netman - ok
07:34:07.0566 0x1200  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
07:34:07.0587 0x1200  NetMsmqActivator - ok
07:34:07.0593 0x1200  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
07:34:07.0613 0x1200  NetPipeActivator - ok
07:34:07.0627 0x1200  [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm        C:\Windows\System32\netprofm.dll
07:34:07.0672 0x1200  netprofm - ok
07:34:07.0680 0x1200  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
07:34:07.0699 0x1200  NetTcpActivator - ok
07:34:07.0706 0x1200  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
07:34:07.0725 0x1200  NetTcpPortSharing - ok
07:34:07.0731 0x1200  [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
07:34:07.0747 0x1200  nfrd960 - ok
07:34:07.0759 0x1200  [ F115C5CD29E512F18BD7138A094B77E5, 90C2CE8B256EE9AABF674ADDE7F85E91DAF48EA368452D03C187A4AE027D4E39 ] NlaSvc          C:\Windows\System32\nlasvc.dll
07:34:07.0783 0x1200  NlaSvc - ok
07:34:07.0788 0x1200  [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
07:34:07.0823 0x1200  Npfs - ok
07:34:07.0828 0x1200  [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi             C:\Windows\system32\nsisvc.dll
07:34:07.0864 0x1200  nsi - ok
07:34:07.0869 0x1200  [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
07:34:07.0902 0x1200  nsiproxy - ok
07:34:07.0943 0x1200  [ C8DFF8D07755A66C7A4A738930F0FEAC, A2CC58312CE57988ABD976155BE91F558DCEC4C23481C6FBE64B361D511A36EA ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
07:34:07.0997 0x1200  Ntfs - ok
07:34:08.0001 0x1200  [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null            C:\Windows\system32\drivers\Null.sys
07:34:08.0035 0x1200  Null - ok
07:34:08.0042 0x1200  [ B3E25EE28883877076E0E1FF877D02E0, 402B6FED6FBBF645190396DC141141EF52DD059DABD01F8AC9CF01D23664070C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
07:34:08.0060 0x1200  nvraid - ok
07:34:08.0068 0x1200  [ 4380E59A170D88C4F1022EFF6719A8A4, 93EDB3F4CDBF53C9C1970DD29AB146E390695C568180847BA8903F5FBEABCFF2 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
07:34:08.0087 0x1200  nvstor - ok
07:34:08.0094 0x1200  [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
07:34:08.0111 0x1200  nv_agp - ok
07:34:08.0117 0x1200  [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
07:34:08.0137 0x1200  ohci1394 - ok
07:34:08.0147 0x1200  [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose             C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
07:34:08.0166 0x1200  ose - ok
07:34:08.0327 0x1200  [ 358A9CCA612C68EB2F07DDAD4CE1D8D7, F342100E2E9001F11FDF93F856B50FA43F9B85D2C6B5706EC0433E77206498DA ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
07:34:08.0501 0x1200  osppsvc - ok
07:34:08.0517 0x1200  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
07:34:08.0543 0x1200  p2pimsvc - ok
07:34:08.0557 0x1200  [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc          C:\Windows\system32\p2psvc.dll
07:34:08.0585 0x1200  p2psvc - ok
07:34:08.0591 0x1200  [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport         C:\Windows\system32\DRIVERS\parport.sys
07:34:08.0610 0x1200  Parport - ok
07:34:08.0616 0x1200  [ 3F34A1B4C5F6475F320C275E63AFCE9B, 31295D5121C0C3F2085E0EEBA260EEE4CA003993C026E2F81986D19158036E6B ] partmgr         C:\Windows\system32\drivers\partmgr.sys
07:34:08.0656 0x1200  partmgr - ok
07:34:08.0660 0x1200  [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
07:34:08.0680 0x1200  Parvdm - ok
07:34:08.0689 0x1200  [ 52954BE460EC6C54C0ACB2B3B126FFC6, 9F9878EC5ABC74C5A8EE8E1D940F0934F081895B07D844F42F80A638FE713F7B ] PcaSvc          C:\Windows\System32\pcasvc.dll
07:34:08.0713 0x1200  PcaSvc - ok
07:34:08.0721 0x1200  [ 673E55C3498EB970088E812EA820AA8F, 1F81315664B8CBFDD569416C0ECCE4C6251F34577313A0858AB46609781303B5 ] pci             C:\Windows\system32\drivers\pci.sys
07:34:08.0741 0x1200  pci - ok
07:34:08.0745 0x1200  [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide          C:\Windows\system32\drivers\pciide.sys
07:34:08.0760 0x1200  pciide - ok
07:34:08.0769 0x1200  [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
07:34:08.0789 0x1200  pcmcia - ok
07:34:08.0794 0x1200  [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw             C:\Windows\system32\drivers\pcw.sys
07:34:08.0810 0x1200  pcw - ok
07:34:08.0830 0x1200  [ AEBC369F7DC72AB3F5B9BDF34FA0D43F, 2A819154AC6C23E97C583D90B4D0C112188B7AE9D8D9B3F88811BFCED124E551 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
07:34:08.0868 0x1200  PEAUTH - ok
07:34:08.0922 0x1200  [ 414BBA67A3DED1D28437EB66AEB8A720, D6DF254E2615FA402044824DCD9004F579FC0DF74B90E44C99D5F0253CF8AD88 ] pla             C:\Windows\system32\pla.dll
07:34:09.0004 0x1200  pla - ok
07:34:09.0017 0x1200  [ EC7BC28D207DA09E79B3E9FAF8B232CA, A42F8F69C3CD753D787A5D558659DEA2CC306C896D75B8C82549219CF654504F ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
07:34:09.0044 0x1200  PlugPlay - ok
07:34:09.0050 0x1200  [ 12B4549D515CB26BB8D375038017CA65, B09ED2BED994D2B04862BBF62EF56F110235D3489D3B1762432F22A3A8F97BB8 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
07:34:09.0058 0x1200  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
07:34:09.0058 0x1200  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
07:34:09.0064 0x1200  [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
07:34:09.0081 0x1200  PNRPAutoReg - ok
07:34:09.0093 0x1200  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
07:34:09.0116 0x1200  PNRPsvc - ok
07:34:09.0131 0x1200  [ 53946B69BA0836BD95B03759530C81EC, 7F14A34635354CCA0F5342C8D9DF5A6AA1B94F6A508BD8834029E9BACF252920 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
07:34:09.0175 0x1200  PolicyAgent - ok
07:34:09.0184 0x1200  [ F87D30E72E03D579A5199CCB3831D6EA, B09328E89954584F97908FA5946376BA990B8C650DABCBF3CA3B08719937C694 ] Power           C:\Windows\system32\umpo.dll
07:34:09.0221 0x1200  Power - ok
07:34:09.0227 0x1200  [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
07:34:09.0263 0x1200  PptpMiniport - ok
07:34:09.0269 0x1200  [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
07:34:09.0287 0x1200  Processor - ok
07:34:09.0295 0x1200  [ FD9692A3D31E021207D3C2A9DDDC2BE3, 5295EFAD9BD4B59996935A41825392C12A4C968D161BEEA37797F90AF8E54229 ] ProfSvc         C:\Windows\system32\profsvc.dll
07:34:09.0317 0x1200  ProfSvc - ok
07:34:09.0321 0x1200  [ F65F365AC0D1657917EFDB52445C848B, 1BDCEFED2799B5507B28B4D72D13D2DD7A1102B21F3938E98BA65737985A4ED9 ] ProtectedStorage C:\Windows\system32\lsass.exe
07:34:09.0337 0x1200  ProtectedStorage - ok
07:34:09.0344 0x1200  [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
07:34:09.0380 0x1200  Psched - ok
07:34:09.0425 0x1200  [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
07:34:09.0487 0x1200  ql2300 - ok
07:34:09.0494 0x1200  [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
07:34:09.0512 0x1200  ql40xx - ok
07:34:09.0522 0x1200  [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE           C:\Windows\system32\qwave.dll
07:34:09.0550 0x1200  QWAVE - ok
07:34:09.0555 0x1200  [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
07:34:09.0575 0x1200  QWAVEdrv - ok
07:34:09.0579 0x1200  [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
07:34:09.0613 0x1200  RasAcd - ok
07:34:09.0618 0x1200  [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
07:34:09.0651 0x1200  RasAgileVpn - ok
07:34:09.0658 0x1200  [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto         C:\Windows\System32\rasauto.dll
07:34:09.0695 0x1200  RasAuto - ok
07:34:09.0701 0x1200  [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
07:34:09.0737 0x1200  Rasl2tp - ok
07:34:09.0749 0x1200  [ CB9E04DC05EACF5B9A36CA276D475006, 4D8C0AEF1D4F84F375AD2BAF786C9F6C52316A3E655B913449E71AD7C0FCA56E ] RasMan          C:\Windows\System32\rasmans.dll
07:34:09.0791 0x1200  RasMan - ok
07:34:09.0797 0x1200  [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
07:34:09.0832 0x1200  RasPppoe - ok
07:34:09.0838 0x1200  [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
07:34:09.0872 0x1200  RasSstp - ok
07:34:09.0883 0x1200  [ D528BC58A489409BA40334EBF96A311B, C71E9A4B101DB6C3183B9F97B9098D73D6FE1B12C05C2EB3CE8A8041BEE6BA61 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
07:34:09.0922 0x1200  rdbss - ok
07:34:09.0927 0x1200  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
07:34:09.0946 0x1200  rdpbus - ok
07:34:09.0951 0x1200  [ 23DAE03F29D253AE74C44F99E515F9A1, 8FED93D10B2062F0526FE3508101F8FCF8F72DEB90AFB472EB7CBAE83A0EC430 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
07:34:09.0982 0x1200  RDPCDD - ok
07:34:09.0989 0x1200  [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
07:34:10.0021 0x1200  RDPENCDD - ok
07:34:10.0027 0x1200  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
07:34:10.0057 0x1200  RDPREFMP - ok
07:34:10.0064 0x1200  [ 65375DF758CA1872AB7EBBBA457FD5E6, 8AC7681F51277E799C22FF95FA0B833E9E260D37C0416319FF05B66FB3948005 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
07:34:10.0083 0x1200  RdpVideoMiniport - ok
07:34:10.0093 0x1200  [ CD9214A6AE17D188D17C3CF8CB9CC693, 2E16FF1F7446F0600D6519010FD05A30B94D97167C16B3E7FC396A97D8139D60 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
07:34:10.0115 0x1200  RDPWD - ok
07:34:10.0124 0x1200  [ 518395321DC96FE2C9F0E96AC743B656, 5F6A0880B4F3EE7196259EA362DA9554B0687B0236F9A8E5CF7A4A77F01F1776 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
07:34:10.0144 0x1200  rdyboost - ok
07:34:10.0150 0x1200  [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess    C:\Windows\System32\mprdim.dll
07:34:10.0186 0x1200  RemoteAccess - ok
07:34:10.0193 0x1200  [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry  C:\Windows\system32\regsvc.dll
07:34:10.0231 0x1200  RemoteRegistry - ok
07:34:10.0239 0x1200  [ CB928D9E6DAF51879DD6BA8D02F01321, DFD263B67DDF98AE09AF6D6986CBC7BE3206BCE8403AAC51BCF9459E78233D12 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
07:34:10.0261 0x1200  RFCOMM - ok
07:34:10.0267 0x1200  [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
07:34:10.0303 0x1200  RpcEptMapper - ok
07:34:10.0307 0x1200  [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator      C:\Windows\system32\locator.exe
07:34:10.0324 0x1200  RpcLocator - ok
07:34:10.0339 0x1200  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs           C:\Windows\system32\rpcss.dll
07:34:10.0381 0x1200  RpcSs - ok
07:34:10.0387 0x1200  [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
07:34:10.0422 0x1200  rspndr - ok
07:34:10.0434 0x1200  [ 80B66A4181F782884A815E69D0AFA743, 23C8B4D5727D9D8AA920D66DC63B01CB0333ABA923832ED7ED9C7210EED84EEF ] RTL8167         C:\Windows\system32\DRIVERS\Rt86win7.sys
07:34:10.0454 0x1200  RTL8167 - ok
07:34:10.0459 0x1200  [ F65F365AC0D1657917EFDB52445C848B, 1BDCEFED2799B5507B28B4D72D13D2DD7A1102B21F3938E98BA65737985A4ED9 ] SamSs           C:\Windows\system32\lsass.exe
07:34:10.0475 0x1200  SamSs - ok
07:34:10.0481 0x1200  [ 05D860DA1040F111503AC416CCEF2BCA, DAE2F37D09A5A42F945BC8E27E4EA2303521081783A80CEE7FEE7C5A1C2CFC5E ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
07:34:10.0498 0x1200  sbp2port - ok
07:34:10.0507 0x1200  [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
07:34:10.0545 0x1200  SCardSvr - ok
07:34:10.0549 0x1200  [ 0693B5EC673E34DC147E195779A4DCF6, AF1B56FBF3ADABF94CD9DBA67586B8746DE135151F6B3D1B0EE315BC1E2DB670 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
07:34:10.0582 0x1200  scfilter - ok
07:34:10.0608 0x1200  [ A04BB13F8A72F8B6E8B4071723E4E336, E63287FF71C39CBF64C3347C455324C8437F9CF398153E269543588B65389502 ] Schedule        C:\Windows\system32\schedsvc.dll
07:34:10.0667 0x1200  Schedule - ok
07:34:10.0673 0x1200  [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] SCPolicySvc     C:\Windows\System32\certprop.dll
07:34:10.0706 0x1200  SCPolicySvc - ok
07:34:10.0713 0x1200  [ 08236C4BCE5EDD0A0318A438AF28E0F7, 77727F963F63C4CEC11E7AAD5FB3836179701D512CA9436C3170B9E6A4E5F888 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
07:34:10.0734 0x1200  SDRSVC - ok
07:34:10.0739 0x1200  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
07:34:10.0773 0x1200  secdrv - ok
07:34:10.0778 0x1200  [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon        C:\Windows\system32\seclogon.dll
07:34:10.0813 0x1200  seclogon - ok
07:34:10.0819 0x1200  [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS            C:\Windows\system32\sens.dll
07:34:10.0854 0x1200  SENS - ok
07:34:10.0859 0x1200  [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
07:34:10.0877 0x1200  SensrSvc - ok
07:34:10.0882 0x1200  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
07:34:10.0899 0x1200  Serenum - ok
07:34:10.0906 0x1200  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial          C:\Windows\system32\DRIVERS\serial.sys
07:34:10.0924 0x1200  Serial - ok
07:34:10.0929 0x1200  [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
07:34:10.0945 0x1200  sermouse - ok
07:34:10.0960 0x1200  [ 4AE380F39A0032EAB7DD953030B26D28, C8F5F2DD59574E966FDF3057867BB959A554BAB6FD5DC6F1427094A6BC2B2809 ] SessionEnv      C:\Windows\system32\sessenv.dll
07:34:10.0996 0x1200  SessionEnv - ok
07:34:11.0001 0x1200  [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
07:34:11.0018 0x1200  sffdisk - ok
07:34:11.0022 0x1200  [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
07:34:11.0039 0x1200  sffp_mmc - ok
07:34:11.0044 0x1200  [ 6D4CCAEDC018F1CF52866BBBAA235982, AAC41F5C97B3FE5A3DC0838457EB8CC9BB71FCA16D3EDBB67D603F0A9D46C131 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
07:34:11.0069 0x1200  sffp_sd - ok
07:34:11.0074 0x1200  [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
07:34:11.0090 0x1200  sfloppy - ok
07:34:11.0103 0x1200  [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess    C:\Windows\System32\ipnathlp.dll
07:34:11.0146 0x1200  SharedAccess - ok
07:34:11.0159 0x1200  [ 414DA952A35BF5D50192E28263B40577, 9C9BAFB9880DA6CC728506A142BE124E186219610DCC3460657A3CA93C865DF1 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
07:34:11.0202 0x1200  ShellHWDetection - ok
07:34:11.0208 0x1200  [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp          C:\Windows\system32\drivers\sisagp.sys
07:34:11.0224 0x1200  sisagp - ok
07:34:11.0229 0x1200  [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
07:34:11.0245 0x1200  SiSRaid2 - ok
07:34:11.0251 0x1200  [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
07:34:11.0268 0x1200  SiSRaid4 - ok
07:34:11.0281 0x1200  [ A9C057A9463C25490CF99EA8DF8A4B35, 8F4D1C40D0F17EDBF84ED455B8946F782C7552383F0A07E410A9B6CFF7F51D63 ] SkypeUpdate     C:\Program Files\Skype\Updater\Updater.exe
07:34:11.0307 0x1200  SkypeUpdate - ok
07:34:11.0314 0x1200  [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
07:34:11.0349 0x1200  Smb - ok
07:34:11.0358 0x1200  [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
07:34:11.0376 0x1200  SNMPTRAP - ok
07:34:11.0381 0x1200  [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr           C:\Windows\system32\drivers\spldr.sys
07:34:11.0396 0x1200  spldr - ok
07:34:11.0409 0x1200  [ 9AEA093B8F9C37CF45538382CABA2475, CC63239C412067AA72318ADB8BB80BCDF2CA60DA05D814D32753C92508BC16A8 ] Spooler         C:\Windows\System32\spoolsv.exe
07:34:11.0437 0x1200  Spooler - ok
07:34:11.0539 0x1200  [ CF87A1DE791347E75B98885214CED2B8, 7AF4E03D751C951A4E5FBA28200DABFE6B3BF055490163EEEEA84EBA4D0F368A ] sppsvc          C:\Windows\system32\sppsvc.exe
07:34:11.0683 0x1200  sppsvc - ok
07:34:11.0690 0x1200  [ B0180B20B065D89232A78A40FE56EAA6, 4D045B23AD58A8822BE9F20119744A8D47455469D54494745CEB099951DA60FF ] sppuinotify     C:\Windows\system32\sppuinotify.dll
07:34:11.0724 0x1200  sppuinotify - ok
07:34:11.0737 0x1200  [ E4C2764065D66EA1D2D3EBC28FE99C46, 043AEF06A23069DD17675955C834690A5FD8F1948A05B3969F977E823C4E25F5 ] srv             C:\Windows\system32\DRIVERS\srv.sys
07:34:11.0764 0x1200  srv - ok
07:34:11.0777 0x1200  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB, 4DF31206DF8F33C2975E23C7257ED930C4EDA8BC4E246D8FDA130BB583083ED0 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
07:34:11.0802 0x1200  srv2 - ok
07:34:11.0809 0x1200  [ BE6BD660CAA6F291AE06A718A4FA8ABC, CD38939CFBA80B882D38099194FC1EBAE15A9D27A4D941DD03C55EC745E52E59 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
07:34:11.0828 0x1200  srvnet - ok
07:34:11.0837 0x1200  [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
07:34:11.0877 0x1200  SSDPSRV - ok
07:34:11.0884 0x1200  [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
07:34:11.0920 0x1200  SstpSvc - ok
07:34:11.0924 0x1200  [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
07:34:11.0939 0x1200  stexstor - ok
07:34:11.0944 0x1200  [ EDB05BD63148796F23EA78506404A538, 8EBF623D3DEB6CCAC75AAFCF8B23271029A28BE29D459088E40FBF109E80AA17 ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
07:34:11.0960 0x1200  StillCam - ok
07:34:11.0978 0x1200  [ E1FB3706030FB4578A0D72C2FC3689E4, A62EC9AA4514CAF2A10C0A3AEF7A36F593A7E7DA370A3F130C24E1B612E19427 ] StiSvc          C:\Windows\System32\wiaservc.dll
07:34:12.0015 0x1200  StiSvc - ok
07:34:12.0019 0x1200  [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum          C:\Windows\system32\drivers\swenum.sys
07:34:12.0034 0x1200  swenum - ok
07:34:12.0048 0x1200  [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv           C:\Windows\System32\swprv.dll
07:34:12.0094 0x1200  swprv - ok
07:34:12.0106 0x1200  [ 2D89249B81F7F3BA9232BB60286BF008, 5DE12B28C4BF788E4AF177AFB96FE93E6F293FBB20414DDD41B84D9B48D4C60D ] SynoDrService   C:\Program Files\Synology\Data Replicator  3\SynoDrService.exe
07:34:12.0125 0x1200  SynoDrService - ok
07:34:12.0135 0x1200  [ 215A45246C6E2D0A9C263CE1786C8D8A, 619D3A836C6D6DCD9739F128E8B4863308A66FF474B31A2CBC4A94FBBEC47D0C ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys
07:34:12.0155 0x1200  SynTP - ok
07:34:12.0192 0x1200  [ 36650D618CA34C9D357DFD3D89B2C56F, 7C3774E53DCF32CB3A4B3504E32D2A651E18467FA0A6AC4C7993C696741B704B ] SysMain         C:\Windows\system32\sysmain.dll
07:34:12.0251 0x1200  SysMain - ok
07:34:12.0259 0x1200  [ 763FECDC3D30C815FE72DD57936C6CD1, 1A62C7E63E426D56894F4121C75D9C60FC9A14469ADBD0D6F0B94B8DE48CDA3E ] TabletInputService C:\Windows\System32\TabSvc.dll
07:34:12.0283 0x1200  TabletInputService - ok
07:34:12.0294 0x1200  [ 613BF4820361543956909043A265C6AC, FCFF02E466D2501630B452627FB218C01E5245A0921EE3D2117E7FD63AC7E98E ] TapiSrv         C:\Windows\System32\tapisrv.dll
07:34:12.0334 0x1200  TapiSrv - ok
07:34:12.0340 0x1200  [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS             C:\Windows\System32\tbssvc.dll
07:34:12.0377 0x1200  TBS - ok
07:34:12.0420 0x1200  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
07:34:12.0478 0x1200  Tcpip - ok
07:34:12.0520 0x1200  [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
07:34:12.0571 0x1200  TCPIP6 - ok
07:34:12.0578 0x1200  [ 3EEBD3BD93DA46A26E89893C7AB2FF3B, 2C7204DCD2BCBC6A250FF0F6477616F327AF41FDB7CABE69E5C357361009FB4E ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
07:34:12.0595 0x1200  tcpipreg - ok
07:34:12.0602 0x1200  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2, 879E2827354BB21573AC6A7CCEB746D44214540687E6882FFCB4089546FBD954 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
07:34:12.0619 0x1200  TDPIPE - ok
07:34:12.0624 0x1200  [ 2C2C5AFE7EE4F620D69C23C0617651A8, E828D974C3F9D7004A030C3AD448096C736FDB4C4C1707D043E567D08C845103 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
07:34:12.0640 0x1200  TDTCP - ok
07:34:12.0646 0x1200  [ 7FE680A3DFA421C4A8E4879AE4C5AAB0, A4C64E155AB2843823CD3586756BA7681CFDEA50812095468221503BBAD30DCD ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
07:34:12.0664 0x1200  tdx - ok
07:34:12.0670 0x1200  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20, 0D81B427720637882077C5024D738191F858FC734ED040697872D906351EF663 ] TermDD          C:\Windows\system32\drivers\termdd.sys
07:34:12.0686 0x1200  TermDD - ok
07:34:12.0704 0x1200  [ FCFD4F50419B4BC72E80066DA10D2E54, 7C2314A57A404525F0444986332DBAE0964A3359374671598387051D7AAE72AE ] TermService     C:\Windows\System32\termsrv.dll
07:34:12.0736 0x1200  TermService - ok
07:34:12.0741 0x1200  [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes          C:\Windows\system32\themeservice.dll
07:34:12.0763 0x1200  Themes - ok
07:34:12.0768 0x1200  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER     C:\Windows\system32\mmcss.dll
07:34:12.0803 0x1200  THREADORDER - ok
07:34:12.0810 0x1200  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks          C:\Windows\System32\trkwks.dll
07:34:12.0848 0x1200  TrkWks - ok
07:34:12.0857 0x1200  [ 2C49B175AEE1D4364B91B531417FE583, 6C7995E18F84E465C376D1D5F153C15ACB66CDEA86EE5BF186677F572E7E129B ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
07:34:12.0895 0x1200  TrustedInstaller - ok
07:34:12.0903 0x1200  [ 6C5139E4283249518F7743D7043775B3, 58684E8C90EBAC65459A97C905CDCFE3A915CFF7E8E96071DE1AC3489F85E67F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
07:34:12.0920 0x1200  tssecsrv - ok
07:34:12.0926 0x1200  [ C6A5FBD4977305E1FA23E02C042DB463, A6EB5E4B8051A258D40A385609E930318EAA3494C8466F48542B806FE6A7C47A ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
07:34:12.0943 0x1200  TsUsbFlt - ok
07:34:12.0951 0x1200  [ B2FA25D9B17A68BB93D58B0556E8C90D, 0146931B733CAB1CD87F94C35F97E110D6ED6C55EAFF03345400A29AEDE99BDE ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
07:34:12.0985 0x1200  tunnel - ok
07:34:12.0991 0x1200  [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
07:34:13.0007 0x1200  uagp35 - ok
07:34:13.0018 0x1200  [ EE43346C7E4B5E63E54F927BABBB32FF, BAD6FC3BEE45E644D5A6A0A31428F5B2AEC72A0AA0C74EF8177B1FE23EEF3AA9 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
07:34:13.0058 0x1200  udfs - ok
07:34:13.0074 0x1200  [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect       C:\Windows\system32\UI0Detect.exe
07:34:13.0095 0x1200  UI0Detect - ok
07:34:13.0101 0x1200  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
07:34:13.0118 0x1200  uliagpkx - ok
07:34:13.0128 0x1200  [ D295BED4B898F0FD999FCFA9B32B071B, D4130DB4AE76EE6DC0B8E7A4FEF5CB8B26EBD822C21021F6FA78FD29C1E211C2 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
07:34:13.0151 0x1200  umbus - ok
07:34:13.0160 0x1200  [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
07:34:13.0177 0x1200  UmPass - ok
07:34:13.0261 0x1200  [ 41118D920B2B268C0ADC36421248CDCF, 4F99C4913DCFE02B0783FD97F02558E4DD4D7C98553D95A8E26FAAA0C0D67616 ] UNS             C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
07:34:13.0357 0x1200  UNS - detected UnsignedFile.Multi.Generic ( 1 )
07:34:13.0357 0x1200  UNS ( UnsignedFile.Multi.Generic ) - warning
07:34:13.0375 0x1200  [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost        C:\Windows\System32\upnphost.dll
07:34:13.0433 0x1200  upnphost - ok
07:34:13.0440 0x1200  [ 0803FBA9FE829D61AE26EC0BCC910C46, 30D00E2C7DFC630C99C1599587D4F9C272BC30D444E07C961AA05BF84587806B ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
07:34:13.0459 0x1200  usbccgp - ok
07:34:13.0467 0x1200  [ 2352AB5F9F8F097BF9D41D5A4718A041, 25BC7828C625B9B2A5110C25B230C5828CEC18EC97ECF9EC4745E8930CBF472C ] usbcir          C:\Windows\system32\drivers\usbcir.sys
07:34:13.0486 0x1200  usbcir - ok
07:34:13.0499 0x1200  [ 635686E528F2C9CB916EC1BB04EE6AD1, 080A0F209773232860F510F17005EF92650BA831F69BB0006AEF11A2BB0A4906 ] UsbClientService C:\Program Files\Synology\Assistant\UsbClientService.exe
07:34:13.0516 0x1200  UsbClientService - ok
07:34:13.0522 0x1200  [ D40855F89B69305140BBD7E9A3BA2DA6, 745DC6D770666F6B19C2B6AA89C21D1A314732E291453BFA2367F9AF86F97C3C ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
07:34:13.0540 0x1200  usbehci - ok
07:34:13.0553 0x1200  [ EDF2DF71C4F1E13A6AC75F5224DE655A, 1764D155C6B99201774B57195349304259232A12868ECFC2069CA49443EBDC2C ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
07:34:13.0577 0x1200  usbhub - ok
07:34:13.0582 0x1200  [ 9828C8D14CC2676421778F0DE638CF97, 479A28211FFB85190A01FAB0283B927588805D2C0CDB03F85F8F814B88E4F453 ] usbohci         C:\Windows\system32\drivers\usbohci.sys
07:34:13.0598 0x1200  usbohci - ok
07:34:13.0602 0x1200  [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
07:34:13.0621 0x1200  usbprint - ok
07:34:13.0630 0x1200  [ F991AB9CC6B908DB552166768176896A, AD8E7A16B23B244B7F834622D4E38B5844193C6E31EF96F61E0E2EA16C945026 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
07:34:13.0648 0x1200  USBSTOR - ok
07:34:13.0653 0x1200  [ 800AABFD625EEFF899F7E5496BDE37AB, 3EB7ED07760CB348FCA9A06C2B838EF79B51A83C5F70A9C9EAAEAE54480067E2 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
07:34:13.0669 0x1200  usbuhci - ok
07:34:13.0677 0x1200  [ DE014425522610BEDCA3821BB8C0F1D5, D6FEA0DF07F89834AEEE8C02CC7FD41068D758B6CCECE2EEE5CF4B9DB646FA1E ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
07:34:13.0697 0x1200  usbvideo - ok
07:34:13.0702 0x1200  [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms           C:\Windows\System32\uxsms.dll
07:34:13.0770 0x1200  UxSms - ok
07:34:13.0781 0x1200  [ F65F365AC0D1657917EFDB52445C848B, 1BDCEFED2799B5507B28B4D72D13D2DD7A1102B21F3938E98BA65737985A4ED9 ] VaultSvc        C:\Windows\system32\lsass.exe
07:34:13.0806 0x1200  VaultSvc - ok
07:34:13.0813 0x1200  [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
07:34:13.0830 0x1200  vdrvroot - ok
07:34:13.0847 0x1200  [ C3CD30495687C2A2F66A65CA6FD89BE9, 582E4706C1D6A151020D14B26C7BF166F4E42BDD6E410F30EC452469270C5E9B ] vds             C:\Windows\System32\vds.exe
07:34:13.0895 0x1200  vds - ok
07:34:13.0901 0x1200  [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
07:34:13.0919 0x1200  vga - ok
07:34:13.0924 0x1200  [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave         C:\Windows\System32\drivers\vga.sys
07:34:13.0959 0x1200  VgaSave - ok
07:34:13.0968 0x1200  [ 5461686CCA2FDA57B024547733AB42E3, 2721D0659AA890172FCAD4EC4D926B58ACD0EE4887DA51545DC7237420D5BF84 ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
07:34:13.0987 0x1200  vhdmp - ok
07:34:13.0993 0x1200  [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
07:34:14.0008 0x1200  viaagp - ok
07:34:14.0015 0x1200  [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7           C:\Windows\system32\DRIVERS\viac7.sys
07:34:14.0033 0x1200  ViaC7 - ok
07:34:14.0038 0x1200  [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide          C:\Windows\system32\drivers\viaide.sys
07:34:14.0055 0x1200  viaide - ok
07:34:14.0061 0x1200  [ 4C63E00F2F4B5F86AB48A58CD990F212, 9796BD4B9CFEEEAF57C5E332A732EFC2770B21F9B35301A5D202F5FC52C1E035 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
07:34:14.0077 0x1200  volmgr - ok
07:34:14.0090 0x1200  [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
07:34:14.0115 0x1200  volmgrx - ok
07:34:14.0125 0x1200  [ F497F67932C6FA693D7DE2780631CFE7, DAE544ED99D2CF570DA31343BD87D2F856D0D13529656D38E1BF854C77F017F6 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
07:34:14.0148 0x1200  volsnap - ok
07:34:14.0157 0x1200  [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
07:34:14.0176 0x1200  vsmraid - ok
07:34:14.0211 0x1200  [ 209A3B1901B83AEB8527ED211CCE9E4C, 1A431F6409F8E0531F600F8F988ECECECB902DA26BBAAF1DE74A5CAC29A7CB44 ] VSS             C:\Windows\system32\vssvc.exe
07:34:14.0280 0x1200  VSS - ok
07:34:14.0285 0x1200  [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
07:34:14.0304 0x1200  vwifibus - ok
07:34:14.0309 0x1200  [ 7090D3436EEB4E7DA3373090A23448F7, 3A130B28F2BFA7DCEC8596C4CE4E187B019F5ECF1AAC8DD1BBDE9CBD2428FEC2 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
07:34:14.0330 0x1200  vwififlt - ok
07:34:14.0342 0x1200  [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time         C:\Windows\system32\w32time.dll
07:34:14.0389 0x1200  W32Time - ok
07:34:14.0396 0x1200  [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
07:34:14.0413 0x1200  WacomPen - ok
07:34:14.0419 0x1200  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
07:34:14.0453 0x1200  WANARP - ok
07:34:14.0457 0x1200  [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
07:34:14.0489 0x1200  Wanarpv6 - ok
07:34:14.0531 0x1200  [ 691E3285E53DCA558E1A84667F13E15A, 12EDB66EF8FC100402BEA221F354D3BD5542F6DDF715B6E7D873D6BAE7E3D329 ] wbengine        C:\Windows\system32\wbengine.exe
07:34:14.0593 0x1200  wbengine - ok
07:34:14.0604 0x1200  [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
07:34:14.0633 0x1200  WbioSrvc - ok
07:34:14.0649 0x1200  [ 34EEE0DFAADB4F691D6D5308A51315DC, A040A03E25A0C78B9E26F86C2DF95BCAF8E7EC90183CEB295615D3265350EBEE ] wcncsvc         C:\Windows\System32\wcncsvc.dll
07:34:14.0683 0x1200  wcncsvc - ok
07:34:14.0707 0x1200  [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
07:34:14.0731 0x1200  WcsPlugInService - ok
07:34:14.0741 0x1200  [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
07:34:14.0757 0x1200  Wd - ok
07:34:14.0809 0x1200  [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
07:34:14.0848 0x1200  Wdf01000 - ok
07:34:14.0859 0x1200  [ DDE994E9159497D0D5AB2CDF66D1EAD6, 49BEDECA469C47E7622542D3B9BCD31ECDDAA27838495EC5C2F1338E33FEA877 ] WdiServiceHost  C:\Windows\system32\wdi.dll
07:34:14.0939 0x1200  WdiServiceHost - ok
07:34:14.0945 0x1200  [ DDE994E9159497D0D5AB2CDF66D1EAD6, 49BEDECA469C47E7622542D3B9BCD31ECDDAA27838495EC5C2F1338E33FEA877 ] WdiSystemHost   C:\Windows\system32\wdi.dll
07:34:14.0965 0x1200  WdiSystemHost - ok
07:34:14.0977 0x1200  [ 75E8EBD7040CE238684333F97014762A, 2CA0B267FBAEB303D1F8B639D733DC0DE17BA1276CC9096035B4F2BBBED3EF7F ] WebClient       C:\Windows\System32\webclnt.dll
07:34:15.0004 0x1200  WebClient - ok
07:34:15.0013 0x1200  [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc          C:\Windows\system32\wecsvc.dll
07:34:15.0053 0x1200  Wecsvc - ok
07:34:15.0063 0x1200  [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
07:34:15.0101 0x1200  wercplsupport - ok
07:34:15.0107 0x1200  [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc          C:\Windows\System32\WerSvc.dll
07:34:15.0145 0x1200  WerSvc - ok
07:34:15.0150 0x1200  [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
07:34:15.0184 0x1200  WfpLwf - ok
07:34:15.0189 0x1200  [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
07:34:15.0204 0x1200  WIMMount - ok
07:34:15.0228 0x1200  [ 082CF481F659FAE0DE51AD060881EB47, BB67D2AF0BB9192D4CCF66C23D80CE5A1B38715556D94E2561DBF8F805FA30A5 ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
07:34:15.0266 0x1200  WinDefend - ok
07:34:15.0273 0x1200  WinHttpAutoProxySvc - ok
07:34:15.0287 0x1200  [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
07:34:15.0325 0x1200  Winmgmt - ok
07:34:15.0363 0x1200  [ 1DE9BD23AFA36150586C732D876D9B74, 32CF2C8EC18CFDA677AB72A182EB4B839DCC72BFCD6CA309BE2F434991CAE973 ] WinRM           C:\Windows\system32\WsmSvc.dll
07:34:15.0420 0x1200  WinRM - ok
07:34:15.0453 0x1200  [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc         C:\Windows\System32\wlansvc.dll
07:34:15.0503 0x1200  Wlansvc - ok
07:34:15.0507 0x1200  [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
07:34:15.0524 0x1200  WmiAcpi - ok
07:34:15.0537 0x1200  [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
07:34:15.0559 0x1200  wmiApSrv - ok
07:34:15.0597 0x1200  [ 3B40D3A61AA8C21B88AE57C58AB3122E, 6C67DCB007C3CDF2EB0BBF5FD89C32CD7800C20F7166872F8C387BE262C5CD21 ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
07:34:15.0651 0x1200  WMPNetworkSvc - ok
07:34:15.0656 0x1200  [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
07:34:15.0674 0x1200  WPCSvc - ok
07:34:15.0681 0x1200  [ AA53356D60AF47EACC85BC617A4F3F66, 155CB8112AA382D841C1891750FF29EF4F1BF716CD9CDF0F2243209E2CCCAC98 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
07:34:15.0704 0x1200  WPDBusEnum - ok
07:34:15.0708 0x1200  [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
07:34:15.0742 0x1200  ws2ifsl - ok
07:34:15.0748 0x1200  [ 6F5D49EFE0E7164E03AE773A3FE25340, 15B6AFF7455538189A96F8863CC995A271E02C6FBDAC15B037D44DDA65E61339 ] wscsvc          C:\Windows\system32\wscsvc.dll
07:34:15.0772 0x1200  wscsvc - ok
07:34:15.0777 0x1200  [ 553F6CCD7C58EB98D4A8FBDAF283D7A9, 71FBE50C470D1F54FDAADCECEC2CB021AE240CD59DE4E8EB5BCAA6E7F2F86560 ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
07:34:15.0796 0x1200  WSDPrintDevice - ok
07:34:15.0801 0x1200  WSearch - ok
07:34:15.0865 0x1200  [ D9B0134913E5EF007AF82A418C503322, 7418DD28C8E968674382F8352AAFFC4DE77887E2B71B8844D615F19432B4C55A ] wuauserv        C:\Windows\system32\wuaueng.dll
07:34:15.0949 0x1200  wuauserv - ok
07:34:15.0956 0x1200  [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
07:34:15.0979 0x1200  WudfPf - ok
07:34:15.0989 0x1200  [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
07:34:16.0009 0x1200  WUDFRd - ok
07:34:16.0017 0x1200  [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
07:34:16.0036 0x1200  wudfsvc - ok
07:34:16.0045 0x1200  [ 7CC38741B8F68F1E0D5D79DA6123666A, F90D2DA1C9AFB506C381CD386E1430931B5F81813FEDFD720F87FBC54E7A00DA ] WwanSvc         C:\Windows\System32\wwansvc.dll
07:34:16.0075 0x1200  WwanSvc - ok
07:34:16.0086 0x1200  ================ Scan global ===============================
07:34:16.0091 0x1200  [ DAB748AE0439955ED2FA22357533DDDB, 73EDD402C7479DDCE1998D0C7E99E1EC2974F64EFC33A851439CC85D09EDCDF9 ] C:\Windows\system32\basesrv.dll
07:34:16.0101 0x1200  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
07:34:16.0116 0x1200  [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
07:34:16.0127 0x1200  [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
07:34:16.0141 0x1200  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6, D7BC4ED605B32274B45328FD9914FB0E7B90D869A38F0E6F94FB1BF4E9E2B407 ] C:\Windows\system32\services.exe
07:34:16.0151 0x1200  [ Global ] - ok
07:34:16.0152 0x1200  ================ Scan MBR ==================================
07:34:16.0154 0x1200  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
07:34:16.0350 0x1200  \Device\Harddisk0\DR0 - ok
07:34:16.0351 0x1200  ================ Scan VBR ==================================
07:34:16.0355 0x1200  [ 520243A1D5561CFDD1924317EC822DE4 ] \Device\Harddisk0\DR0\Partition1
07:34:16.0358 0x1200  \Device\Harddisk0\DR0\Partition1 - ok
07:34:16.0359 0x1200  ================ Scan generic autorun ======================
07:34:16.0372 0x1200  [ 157B5DF2CBCE17A0CEECB0FF4297700E, D212EC0108D92FF3A84CF6DCA81F11DF028F1C5217FCA4CD47EE1A170FCAC10D ] C:\Windows\system32\igfxtray.exe
07:34:16.0395 0x1200  IgfxTray - ok
07:34:16.0406 0x1200  [ 9A30BDDE96721FE6D6B2BA0593F69C81, 840F07D9A50C623CCD7BF278B9ABDDBCE69881DD6A3F6A99861A553F98DDE421 ] C:\Windows\system32\hkcmd.exe
07:34:16.0423 0x1200  HotKeysCmds - ok
07:34:16.0431 0x1200  [ FEC63BCD1A1DDE7A990223D0F12655D7, FFBE21587263DA615D06BBFDCC5A2AACA99528266BAB15C9AE37B57EC5B4D113 ] C:\Windows\system32\igfxpers.exe
07:34:16.0448 0x1200  Persistence - ok
07:34:16.0696 0x1200  [ A46F03AEF08E7E46D814483207D8C281, 79828B9EFF594FC6A92CD1E2F6004E22FED629FAF4FAA7118BE9EB3C24385771 ] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
07:34:16.0928 0x1200  RtHDVCpl - ok
07:34:16.0976 0x1200  [ 3EE8375B1063CF4A0C4353123F4129C5, 670CD1757ACBC269264EB3FA05EF589A3F33CD988696086C568F3798B6B8F18B ] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
07:34:17.0029 0x1200  SynTPEnh - ok
07:34:17.0029 0x1200  ============================================================
07:34:17.0029 0x1200  Scan finished
07:34:17.0029 0x1200  ============================================================
07:34:17.0040 0x1204  Detected object count: 4
07:34:17.0040 0x1204  Actual detected object count: 4
07:34:21.0383 0x1204  LMS ( UnsignedFile.Multi.Generic ) - skipped by user
07:34:21.0383 0x1204  LMS ( UnsignedFile.Multi.Generic ) - User select action: Skip 
07:34:21.0386 0x1204  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
07:34:21.0386 0x1204  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
07:34:21.0387 0x1204  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
07:34:21.0387 0x1204  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
07:34:21.0389 0x1204  UNS ( UnsignedFile.Multi.Generic ) - skipped by user
07:34:21.0389 0x1204  UNS ( UnsignedFile.Multi.Generic ) - User select action: Skip

Antwort
Seite 1 von 2 1 2

Themen zu Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten
bonjour, browser, desktop, ebanking, failed, fehler, flash player, google, helper, homepage, hängen, internet, kaspersky, mozilla, problem, prozess, registry, security, server, software, starten, svchost.exe, synology, system, tracker, trojaner, windows, wiso


« stamplive, pc doctor, redirect1, bestbuy... popups nach Chrome Download | Link angeklickt DHL »


Ähnliche Themen: Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten


  1. Bekomme massen E-Mail "This message was created automatically by mail delivery software."
    Plagegeister aller Art und deren Bekämpfung - 31.08.2015 (2)
  2. Mail Delivery System <mailer-daemon@kundenserver.de> mailrücklauf auf nicht gesendete mail
    Überwachung, Datenschutz und Spam - 26.03.2015 (4)
  3. mailer-daemon@gmx.de; Mail delivery failed: returning message to sender
    Plagegeister aller Art und deren Bekämpfung - 06.02.2015 (1)
  4. Ständige Spam Mails im Minutentakt "Mail Delivery System"
    Überwachung, Datenschutz und Spam - 16.02.2014 (17)
  5. "Mail Delivery System" - Spam-Emails
    Überwachung, Datenschutz und Spam - 17.01.2014 (3)
  6. Viele "Mail delivery failed: returning message to sender" und komische Emails im Postfach!
    Plagegeister aller Art und deren Bekämpfung - 27.10.2013 (3)
  7. Windows 7; Brief Telekom: Sicherheitswarnung Internetzugang; 3 Trojaner ; mehrer Emails "Mail Delivery System" auch nach Passwordänderung
    Plagegeister aller Art und deren Bekämpfung - 04.09.2013 (28)
  8. Dauerhafte "Mail Delivery System"-Mails
    Überwachung, Datenschutz und Spam - 03.04.2013 (33)
  9. Trojaner nach E-Mail von T-Mobile (Betreff: "MMS-Nachricht")
    Log-Analyse und Auswertung - 04.02.2013 (12)
  10. E-Mail "Mail Delivery System" hundertfach im Posteingang
    Plagegeister aller Art und deren Bekämpfung - 15.01.2013 (13)
  11. "MAILER-DAEMON@server190-han.de-nserver.de" Fehlermeldungen! Warum?
    Plagegeister aller Art und deren Bekämpfung - 08.01.2013 (0)
  12. Mailer-Daemon - erhalte für EINGEGANGENE Mails Mailer-Daemon-Nachrichten
    Plagegeister aller Art und deren Bekämpfung - 09.12.2012 (3)
  13. viele MAILER-DAEMON@mail.gmx.net emails im postfach bei thunderbird
    Plagegeister aller Art und deren Bekämpfung - 04.01.2011 (8)
  14. Mail Delivery Subsystem <MAILER-DAEMON@mail19.bybn.de>
    Plagegeister aller Art und deren Bekämpfung - 06.12.2010 (5)
  15. Plötzlich hunderte MAILER-DAEMON@mail.gmx.net emails
    Plagegeister aller Art und deren Bekämpfung - 19.10.2010 (1)
  16. Heute schon über 30 "Mail Delivery System "Mail Delivery System" Mail bekommen
    Log-Analyse und Auswertung - 26.05.2008 (4)
  17. Email mit Betreff: "=?ISO-8859-1?Q??=" erhalten!!
    Plagegeister aller Art und deren Bekämpfung - 01.07.2005 (8)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten - Guten Morgen, ich erhalte seit Sonntag unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>. XXX steht hier für einen Server meines Providers, wo ich webspace und Email-Adressen miete. Ich - Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten...
Archiv
Du betrachtest: Unzählige Emails mit dem Betreff "Mail Delivery System <MAILER-DAEMON@XXX.info>" erhalten auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19