| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Browser extrem langsamWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
19.05.2015, 21:26
| #1 |
 |  Browser extrem langsam Hallo, am PC meiner Eltern sind seit kurzem sämtliche Browser sehr sehr langsam und alles was man macht, ist zudem etwas verzögert, bspw. wenn man einen Link anklickt, beginnt er erst 2 Sekunden später sich zu öffnen, das öffnen und Laden der Seite ist wirklich sehr langsam. HiJackThis brachte kein Ergebnis zutage, ebenso ein Virenscan mit Avast. Neustarten und CCleaner haben ebenfalls nichts gebracht. Im Folgepost werde ich defogger, FRST und GMER-Logs posten. defogger_disable Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:56 on 19/05/2015 (Worthmann)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-05-2015
Ran by Worthmann (administrator) on WORTHMANN-PC on 19-05-2015 21:58:44
Running from C:\Users\Worthmann\Desktop
Loaded Profiles: Worthmann (Available profiles: Worthmann)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Creative Technology Ltd) C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\Setup\instup.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM\...\Run: [diagent] => C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe [135264 2002-04-03] (Creative Technology Ltd)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-03-30] (Avast Software s.r.o.)
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6278424 2015-04-23] (Piriform Ltd)
Startup: C:\Users\Worthmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2013-06-28]
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-03-30] (Avast Software s.r.o.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-03-30] (Avast Software s.r.o.)
Tcpip\Parameters: [DhcpNameServer] 83.169.185.161 83.169.185.225
FireFox:
========
FF ProfilePath: C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default
FF DefaultSearchEngine: Google (avast)
FF DefaultSearchUrl: https://www.google.com/search/?trackid=sp-006
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: Google (avast)
FF Homepage: https://www.google.com/?trackid=sp-006
FF Keyword.URL: https://www.google.com/search/?trackid=sp-006
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-17] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\searchplugins\ask-web-search.xml [2015-03-27]
FF SearchPlugin: C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\searchplugins\google-avast.xml [2015-04-03]
FF Extension: Adblock Plus - C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-10]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-20]
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-08]
CHR Extension: (Google Drive) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-08]
CHR Extension: (YouTube) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-08]
CHR Extension: (Google Search) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-08]
CHR Extension: (Bookmark Manager) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (Avast Online Security) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-21]
CHR Extension: (Google Wallet) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-08]
CHR Extension: (Gmail) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-08]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-30]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-30] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3205216 2015-03-30] (Avast Software)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-03-30] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [73440 2015-03-30] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-03-30] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-03-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788272 2015-03-30] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427736 2015-03-30] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-03-30] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208024 2015-03-30] ()
R3 P16X; C:\Windows\System32\drivers\P16X.sys [1330048 2003-09-22] (Creative Technology Ltd.)
R2 PfModNT; C:\Windows\system32\drivers\PfModNT.sys [15840 2003-03-05] (Creative Technology Ltd.) [File not signed]
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220240 2015-03-30] (Avast Software)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-19 21:58 - 2015-05-19 21:59 - 00009046 _____ () C:\Users\Worthmann\Desktop\FRST.txt
2015-05-19 21:58 - 2015-05-19 21:58 - 00000000 ____D () C:\FRST
2015-05-19 21:57 - 2015-05-19 21:57 - 01146880 _____ (Farbar) C:\Users\Worthmann\Desktop\FRST.exe
2015-05-19 21:56 - 2015-05-19 21:57 - 00000480 _____ () C:\Users\Worthmann\Desktop\defogger_disable.log
2015-05-19 21:56 - 2015-05-19 21:56 - 00000000 _____ () C:\Users\Worthmann\defogger_reenable
2015-05-19 21:55 - 2015-05-19 21:55 - 00050477 _____ () C:\Users\Worthmann\Desktop\Defogger.exe
2015-05-19 21:40 - 2015-05-19 21:41 - 01203488 _____ () C:\Users\Worthmann\Downloads\HijackThis - CHIP-Installer.exe
2015-05-19 21:03 - 2015-05-19 21:03 - 00000056 _____ () C:\Windows\setupact.log
2015-05-19 21:03 - 2015-05-19 21:03 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-19 15:53 - 2015-05-19 15:53 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-05-18 15:19 - 2015-05-18 15:19 - 01203488 _____ () C:\Users\Worthmann\Downloads\JPEG to PDF - CHIP-Installer.exe
2015-05-18 15:17 - 2015-05-18 15:23 - 00000000 ____D () C:\Program Files\FreePDF_XP
2015-05-18 15:17 - 2015-05-18 15:22 - 00000000 ____D () C:\ProgramData\FreePDF
2015-05-18 15:16 - 2015-05-18 15:16 - 12666892 _____ () C:\Users\Worthmann\Downloads\gs907w32.exe
2015-05-18 15:16 - 2015-05-18 15:16 - 00000000 ____D () C:\Program Files\gs
2015-05-18 15:14 - 2015-05-18 15:14 - 02561536 _____ (Microsoft Corporation) C:\Users\Worthmann\Downloads\freepdf4.14.exe
2015-05-18 15:04 - 2015-05-18 15:04 - 00014900 _____ () C:\Users\Worthmann\Desktop\bewerbung pannekoekschip.odt
2015-05-18 15:02 - 2015-05-18 15:05 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\PDF Architect 3
2015-05-18 14:57 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files\PDFCreator
2015-05-18 14:57 - 2015-05-18 15:14 - 00000000 ____D () C:\ProgramData\PDF Architect 3
2015-05-18 14:52 - 2015-05-18 14:52 - 00000000 ____D () C:\Program Files\Microsoft.NET
2015-05-18 14:48 - 2015-05-18 14:48 - 27837984 _____ (pdfforge ) C:\Users\Worthmann\Downloads\PDFCreator-2_1_1-setup.exe
2015-05-18 14:44 - 2015-05-18 14:44 - 00014743 _____ () C:\Users\Worthmann\Desktop\Lebenslauf.odt
2015-05-17 21:00 - 2015-05-17 21:39 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-05-17 20:46 - 2015-05-17 20:47 - 00000000 ____D () C:\Users\Worthmann\Documents\Ableton
2015-05-17 20:35 - 2015-05-17 20:51 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\Ableton
2015-05-17 20:35 - 2015-05-17 20:35 - 00000000 ____D () C:\Program Files\Common Files\Propellerhead Software
2015-05-17 20:32 - 2015-05-17 21:39 - 00000000 ____D () C:\ProgramData\Ableton
2015-05-14 00:50 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 10:52 - 2015-05-13 10:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-05-13 10:52 - 2015-05-13 10:52 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-13 10:51 - 2015-05-13 10:51 - 06484352 _____ (Piriform Ltd) C:\Users\Worthmann\Downloads\ccsetup505.exe
2015-05-13 09:56 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 09:56 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 09:56 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 09:56 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 09:56 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 09:56 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 09:56 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 09:56 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 09:56 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 09:56 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 09:56 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 09:56 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 09:56 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 09:56 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 09:56 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 09:56 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 09:56 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 09:56 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 09:56 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 09:56 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 09:56 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 09:56 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 09:56 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 09:56 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 09:56 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 09:56 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 09:56 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 09:56 - 2015-04-04 05:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 09:56 - 2015-04-04 05:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 09:56 - 2015-04-04 05:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 09:56 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 09:56 - 2015-04-04 05:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 09:56 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 09:56 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 09:56 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 09:55 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 09:55 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 09:55 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 09:55 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 09:55 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 09:55 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 09:55 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 09:55 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 09:55 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 09:55 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 09:55 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 09:55 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 09:55 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 09:55 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-10 21:13 - 2015-05-12 18:51 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\vlc
2015-05-10 21:12 - 2015-05-10 21:12 - 00000988 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-05-10 21:12 - 2015-05-10 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-05-10 21:11 - 2015-05-10 21:11 - 00000000 ____D () C:\Program Files\VideoLAN
2015-05-10 21:09 - 2015-05-10 21:10 - 28849904 _____ () C:\Users\Worthmann\Downloads\vlc-2.2.1-win32.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-19 21:56 - 2013-06-20 13:11 - 00000000 ____D () C:\Users\Worthmann
2015-05-19 21:55 - 2014-08-08 23:22 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-19 21:50 - 2014-04-13 13:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-19 21:15 - 2009-07-14 06:34 - 00022544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-19 21:15 - 2009-07-14 06:34 - 00022544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-19 21:11 - 2013-06-20 12:54 - 01540115 _____ () C:\Windows\WindowsUpdate.log
2015-05-19 21:08 - 2010-11-20 23:01 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-19 21:04 - 2014-08-08 23:22 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-19 21:03 - 2013-06-20 14:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-05-19 21:03 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-19 20:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-19 20:06 - 2013-06-20 13:11 - 00000000 ____D () C:\Users\Worthmann\AppData\Local\VirtualStore
2015-05-18 14:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-15 18:51 - 2014-08-08 23:23 - 00002081 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-14 14:04 - 2011-04-12 03:39 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 12:04 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-05-14 11:14 - 2009-07-14 06:33 - 00292320 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 00:50 - 2013-08-12 00:49 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-14 00:45 - 2013-06-20 14:28 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 10:53 - 2013-06-20 13:50 - 00000000 ____D () C:\Windows\Panther
2015-04-20 17:01 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-14 11:57
==================== End Of Log ============================
--- --- --- Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-05-2015
Ran by Worthmann at 2015-05-19 21:59:42
Running from C:\Users\Worthmann\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1696922312-3565181748-3259631844-500 - Administrator - Disabled)
Gast (S-1-5-21-1696922312-3565181748-3259631844-501 - Limited - Disabled)
Worthmann (S-1-5-21-1696922312-3565181748-3259631844-1000 - Administrator - Enabled) => C:\Users\Worthmann
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Avast Free Antivirus (HKLM\...\avast) (Version: 10.2.2215 - AVAST Software)
Brother MFL-Pro Suite DCP-135C (HKLM\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.0.2.0 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.152 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.27.5 - Google Inc.) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 de) (HKLM\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
OpenOffice.org 3.4.1 (HKLM\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Sound Blaster Live! (HKLM\...\{96E16100-A77F-4B31-B9AD-FFBA040EE1BD}) (Version: - )
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
23-02-2015 19:42:32 Windows Update
27-02-2015 17:15:04 Windows Update
03-03-2015 20:17:20 Windows Update
11-03-2015 01:00:02 Geplanter Prüfpunkt
14-03-2015 17:38:12 Windows Update
14-03-2015 22:04:05 Windows Update
20-03-2015 11:49:56 Windows Update
24-03-2015 12:29:48 Windows Update
30-03-2015 22:50:36 avast! antivirus system restore point
01-04-2015 13:59:10 Windows Update
09-04-2015 14:44:43 Windows Update
14-04-2015 08:48:48 Windows Update
17-04-2015 10:21:40 Windows Update
17-04-2015 22:53:57 Windows Update
20-04-2015 23:17:16 Windows Update
26-04-2015 10:10:52 Windows Update
03-05-2015 10:38:40 Windows Update
08-05-2015 09:29:34 Windows Update
12-05-2015 13:47:00 Windows Update
14-05-2015 00:41:41 Windows Update
14-05-2015 14:04:08 Windows Update
17-05-2015 20:28:10 Installed Ableton Live 9 Trial
17-05-2015 20:53:56 Removed Ableton Live 9 Trial
17-05-2015 21:01:09 Removed Ableton Live 9 Trial
17-05-2015 21:25:39 Removed Ableton Live 9 Trial
18-05-2015 14:50:50 Windows Update
18-05-2015 14:58:15 Installed PDF Architect 3 View Module
18-05-2015 14:59:57 Installed PDF Architect 3 Edit Module
18-05-2015 15:01:27 Installed PDF Architect 3 Create Module
19-05-2015 20:07:02 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1516F265-DB80-4777-AF45-C1B21A85A427} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-23] (Piriform Ltd)
Task: {3C395254-EC6D-4A58-86CA-896D2A188ED1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-17] (Adobe Systems Incorporated)
Task: {6A5EB856-281A-4BEB-8CFD-15511F37DC22} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-08-08] (Google Inc.)
Task: {6E274928-3480-4F16-B7F5-6C84E78E4A45} - System32\Tasks\{4785F2B7-BE70-47D9-8FD1-F170D1936C73} => pcalua.exe -a C:\dell\drivers\R58182\Setup.exe -d C:\dell\drivers\R58182
Task: {88DA59FF-8132-4076-A8A1-21FF40C3286B} - System32\Tasks\{0CC9C4FC-9B09-45E4-B62A-DCA15B832F83} => pcalua.exe -a C:\dell\drivers\R69382\SBLA05W.exe -d C:\dell\drivers\R69382
Task: {A4161DA2-4C07-4163-AFD1-E28FC76BC3F9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-08-08] (Google Inc.)
Task: {B5492201-2694-4906-9AAB-1AE4C28ADD54} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-03-30] (Avast Software s.r.o.)
Task: {DCFF03E6-6F87-4740-9B72-05DE11FEF76E} - System32\Tasks\{09CE7091-9E9B-4765-BFC1-5378174B2F21} => pcalua.exe -a C:\Users\Worthmann\Downloads\setup.exe -d C:\Users\Worthmann\Downloads
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2015-03-30 22:51 - 2015-03-30 22:51 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-03-30 22:51 - 2015-03-30 22:51 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-05-19 12:49 - 2015-05-19 12:49 - 02929664 _____ () C:\Program Files\AVAST Software\Avast\defs\15051900\algo.dll
2015-05-19 21:04 - 2015-05-19 21:04 - 02929664 _____ () C:\Program Files\AVAST Software\Avast\defs\15051901\algo.dll
2015-03-30 22:51 - 2015-03-30 22:51 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-11-04 15:13 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files\Brother\BrUtilities\BrLogAPI.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2015-04-08 21:53 - 2015-04-08 21:53 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Worthmann\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 83.169.185.161 - 83.169.185.225
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{10BF469D-BD49-4581-9686-2D6812E67E76}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{FDBA33A1-6CA5-42A2-BB7F-E800FD33E921}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{2213EA8F-B804-434B-B814-C6EA12491DB1}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{D45F38F5-0427-4C64-9E05-286226E45D79}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{A34E05D0-E802-4E10-81C7-DD7BAE7EEC41}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{2222746F-2EF0-410C-9A9C-97658BD5428E}] => (Allow) C:\Program Files\AVAST Software\Avast\ng\vbox\aswFe.exe
FirewallRules: [{5DA2421D-0822-4960-B5A3-C59DCE88FCE9}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/19/2015 09:04:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/19/2015 00:49:00 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/18/2015 03:13:03 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Worthmann-PC)
Description: Die Anwendung oder der Dienst "PDF Architect 3 Creator" konnte nicht neu gestartet werden.
Error: (05/18/2015 00:52:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/18/2015 11:05:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/17/2015 09:21:12 PM) (Source: MsiInstaller) (EventID: 11730) (User: Worthmann-PC)
Description: Product: Ableton Live 9 Trial -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.
Error: (05/17/2015 09:00:58 PM) (Source: MsiInstaller) (EventID: 11730) (User: Worthmann-PC)
Description: Product: Ableton Live 9 Trial -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.
Error: (05/17/2015 03:20:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/15/2015 06:27:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/14/2015 11:15:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (05/19/2015 09:04:05 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005
Error: (05/19/2015 00:55:50 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom1 ist für den Zugriff noch nicht bereit.
Error: (05/19/2015 00:55:50 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
Error: (05/19/2015 00:55:50 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom1 ist für den Zugriff noch nicht bereit.
Error: (05/19/2015 00:55:50 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom1 ist für den Zugriff noch nicht bereit.
Error: (05/19/2015 00:55:50 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom1 ist für den Zugriff noch nicht bereit.
Error: (05/19/2015 00:55:50 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom1 ist für den Zugriff noch nicht bereit.
Error: (05/19/2015 00:55:50 PM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom1 ist für den Zugriff noch nicht bereit.
Error: (05/18/2015 11:11:59 AM) (Source: cdrom) (EventID: 15) (User: )
Description: Das Gerät \Device\CdRom1 ist für den Zugriff noch nicht bereit.
Error: (05/18/2015 11:11:59 AM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
Microsoft Office Sessions:
=========================
Error: (05/19/2015 09:04:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/19/2015 00:49:00 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/18/2015 03:13:03 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Worthmann-PC)
Description: 0creator-ws.exePDF Architect 3 Creator03026217828480
Error: (05/18/2015 00:52:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/18/2015 11:05:05 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/17/2015 09:21:12 PM) (Source: MsiInstaller) (EventID: 11730) (User: Worthmann-PC)
Description: Product: Ableton Live 9 Trial -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.(NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/17/2015 09:00:58 PM) (Source: MsiInstaller) (EventID: 11730) (User: Worthmann-PC)
Description: Product: Ableton Live 9 Trial -- Error 1730. You must be an Administrator to remove this application. To remove this application, you can log on as an Administrator, or contact your technical support group for assistance.(NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/17/2015 03:20:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/15/2015 06:27:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/14/2015 11:15:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz
Percentage of memory in use: 75%
Total physical RAM: 1023.07 MB
Available physical RAM: 249.84 MB
Total Pagefile: 2047.07 MB
Available Pagefile: 1113.36 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.9 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:119.14 GB) (Free:65.97 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: A199686C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-19 22:13:40
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 SanDisk_SDSSDP128G rev.2.0.0 119,24GB
Running: Gmer-19357.exe; Driver: C:\Users\WORTHM~1\AppData\Local\Temp\fglciuoc.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0x87F4BACC]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwAllocateVirtualMemory [0x87B2B464]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0x87F4C5AA]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0x87F586A0]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0x87F586EC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0x87F58886]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0x87F5860E]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateSection [0x87B2B83E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0x87F58656]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThread [0x87B2BACE]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThreadEx [0x87B2BBB8]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0x87F58840]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0x87F4D398]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0x87F4BB32]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwDuplicateObject [0x87B2BCBC]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwFreeVirtualMemory [0x87B2B53C]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwLoadDriver [0x87B288D6]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwMapViewOfSection [0x87B2B91E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0x87F4BB98]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0x87F50FE0]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0x87F4DEDC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0x87F586CA]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0x87F5870E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0x87F588AA]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0x87F58634]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0x87F504E2]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0x87F587BE]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0x87F5867E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0x87F508CE]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0x87F58864]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0x87B2B6BC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0x87F4DCF4]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThreadEx [0x87F4DA02]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0x87F4BBFE]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0x87F4BC64]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwSetContextThread [0x87B2BA1A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0x87F4B7B8]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0x87F4B98A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0x87F4B918]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0x87F4D562]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0x87F4D6C4]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0x87F4BA12]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwTerminateProcess [0x87B2B78A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0x87F4D1F2]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwUnloadDriver [0x87B28906]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0x87F4BCCA]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwWriteVirtualMemory [0x87B2B5EE]
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!ZwRequestWaitReplyPort + 14B9 8284DA15 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 8286DC62 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 1393 828750D8 4 Bytes [CC, BA, F4, 87]
.text ntoskrnl.exe!KeRemoveQueueEx + 13BB 82875100 4 Bytes [64, B4, B2, 87]
.text ntoskrnl.exe!KeRemoveQueueEx + 141B 82875160 4 Bytes [AA, C5, F4, 87]
.text ntoskrnl.exe!KeRemoveQueueEx + 146F 828751B4 8 Bytes [A0, 86, F5, 87, EC, 86, F5, ...]
.text ntoskrnl.exe!KeRemoveQueueEx + 147B 828751C0 4 Bytes [86, 88, F5, 87]
.text ...
---- User code sections - GMER 2.1 ----
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!SetScrollRange 75A88EC5 5 Bytes JMP 010589D5 C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!GetScrollInfo 75A92DA3 5 Bytes JMP 01058968 C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!SetScrollInfo 75A948DA 5 Bytes JMP 01058A0C C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!GetScrollRange 75AB045A 5 Bytes JMP 0105890B C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!SetScrollPos 75AB04BE 5 Bytes JMP 010588E6 C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!GetScrollPos 75AB0E43 5 Bytes JMP 01058943 C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!EnableScrollBar 75AB19CE 5 Bytes JMP 01058A40 C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\CCleaner\CCleaner.exe[344] USER32.dll!ShowScrollBar 75AB3C89 5 Bytes JMP 0105899B C:\Program Files\CCleaner\CCleaner.exe
.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1264] kernel32.dll!SetUnhandledExceptionFilter 756FF5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[1512] kernel32.dll!SetUnhandledExceptionFilter 756FF5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
---- Threads - GMER 2.1 ----
Thread System [4:3688] 93B342F4
Thread System [4:3692] 93B342F4
Thread System [4:3696] 93B342F4
Thread System [4:3700] 93B342F4
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BITS@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\BITS
---- EOF - GMER 2.1 ----
|
|
20.05.2015, 05:16
| #2 |
| /// the machine /// TB-Ausbilder    | Browser extrem langsam Hi,
__________________Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ |
|
20.05.2015, 13:14
| #3 |
| | Browser extrem langsam MBAR
__________________Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org
Database version:
main: v2015.05.20.02
rootkit: v2015.05.16.01
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.17801
Worthmann :: WORTHMANN-PC [administrator]
20.05.2015 13:55:08
mbar-log-2015-05-20 (13-55-08).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 298199
Time elapsed: 12 minute(s), 4 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter 14:09:19.0281 0x051c TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
14:09:23.0286 0x051c ============================================================
14:09:23.0286 0x051c Current date / time: 2015/05/20 14:09:23.0286
14:09:23.0286 0x051c SystemInfo:
14:09:23.0286 0x051c
14:09:23.0286 0x051c OS Version: 6.1.7601 ServicePack: 1.0
14:09:23.0286 0x051c Product type: Workstation
14:09:23.0286 0x051c ComputerName: WORTHMANN-PC
14:09:23.0287 0x051c UserName: Worthmann
14:09:23.0287 0x051c Windows directory: C:\Windows
14:09:23.0287 0x051c System windows directory: C:\Windows
14:09:23.0287 0x051c Processor architecture: Intel x86
14:09:23.0287 0x051c Number of processors: 1
14:09:23.0287 0x051c Page size: 0x1000
14:09:23.0287 0x051c Boot type: Normal boot
14:09:23.0287 0x051c ============================================================
14:09:23.0623 0x051c KLMD registered as C:\Windows\system32\drivers\72902973.sys
14:09:23.0834 0x051c System UUID: {FF04B4CB-8233-83BC-7BA7-E6CFB4E440E7}
14:09:24.0705 0x051c Drive \Device\Harddisk0\DR0 - Size: 0x1DCF856000 ( 119.24 Gb ), SectorSize: 0x200, Cylinders: 0x3CCE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
14:09:24.0809 0x051c ============================================================
14:09:24.0809 0x051c \Device\Harddisk0\DR0:
14:09:24.0809 0x051c MBR partitions:
14:09:24.0809 0x051c \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
14:09:24.0809 0x051c \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xEE49000
14:09:24.0809 0x051c ============================================================
14:09:24.0812 0x051c C: <-> \Device\Harddisk0\DR0\Partition2
14:09:24.0813 0x051c ============================================================
14:09:24.0813 0x051c Initialize success
14:09:24.0813 0x051c ============================================================
14:10:56.0729 0x05b4 ============================================================
14:10:56.0729 0x05b4 Scan started
14:10:56.0729 0x05b4 Mode: Manual; SigCheck; TDLFS;
14:10:56.0729 0x05b4 ============================================================
14:10:56.0729 0x05b4 KSN ping started
14:10:59.0495 0x05b4 KSN ping finished: true
14:10:59.0698 0x05b4 ================ Scan system memory ========================
14:10:59.0698 0x05b4 System memory - ok
14:10:59.0698 0x05b4 ================ Scan services =============================
14:10:59.0791 0x05b4 [ 1B133875B8AA8AC48969BD3458AFE9F5, 01753BDD47F3F9BC0E0D23A069B9C56D4AE6A6B6295BC19B95AE245D25B12744 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
14:10:59.0948 0x05b4 1394ohci - ok
14:10:59.0979 0x05b4 [ CEA80C80BED809AA0DA6FEBC04733349, AE69C142DC2210A4AE657C23CEA4A6E7CB32C4F4EBA039414123CAC52157509B ] ACPI C:\Windows\system32\drivers\ACPI.sys
14:11:00.0026 0x05b4 ACPI - ok
14:11:00.0041 0x05b4 [ 1EFBC664ABFF416D1D07DB115DCB264F, BF94D069D692140B792DBF4FD3CB0127D27C26CC5BFB6B0C28A8B6346767EE58 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
14:11:00.0088 0x05b4 AcpiPmi - ok
14:11:00.0104 0x05b4 [ B362181ED3771DC03B4141927C80F801, 69514E5177A0AEA89C27C2234712F9F82E8D8F99E1FD4273898C9324C6FF7472 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
14:11:00.0135 0x05b4 AdobeARMservice - ok
14:11:00.0151 0x05b4 [ B04A4810C6CC205F9DC72DC22E4AB236, 547321F5C28C80D4818372D65E2A33D4BAC593015DD6613B24586FE4B4A95D5D ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
14:11:00.0182 0x05b4 AdobeFlashPlayerUpdateSvc - ok
14:11:00.0213 0x05b4 [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
14:11:00.0276 0x05b4 adp94xx - ok
14:11:00.0307 0x05b4 [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci C:\Windows\system32\drivers\adpahci.sys
14:11:00.0354 0x05b4 adpahci - ok
14:11:00.0370 0x05b4 [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320 C:\Windows\system32\drivers\adpu320.sys
14:11:00.0401 0x05b4 adpu320 - ok
14:11:00.0416 0x05b4 [ 8B5EEFEEC1E6D1A72A06C526628AD161, 026CDF4C96F4D493E7BABF79A14C4B0B5ADCCEF0B081FFFA2E3B243B2414167F ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
14:11:00.0495 0x05b4 AeLookupSvc - ok
14:11:00.0526 0x05b4 [ D0B388DA1D111A34366E04EB4A5DD156, 60D226F027F4025CC032CAFF73A80FAFB5FA75445654FDCF80CA8C0419C6E938 ] AFD C:\Windows\system32\drivers\afd.sys
14:11:00.0604 0x05b4 AFD - ok
14:11:00.0620 0x05b4 [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440 C:\Windows\system32\DRIVERS\agp440.sys
14:11:00.0635 0x05b4 agp440 - ok
14:11:00.0666 0x05b4 [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx C:\Windows\system32\drivers\djsvs.sys
14:11:00.0682 0x05b4 aic78xx - ok
14:11:00.0698 0x05b4 [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG C:\Windows\System32\alg.exe
14:11:00.0745 0x05b4 ALG - ok
14:11:00.0760 0x05b4 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide C:\Windows\system32\drivers\aliide.sys
14:11:00.0791 0x05b4 aliide - ok
14:11:00.0807 0x05b4 [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp C:\Windows\system32\drivers\amdagp.sys
14:11:00.0838 0x05b4 amdagp - ok
14:11:00.0854 0x05b4 [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide C:\Windows\system32\drivers\amdide.sys
14:11:00.0870 0x05b4 amdide - ok
14:11:00.0901 0x05b4 [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
14:11:00.0932 0x05b4 AmdK8 - ok
14:11:00.0948 0x05b4 [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
14:11:00.0979 0x05b4 AmdPPM - ok
14:11:01.0010 0x05b4 [ E7F4D42D8076EC60E21715CD11743A0D, 91AC020A70964F8783C999BDE8AB8391A3FA3AFC1CD4BC52A43625A2010A53E7 ] amdsata C:\Windows\system32\drivers\amdsata.sys
14:11:01.0026 0x05b4 amdsata - ok
14:11:01.0057 0x05b4 [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
14:11:01.0088 0x05b4 amdsbs - ok
14:11:01.0104 0x05b4 [ 146459D2B08BFDCBFA856D9947043C81, AC7F2069717601F949B0968EA651899D497170A93B84281B66D3CE5C382DDECB ] amdxata C:\Windows\system32\drivers\amdxata.sys
14:11:01.0135 0x05b4 amdxata - ok
14:11:01.0151 0x05b4 [ 81F97D8F8B3FB94A451CC6F7CF8B2965, 8DEBA4E47E1016D69740C0BB7CDD23852D86E0D42C1C1EA5A847ECB115C38CB1 ] AppID C:\Windows\system32\drivers\appid.sys
14:11:01.0198 0x05b4 AppID - ok
14:11:01.0198 0x05b4 [ F5090F8FA6757C58E17BAEAA86093636, 5E14CF3032DF5801240F45C59AA93962EA41AA5648A0C6458D16D9B9D95A131F ] AppIDSvc C:\Windows\System32\appidsvc.dll
14:11:01.0245 0x05b4 AppIDSvc - ok
14:11:01.0260 0x05b4 [ EACFDF31921F51C097629F1F3C9129B4, 24138755D823E69760579ECBD672421192457CDC9941B2BC499C2D34D83E86C3 ] Appinfo C:\Windows\System32\appinfo.dll
14:11:01.0307 0x05b4 Appinfo - ok
14:11:01.0323 0x05b4 [ A45D184DF6A8803DA13A0B329517A64A, C1D16B60A6D69689AE951DC3D6884ED2E233D144B3FC0B86BC1C50AAAAA01ED2 ] AppMgmt C:\Windows\System32\appmgmts.dll
14:11:01.0370 0x05b4 AppMgmt - ok
14:11:01.0385 0x05b4 [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc C:\Windows\system32\drivers\arc.sys
14:11:01.0416 0x05b4 arc - ok
14:11:01.0432 0x05b4 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas C:\Windows\system32\drivers\arcsas.sys
14:11:01.0463 0x05b4 arcsas - ok
14:11:01.0479 0x05b4 [ FE99FCB91E93BC4A7E222928A06411DE, C0F9A2A6324B17D435A7C62EB133E3E529D5622ED83C65E48F092CAB79D9A787 ] aswHwid C:\Windows\system32\drivers\aswHwid.sys
14:11:01.0526 0x05b4 aswHwid - ok
14:11:01.0541 0x05b4 [ 5D70C1C6C61C5A034BD086AD219A0237, 318C3CC5AF2A4B99C6C3938B36C95ECA63EABC5E93A2A3D7C729BA0BF191CDF1 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys
14:11:01.0588 0x05b4 aswMonFlt - ok
14:11:01.0620 0x05b4 [ 456106F51D03D99A8C65BFC0E37E3D0B, AC616957C299DF452E37ACB1C77F20A50AD4B23AD07BF09951817EF8B460A6D6 ] aswRdr C:\Windows\system32\drivers\aswRdr2.sys
14:11:01.0635 0x05b4 aswRdr - ok
14:11:01.0651 0x05b4 [ 74E84C8CEB52042E8A1EA3104D151843, B9D1ADC6A0FF31EE18E2EECCCC3D98C41FAE9E37295A0F555DAB59D0B6028A6E ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys
14:11:01.0682 0x05b4 aswRvrt - ok
14:11:01.0729 0x05b4 [ 48FA0C8E04A37A619C894A1C02D5AB96, F79C7252D0C578F827EED28630D97F2B5E3B361F920AF626343D8A71CDD86288 ] aswSnx C:\Windows\system32\drivers\aswSnx.sys
14:11:01.0791 0x05b4 aswSnx - ok
14:11:01.0823 0x05b4 [ 2AB454C9C10C427738426C06D3749361, BC604BC9006CF52520FA962055F391A806B7452639640F13516B151E34517643 ] aswSP C:\Windows\system32\drivers\aswSP.sys
14:11:01.0870 0x05b4 aswSP - ok
14:11:01.0901 0x05b4 [ F7D2CE852966935E2F85C3DB4D50D3A5, BE41E9849380BC047B145B8AC7A402C223A901D39CA349F5D2A070C890B7DCE6 ] aswStm C:\Windows\system32\drivers\aswStm.sys
14:11:01.0932 0x05b4 aswStm - ok
14:11:01.0948 0x05b4 [ 0AE22EAD6B30E448160338E708BCB71D, 4657A7C60635B916FFBC0A731D52E944FDDE6B052AD0DBD0848C3C7A5C15DD0D ] aswVmm C:\Windows\system32\drivers\aswVmm.sys
14:11:01.0995 0x05b4 aswVmm - ok
14:11:02.0010 0x05b4 [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
14:11:02.0073 0x05b4 AsyncMac - ok
14:11:02.0104 0x05b4 [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi C:\Windows\system32\drivers\atapi.sys
14:11:02.0120 0x05b4 atapi - ok
14:11:02.0166 0x05b4 [ C1619A13B10CAC5038BF7129F57D8DE3, 9F71EA6C844650658938E68CCC1383F92D37C68E46E08461A8351491185BA791 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:11:02.0213 0x05b4 AudioEndpointBuilder - ok
14:11:02.0245 0x05b4 [ C1619A13B10CAC5038BF7129F57D8DE3, 9F71EA6C844650658938E68CCC1383F92D37C68E46E08461A8351491185BA791 ] Audiosrv C:\Windows\System32\Audiosrv.dll
14:11:02.0307 0x05b4 Audiosrv - ok
14:11:02.0338 0x05b4 [ 210A326658D72D7F2EE2267F3D9C44D4, 25BC620209B5F4BCF5C3F323290E41255F68660F3DFF901FA5A78423A7293D73 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
14:11:02.0385 0x05b4 avast! Antivirus - ok
14:11:02.0541 0x05b4 [ 5019A83BE87FD8B60F7333901BFD35E5, 674DF51CAA1B6C0BC9CA9755B3BC5A9A71C583BD7C7A2826BD280E107B855092 ] AvastVBoxSvc C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
14:11:02.0776 0x05b4 AvastVBoxSvc - ok
14:11:02.0807 0x05b4 [ 6E30D02AAC9CAC84F421622E3A2F6178, 229DC527C1D6C778BCA2C855A2A6F6D2C4B0F4F6DE56C886B3AAD26E3347952C ] AxInstSV C:\Windows\System32\AxInstSV.dll
14:11:02.0916 0x05b4 AxInstSV - ok
14:11:02.0948 0x05b4 [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv C:\Windows\system32\drivers\bxvbdx.sys
14:11:02.0995 0x05b4 b06bdrv - ok
14:11:03.0010 0x05b4 [ BD8869EB9CDE6BBE4508D869929869EE, F4363A12EBFDBB89C69FD59B22F9EE05BADA07D477A1DF2DE01F59D6EE496543 ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys
14:11:03.0057 0x05b4 b57nd60x - ok
14:11:03.0073 0x05b4 [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC C:\Windows\System32\bdesvc.dll
14:11:03.0120 0x05b4 BDESVC - ok
14:11:03.0135 0x05b4 [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep C:\Windows\system32\drivers\Beep.sys
14:11:03.0198 0x05b4 Beep - ok
14:11:03.0229 0x05b4 [ 1E2BAC209D184BB851E1A187D8A29136, 53933C938DA5126986FFF2918C1F522ABE93ABAB460AE32E4453161C2F7B68DF ] BFE C:\Windows\System32\bfe.dll
14:11:03.0354 0x05b4 BFE - ok
14:11:03.0401 0x05b4 [ E585445D5021971FAE10393F0F1C3961, 178C008A9A0A6BFDA65EB0B98C510271360AD4474F22F13594F5EB60AA4E1CF5 ] BITS C:\Windows\System32\qmgr.dll
14:11:03.0526 0x05b4 BITS - ok
14:11:03.0541 0x05b4 [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
14:11:03.0573 0x05b4 blbdrive - ok
14:11:03.0604 0x05b4 [ 8F2DA3028D5FCBD1A060A3DE64CD6506, E234672E9CFE1A95AD2E78E306E41E010B870221E6EBBC0E2B0BE2FA5CE0CD76 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
14:11:03.0651 0x05b4 bowser - ok
14:11:03.0651 0x05b4 [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
14:11:03.0698 0x05b4 BrFiltLo - ok
14:11:03.0713 0x05b4 [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
14:11:03.0745 0x05b4 BrFiltUp - ok
14:11:03.0760 0x05b4 [ 3DAA727B5B0A45039B0E1C9A211B8400, 903B51E75F0C503A0E255120F53BF51B047B219FEC1E15F2F1D02DDD562FC73B ] Browser C:\Windows\System32\browser.dll
14:11:03.0807 0x05b4 Browser - ok
14:11:03.0823 0x05b4 [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid C:\Windows\System32\Drivers\Brserid.sys
14:11:03.0885 0x05b4 Brserid - ok
14:11:03.0901 0x05b4 [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
14:11:03.0932 0x05b4 BrSerWdm - ok
14:11:03.0948 0x05b4 [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
14:11:03.0979 0x05b4 BrUsbMdm - ok
14:11:04.0010 0x05b4 [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
14:11:04.0041 0x05b4 BrUsbSer - ok
14:11:04.0073 0x05b4 [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
14:11:04.0104 0x05b4 BTHMODEM - ok
14:11:04.0135 0x05b4 [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv C:\Windows\system32\bthserv.dll
14:11:04.0229 0x05b4 bthserv - ok
14:11:04.0245 0x05b4 [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
14:11:04.0291 0x05b4 cdfs - ok
14:11:04.0323 0x05b4 [ BE167ED0FDB9C1FA1133953C18D5A6C9, E26A851CA13E7300F977E5B20FA5D25FD0E1442AB6AD5DB58BBDB2DAAD87027C ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
14:11:04.0370 0x05b4 cdrom - ok
14:11:04.0385 0x05b4 [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] CertPropSvc C:\Windows\System32\certprop.dll
14:11:04.0432 0x05b4 CertPropSvc - ok
14:11:04.0448 0x05b4 [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass C:\Windows\system32\drivers\circlass.sys
14:11:04.0495 0x05b4 circlass - ok
14:11:04.0526 0x05b4 [ 33A60554882FDF59CDA3E1806370BBA1, 3DE5451E1CB84AAEBD03F54BEFC670C401447B4881A8B022748B6ECF0F500F01 ] CLFS C:\Windows\system32\CLFS.sys
14:11:04.0557 0x05b4 CLFS - ok
14:11:04.0588 0x05b4 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:11:04.0620 0x05b4 clr_optimization_v2.0.50727_32 - ok
14:11:04.0651 0x05b4 [ C5A75EB48E2344ABDC162BDA79E16841, 6070A8AAFD38FBC6A68A2B10C20117612354DF21B4492D90CA522BFB6870D726 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:11:04.0682 0x05b4 clr_optimization_v4.0.30319_32 - ok
14:11:04.0698 0x05b4 [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
14:11:04.0729 0x05b4 CmBatt - ok
14:11:04.0745 0x05b4 [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide C:\Windows\system32\drivers\cmdide.sys
14:11:04.0776 0x05b4 cmdide - ok
14:11:04.0807 0x05b4 [ 3051724F223EA48968B19567DE2A81F4, DCC27DE1B2B35866FC6DBDE95A368E7D0D346B6C3F31D0BACA63DD39B0A8874E ] CNG C:\Windows\system32\Drivers\cng.sys
14:11:04.0870 0x05b4 CNG - ok
14:11:04.0885 0x05b4 [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt C:\Windows\system32\drivers\compbatt.sys
14:11:04.0916 0x05b4 Compbatt - ok
14:11:04.0932 0x05b4 [ CBE8C58A8579CFE5FCCF809E6F114E89, AC083A1C649EBA18C59FCC1772D0784B10E2B8C63094E3C14388E147DBC3F6DF ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
14:11:04.0963 0x05b4 CompositeBus - ok
14:11:04.0979 0x05b4 COMSysApp - ok
14:11:04.0995 0x05b4 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
14:11:05.0026 0x05b4 crcdisk - ok
14:11:05.0057 0x05b4 [ 49474B3E37969AF4B5C076F42B623AFF, BDA6B57E9B60EF1B67C74099263D33A367AAA035667239F76AB8B268FD3E8F23 ] CryptSvc C:\Windows\system32\cryptsvc.dll
14:11:05.0104 0x05b4 CryptSvc - ok
14:11:05.0135 0x05b4 [ 3C2177A897B4CA2788C6FB0C3FD81D4B, 98575CBD0664586E6211D02E71BDD52CBAA149A1658573550E29E74E5F7B1553 ] CSC C:\Windows\system32\drivers\csc.sys
14:11:05.0182 0x05b4 CSC - ok
14:11:05.0229 0x05b4 [ 15F93B37F6801943360D9EB42485D5D3, DD6838C6496CB15F8BB57A6596F6A64ADD9C36B09F062295699131232712B558 ] CscService C:\Windows\System32\cscsvc.dll
14:11:05.0276 0x05b4 CscService - ok
14:11:05.0307 0x05b4 [ B459AE4AFCA570088ADDDBE55EABBC92, 3127555817CE86C5C400514FF3C694FA20A6F4381AACF354E31EEF192D6683BD ] ctsfm2k C:\Windows\system32\DRIVERS\ctsfm2k.sys
14:11:05.0338 0x05b4 ctsfm2k - ok
14:11:05.0370 0x05b4 [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch C:\Windows\system32\rpcss.dll
14:11:05.0432 0x05b4 DcomLaunch - ok
14:11:05.0463 0x05b4 [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc C:\Windows\System32\defragsvc.dll
14:11:05.0526 0x05b4 defragsvc - ok
14:11:05.0541 0x05b4 [ F024449C97EC1E464AAFFDA18593DB88, 7EF1E241892E098A472BCA14C724DFF1AACCF190954AF1C4A38B6D542CC74BD2 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
14:11:05.0588 0x05b4 DfsC - ok
14:11:05.0620 0x05b4 [ E9E01EB683C132F7FA27CD607B8A2B63, 4D9037B458C522874619143A4176BCED42472C68933E6E83D37B67242706F3C4 ] Dhcp C:\Windows\system32\dhcpcore.dll
14:11:05.0682 0x05b4 Dhcp - ok
14:11:05.0713 0x05b4 [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache C:\Windows\system32\drivers\discache.sys
14:11:05.0760 0x05b4 discache - ok
14:11:05.0776 0x05b4 [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk C:\Windows\system32\drivers\disk.sys
14:11:05.0807 0x05b4 Disk - ok
14:11:05.0823 0x05b4 [ 2A958EF85DB1B61FFCA65044FA4BCE9E, C83511685EE1CE85A5ADF9B5BE96C375A521601F66024BDC3EE044C0B6E85D69 ] dmvsc C:\Windows\system32\drivers\dmvsc.sys
14:11:05.0870 0x05b4 dmvsc - ok
14:11:05.0885 0x05b4 [ 33EF4861F19A0736B11314AAD9AE28D0, 4C4B84365D85758E3263B88F157D8B086B392C6F1EA5F0F3DB6BF87EF90248EC ] Dnscache C:\Windows\System32\dnsrslvr.dll
14:11:05.0932 0x05b4 Dnscache - ok
14:11:05.0948 0x05b4 [ 366BA8FB4B7BB7435E3B9EACB3843F67, 65B7C61ACF34F1F0149045AA9E09A3F917A927963237A385A914D0B80551DC31 ] dot3svc C:\Windows\System32\dot3svc.dll
14:11:06.0010 0x05b4 dot3svc - ok
14:11:06.0026 0x05b4 [ 8EC04CA86F1D68DA9E11952EB85973D6, 2E3FBC2D683D1274E8BC45EEEA87D43B77EDDCAAF0D453296D9FDA6B9D717071 ] DPS C:\Windows\system32\dps.dll
14:11:06.0088 0x05b4 DPS - ok
14:11:06.0104 0x05b4 [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
14:11:06.0151 0x05b4 drmkaud - ok
14:11:06.0182 0x05b4 [ 3583A5A8CC2E682BFFBD4630D0FEC08B, FD0F184B358FCECAA763444B414074BEF4E871EB7527D88385519FC158435C72 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
14:11:06.0245 0x05b4 DXGKrnl - ok
14:11:06.0276 0x05b4 [ 20DE769B84960606D8DBB2AEC123021A, 3099D99E5D107D9A7301A8521F09EB3FD19C0E934EC061850395BCC1A1279B88 ] E100B C:\Windows\system32\DRIVERS\e100b325.sys
14:11:06.0307 0x05b4 E100B - ok
14:11:06.0338 0x05b4 [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost C:\Windows\System32\eapsvc.dll
14:11:06.0385 0x05b4 EapHost - ok
14:11:06.0541 0x05b4 [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv C:\Windows\system32\drivers\evbdx.sys
14:11:06.0760 0x05b4 ebdrv - ok
14:11:06.0791 0x05b4 [ 618BA9298726844DA4E9E53C7C8D4015, BCDA8D829E0D40DA8E30832D6A53A2B9882655E5B024E4171BA9732456549B3E ] EFS C:\Windows\System32\lsass.exe
14:11:06.0823 0x05b4 EFS - ok
14:11:06.0854 0x05b4 [ A8C362018EFC87BEB013EE28F29C0863, 07971C681FBD391C0BA0172618AF8AD77520182207F1C57F134B34D6A113857F ] ehRecvr C:\Windows\ehome\ehRecvr.exe
14:11:06.0932 0x05b4 ehRecvr - ok
14:11:06.0948 0x05b4 [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched C:\Windows\ehome\ehsched.exe
14:11:06.0979 0x05b4 ehSched - ok
14:11:07.0010 0x05b4 [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor C:\Windows\system32\drivers\elxstor.sys
14:11:07.0073 0x05b4 elxstor - ok
14:11:07.0088 0x05b4 [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev C:\Windows\system32\drivers\errdev.sys
14:11:07.0120 0x05b4 ErrDev - ok
14:11:07.0166 0x05b4 [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem C:\Windows\system32\es.dll
14:11:07.0229 0x05b4 EventSystem - ok
14:11:07.0260 0x05b4 [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat C:\Windows\system32\drivers\exfat.sys
14:11:07.0307 0x05b4 exfat - ok
14:11:07.0338 0x05b4 [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat C:\Windows\system32\drivers\fastfat.sys
14:11:07.0401 0x05b4 fastfat - ok
14:11:07.0432 0x05b4 [ 967EA5B213E9984CBE270205DF37755B, 43153E23210B03FAE16897D62D55B8742F834EDC695F8401EAB5DE307F62602D ] Fax C:\Windows\system32\fxssvc.exe
14:11:07.0495 0x05b4 Fax - ok
14:11:07.0510 0x05b4 [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc C:\Windows\system32\DRIVERS\fdc.sys
14:11:07.0541 0x05b4 fdc - ok
14:11:07.0557 0x05b4 [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost C:\Windows\system32\fdPHost.dll
14:11:07.0620 0x05b4 fdPHost - ok
14:11:07.0635 0x05b4 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub C:\Windows\system32\fdrespub.dll
14:11:07.0698 0x05b4 FDResPub - ok
14:11:07.0713 0x05b4 [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
14:11:07.0745 0x05b4 FileInfo - ok
14:11:07.0760 0x05b4 [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
14:11:07.0807 0x05b4 Filetrace - ok
14:11:07.0823 0x05b4 [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
14:11:07.0854 0x05b4 flpydisk - ok
14:11:07.0885 0x05b4 [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
14:11:07.0916 0x05b4 FltMgr - ok
14:11:07.0979 0x05b4 [ 6EC244F102C7F129678E5F7309D1366D, C30DA201AC623DA440B0A0716534557C578218C2A591FA8893CCCBD96B4518F9 ] FontCache C:\Windows\system32\FntCache.dll
14:11:08.0041 0x05b4 FontCache - ok
14:11:08.0057 0x05b4 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
14:11:08.0088 0x05b4 FontCache3.0.0.0 - ok
14:11:08.0104 0x05b4 [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
14:11:08.0135 0x05b4 FsDepends - ok
14:11:08.0151 0x05b4 [ 7DAE5EBCC80E45D3253F4923DC424D05, 8A2C4D5591509B0B0A44583520617A9AE34F32BB6E68A012A7D7870ED24F703A ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
14:11:08.0182 0x05b4 Fs_Rec - ok
14:11:08.0198 0x05b4 [ 8A73E79089B282100B9393B644CB853B, 844DC5AADFABBD050B967904B796BA06BFD64C9112616EA26229D084F8B3AD41 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
14:11:08.0245 0x05b4 fvevol - ok
14:11:08.0260 0x05b4 [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
14:11:08.0291 0x05b4 gagp30kx - ok
14:11:08.0323 0x05b4 [ E897EAF5ED6BA41E081060C9B447A673, A428DC68516F19C6C53A8B62E4BDB2587E70FB751B9D77700B6B147D347DA157 ] gpsvc C:\Windows\System32\gpsvc.dll
14:11:08.0416 0x05b4 gpsvc - ok
14:11:08.0432 0x05b4 [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
14:11:08.0463 0x05b4 gupdate - ok
14:11:08.0479 0x05b4 [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
14:11:08.0495 0x05b4 gupdatem - ok
14:11:08.0526 0x05b4 [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
14:11:08.0604 0x05b4 hcw85cir - ok
14:11:08.0620 0x05b4 [ 9036377B8A6C15DC2EEC53E489D159B5, 1E56D2ACFE92E6DF96D755B05C63D580EED82C210F075C8623E138BEE6BCD41B ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
14:11:08.0682 0x05b4 HDAudBus - ok
14:11:08.0698 0x05b4 [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
14:11:08.0760 0x05b4 HidBatt - ok
14:11:08.0776 0x05b4 [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth C:\Windows\system32\drivers\hidbth.sys
14:11:08.0838 0x05b4 HidBth - ok
14:11:08.0870 0x05b4 [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr C:\Windows\system32\drivers\hidir.sys
14:11:08.0901 0x05b4 HidIr - ok
14:11:08.0932 0x05b4 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv C:\Windows\system32\hidserv.dll
14:11:08.0979 0x05b4 hidserv - ok
14:11:08.0995 0x05b4 [ 10C19F8290891AF023EAEC0832E1EB4D, E208553029488A6EE2F5216CC9FE5F93E9931A94C0D0625253BB159E30642853 ] HidUsb C:\Windows\system32\drivers\hidusb.sys
14:11:09.0026 0x05b4 HidUsb - ok
14:11:09.0057 0x05b4 [ 196B4E3F4CCCC24AF836CE58FACBB699, 7A2E1F603A073421FA0987EFB96647F1F0F2D4E0C82AA62EBC041585DA811DAF ] hkmsvc C:\Windows\system32\kmsvc.dll
14:11:09.0104 0x05b4 hkmsvc - ok
14:11:09.0135 0x05b4 [ 6658F4404DE03D75FE3BA09F7ABA6A30, E51D9C1580A283EB862F09B73AAE1B647DD683A53F3DD99834222F12DD15E40F ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:11:09.0182 0x05b4 HomeGroupListener - ok
14:11:09.0213 0x05b4 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8, 02121800D9062692C102475876AE8143EBE46D855E8328B8CDCFE6A2F0D19696 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:11:09.0245 0x05b4 HomeGroupProvider - ok
14:11:09.0276 0x05b4 [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
14:11:09.0291 0x05b4 HpSAMD - ok
14:11:09.0338 0x05b4 [ 487569E5DA56A5A432FF8AF6D3599CF9, 7C974D8379C60B4F69A20B01876C49181B0A63AC318C4BD0A21DABFF27A15C9D ] HTTP C:\Windows\system32\drivers\HTTP.sys
14:11:09.0401 0x05b4 HTTP - ok
14:11:09.0416 0x05b4 [ 0C4E035C7F105F1299258C90886C64C5, CFB4FBE7B28058E6D3E6E508CF3C1645F6AAE0AFEB4C5364835B9C42311DF0D4 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
14:11:09.0448 0x05b4 hwpolicy - ok
14:11:09.0463 0x05b4 [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
14:11:09.0495 0x05b4 i8042prt - ok
14:11:09.0526 0x05b4 [ A3CAE5D281DB4CFF7CFF8233507EE5AD, 2666107220B9F301193F2CF85A3D6B09E6E42CC150152D10A8886E47A3FD9B0D ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
14:11:09.0557 0x05b4 iaStorV - ok
14:11:09.0604 0x05b4 [ 3E9213A2A050BF429E91898C90F8B4E3, D80ABE5691087661B19F01927B631CB8C5291120B814B6F863F046E0D643E9E4 ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:11:09.0698 0x05b4 idsvc - ok
14:11:09.0713 0x05b4 IEEtwCollectorService - ok
14:11:09.0729 0x05b4 [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp C:\Windows\system32\drivers\iirsp.sys
14:11:09.0760 0x05b4 iirsp - ok
14:11:09.0791 0x05b4 [ B9C54120F46392100478F58F374E5709, A28EE8B0988F580D5984E815FC78DF41B169260814234AA0E453375542D0957B ] IKEEXT C:\Windows\System32\ikeext.dll
14:11:09.0854 0x05b4 IKEEXT - ok
14:11:09.0885 0x05b4 [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide C:\Windows\system32\drivers\intelide.sys
14:11:09.0916 0x05b4 intelide - ok
14:11:09.0932 0x05b4 [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
14:11:09.0963 0x05b4 intelppm - ok
14:11:09.0995 0x05b4 [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
14:11:10.0041 0x05b4 IPBusEnum - ok
14:11:10.0073 0x05b4 [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:11:10.0120 0x05b4 IpFilterDriver - ok
14:11:10.0151 0x05b4 [ 4D65A07B795D6674312F879D09AA7663, 8D72FE0B51A6FF71F85D2602DB3AE91C8749F70869B6789552F047BA81411EDA ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
14:11:10.0229 0x05b4 iphlpsvc - ok
14:11:10.0260 0x05b4 [ 4BD7134618C1D2A27466A099062547BF, 20284ABEF4433A59E2981F4143CAEC67DC990864FE0B9E3DC70EE0B88539E964 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
14:11:10.0291 0x05b4 IPMIDRV - ok
14:11:10.0307 0x05b4 [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
14:11:10.0370 0x05b4 IPNAT - ok
14:11:10.0385 0x05b4 [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM C:\Windows\system32\drivers\irenum.sys
14:11:10.0416 0x05b4 IRENUM - ok
14:11:10.0448 0x05b4 [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp C:\Windows\system32\drivers\isapnp.sys
14:11:10.0463 0x05b4 isapnp - ok
14:11:10.0495 0x05b4 [ CB7A9ABB12B8415BCE5D74994C7BA3AE, 464BFF3F5EEE985BE075E23E1813F5CB82A9A0771A92C6D889B13B867BCDF647 ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
14:11:10.0526 0x05b4 iScsiPrt - ok
14:11:10.0557 0x05b4 [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
14:11:10.0573 0x05b4 kbdclass - ok
14:11:10.0604 0x05b4 [ 9E3CED91863E6EE98C24794D05E27A71, 90CF59F20E14E4A5A793266805E82BF7AE1F0CF4C7BAB1FD2EEF3B53C5DF770F ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
14:11:10.0635 0x05b4 kbdhid - ok
14:11:10.0651 0x05b4 [ 618BA9298726844DA4E9E53C7C8D4015, BCDA8D829E0D40DA8E30832D6A53A2B9882655E5B024E4171BA9732456549B3E ] KeyIso C:\Windows\system32\lsass.exe
14:11:10.0682 0x05b4 KeyIso - ok
14:11:10.0713 0x05b4 [ A5B076011C853B4CAFD6296217A6E345, 3C852DC701231241881AB472A0CBBA9C1E25E92C52EF819C8AA2252833835344 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
14:11:10.0729 0x05b4 KSecDD - ok
14:11:10.0760 0x05b4 [ FD6A70D5D5B5BDF36AD265A232DAFB9A, C8CB4CE76A8CBD84CA1430D0E50651D3E3AEF4861FD17DEAFF2974183FAC585F ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
14:11:10.0791 0x05b4 KSecPkg - ok
14:11:10.0823 0x05b4 [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm C:\Windows\system32\msdtckrm.dll
14:11:10.0885 0x05b4 KtmRm - ok
14:11:10.0916 0x05b4 [ D64AF876D53ECA3668BB97B51B4E70AB, D5C07C019BFEAFBEDC29AB5060356A3B07449712B21B50E03378BEF04AF180F9 ] LanmanServer C:\Windows\system32\srvsvc.dll
14:11:10.0979 0x05b4 LanmanServer - ok
14:11:10.0995 0x05b4 [ 58405E4F68BA8E4057C6E914F326ABA2, C3E6519A1A38F1B3597D4391E42ABFE8F1F5E86256C4B3BD876CDAD9BB68B0A6 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:11:11.0057 0x05b4 LanmanWorkstation - ok
14:11:11.0088 0x05b4 [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
14:11:11.0135 0x05b4 lltdio - ok
14:11:11.0166 0x05b4 [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc C:\Windows\System32\lltdsvc.dll
14:11:11.0229 0x05b4 lltdsvc - ok
14:11:11.0245 0x05b4 [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts C:\Windows\System32\lmhsvc.dll
14:11:11.0291 0x05b4 lmhosts - ok
14:11:11.0323 0x05b4 [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
14:11:11.0354 0x05b4 LSI_FC - ok
14:11:11.0370 0x05b4 [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
14:11:11.0401 0x05b4 LSI_SAS - ok
14:11:11.0432 0x05b4 [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
14:11:11.0463 0x05b4 LSI_SAS2 - ok
14:11:11.0479 0x05b4 [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
14:11:11.0510 0x05b4 LSI_SCSI - ok
14:11:11.0526 0x05b4 [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv C:\Windows\system32\drivers\luafv.sys
14:11:11.0588 0x05b4 luafv - ok
14:11:11.0604 0x05b4 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1, D2A84EBF0C0B7A14AD432FD2EF43CC12300027AEA3FA4075659FB088AB62B588 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
14:11:11.0635 0x05b4 Mcx2Svc - ok
14:11:11.0666 0x05b4 [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas C:\Windows\system32\drivers\megasas.sys
14:11:11.0698 0x05b4 megasas - ok
14:11:11.0713 0x05b4 [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
14:11:11.0760 0x05b4 MegaSR - ok
14:11:11.0776 0x05b4 [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS C:\Windows\system32\mmcss.dll
14:11:11.0823 0x05b4 MMCSS - ok
14:11:11.0854 0x05b4 [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem C:\Windows\system32\drivers\modem.sys
14:11:11.0901 0x05b4 Modem - ok
14:11:11.0916 0x05b4 [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
14:11:11.0948 0x05b4 monitor - ok
14:11:11.0979 0x05b4 [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
14:11:11.0995 0x05b4 mouclass - ok
14:11:12.0026 0x05b4 [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
14:11:12.0057 0x05b4 mouhid - ok
14:11:12.0073 0x05b4 [ 644905A19D0F37F2233DFCE53BC4BC19, F52CB40AA0FD1EBF8CBF0F3BFB20C47142C637719840877FB93F10D085EB8C2B ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
14:11:12.0104 0x05b4 mountmgr - ok
14:11:12.0120 0x05b4 [ DD370A8148862150BA81A3F5C56A1E40, F56B84297BDC32266CB69D10FB2D66B8B332D60CAB7E64E4E3AC2BB749BBD31B ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
14:11:12.0151 0x05b4 MozillaMaintenance - ok
14:11:12.0182 0x05b4 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0, D3D903EEA465D77345AAC9B9F02CDEADF4831212EA2DE4FCA33BEE26EBB47420 ] mpio C:\Windows\system32\drivers\mpio.sys
14:11:12.0213 0x05b4 mpio - ok
14:11:12.0245 0x05b4 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
14:11:12.0291 0x05b4 mpsdrv - ok
14:11:12.0338 0x05b4 [ 9835584E999D25004E1EE8E5F3E3B881, 71798B0CBE9AE69F1F29B845319019C69EC7F415CBABB3B87DDE92C360675021 ] MpsSvc C:\Windows\system32\mpssvc.dll
14:11:12.0401 0x05b4 MpsSvc - ok
14:11:12.0432 0x05b4 [ 03F899F521D2AAED1C55008F734DF252, 4E56A51476A13F5630719018037B1F63DF9ACEA1CFE782AF04E669BD696954C5 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
14:11:12.0479 0x05b4 MRxDAV - ok
14:11:12.0495 0x05b4 [ 5D16C921E3671636C0EBA3BBAAC5FD25, 5BC107B95CAFC88F51FBB9F657B99944B20627A2B618F263093D7045E4FFD65C ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
14:11:12.0526 0x05b4 mrxsmb - ok
14:11:12.0557 0x05b4 [ 6D17A4791ACA19328C685D256349FEFC, 012AA3D84EEAAF53780D06D2D11B9727DFC3441F3FAD75BC9E751FB814403668 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:11:12.0604 0x05b4 mrxsmb10 - ok
14:11:12.0620 0x05b4 [ B81F204D146000BE76651A50670A5E9E, 78193D0F967BE9829E53F9B500342934B4B1E1F4CEFC444382959E2061BC3B17 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:11:12.0651 0x05b4 mrxsmb20 - ok
14:11:12.0666 0x05b4 [ 012C5F4E9349E711E11E0F19A8589F0A, 208B92DFCF7AD43202660FBBC9FF5E03AEDBEE38178FF3628EB74CB6CD37C584 ] msahci C:\Windows\system32\drivers\msahci.sys
14:11:12.0698 0x05b4 msahci - ok
14:11:12.0729 0x05b4 [ 55055F8AD8BE27A64C831322A780A228, C2C9FD1F61302997117B1CD0835E8234405BB80084065ED05363B77868397304 ] msdsm C:\Windows\system32\drivers\msdsm.sys
14:11:12.0760 0x05b4 msdsm - ok
14:11:12.0776 0x05b4 [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC C:\Windows\System32\msdtc.exe
14:11:12.0823 0x05b4 MSDTC - ok
14:11:12.0854 0x05b4 [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs C:\Windows\system32\drivers\Msfs.sys
14:11:12.0901 0x05b4 Msfs - ok
14:11:12.0916 0x05b4 [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
14:11:12.0979 0x05b4 mshidkmdf - ok
14:11:12.0995 0x05b4 [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
14:11:13.0026 0x05b4 msisadrv - ok
14:11:13.0041 0x05b4 [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI C:\Windows\system32\iscsiexe.dll
14:11:13.0088 0x05b4 MSiSCSI - ok
14:11:13.0120 0x05b4 msiserver - ok
14:11:13.0135 0x05b4 [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
14:11:13.0182 0x05b4 MSKSSRV - ok
14:11:13.0213 0x05b4 [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
14:11:13.0245 0x05b4 MSPCLOCK - ok
14:11:13.0276 0x05b4 [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
14:11:13.0323 0x05b4 MSPQM - ok
14:11:13.0338 0x05b4 [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
14:11:13.0370 0x05b4 MsRPC - ok
14:11:13.0401 0x05b4 [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
14:11:13.0432 0x05b4 mssmbios - ok
14:11:13.0448 0x05b4 [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
14:11:13.0495 0x05b4 MSTEE - ok
14:11:13.0526 0x05b4 [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
14:11:13.0541 0x05b4 MTConfig - ok
14:11:13.0573 0x05b4 [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup C:\Windows\system32\Drivers\mup.sys
14:11:13.0604 0x05b4 Mup - ok
14:11:13.0635 0x05b4 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E, D252248532142E9E2332DA693BC51B795102CA938B568FF04981E98B19BFBC5C ] napagent C:\Windows\system32\qagentRT.dll
14:11:13.0698 0x05b4 napagent - ok
14:11:13.0729 0x05b4 [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
14:11:13.0776 0x05b4 NativeWifiP - ok
14:11:13.0838 0x05b4 [ E7C54812A2AAF43316EB6930C1FFA108, C8A6FC1957FA29A3B372132FEA9145538BC767044A11D77316D3D1A3EAA60630 ] NDIS C:\Windows\system32\drivers\ndis.sys
14:11:13.0885 0x05b4 NDIS - ok
14:11:13.0916 0x05b4 [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
14:11:14.0010 0x05b4 NdisCap - ok
14:11:14.0026 0x05b4 [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
14:11:14.0104 0x05b4 NdisTapi - ok
14:11:14.0120 0x05b4 [ D8A65DAFB3EB41CBB622745676FCD072, 874D3C3D247C4A309DA813DB1D2EDB0037D3C489824BD5FE95B0C20699764EF7 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
14:11:14.0182 0x05b4 Ndisuio - ok
14:11:14.0198 0x05b4 [ 38FBE267E7E6983311179230FACB1017, CFD1CBCA59650795C030DB30E5795B37C11C736E14003AE1DAB081BA5C0C9B14 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
14:11:14.0307 0x05b4 NdisWan - ok
14:11:14.0323 0x05b4 [ A4BDC541E69674FBFF1A8FF00BE913F2, 18CCFD063E9870B8B6958715BC0414C4D920AE63528EA1E9D7E30F7138918FFA ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
14:11:14.0370 0x05b4 NDProxy - ok
14:11:14.0385 0x05b4 [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
14:11:14.0448 0x05b4 NetBIOS - ok
14:11:14.0463 0x05b4 [ 280122DDCF04B378EDD1AD54D71C1E54, F98B2ADE34F7E67C7C06C1D0FFB80ECBC353D044D4B4784CD952910345DC2ED0 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
14:11:14.0526 0x05b4 NetBT - ok
14:11:14.0541 0x05b4 [ 618BA9298726844DA4E9E53C7C8D4015, BCDA8D829E0D40DA8E30832D6A53A2B9882655E5B024E4171BA9732456549B3E ] Netlogon C:\Windows\system32\lsass.exe
14:11:14.0573 0x05b4 Netlogon - ok
14:11:14.0604 0x05b4 [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman C:\Windows\System32\netman.dll
14:11:14.0666 0x05b4 Netman - ok
14:11:14.0713 0x05b4 [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm C:\Windows\System32\netprofm.dll
14:11:14.0776 0x05b4 netprofm - ok
14:11:14.0807 0x05b4 [ 005C38BA492291801AA5F71DAE3C1A7B, E43F0CE95D646B41FC681E0B95721598EA74C45975BEEE1C5EFFB0D238253B0E ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:11:14.0838 0x05b4 NetTcpPortSharing - ok
14:11:14.0854 0x05b4 [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
14:11:14.0870 0x05b4 nfrd960 - ok
14:11:14.0901 0x05b4 [ F115C5CD29E512F18BD7138A094B77E5, 90C2CE8B256EE9AABF674ADDE7F85E91DAF48EA368452D03C187A4AE027D4E39 ] NlaSvc C:\Windows\System32\nlasvc.dll
14:11:14.0963 0x05b4 NlaSvc - ok
14:11:14.0979 0x05b4 [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs C:\Windows\system32\drivers\Npfs.sys
14:11:15.0026 0x05b4 Npfs - ok
14:11:15.0041 0x05b4 [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi C:\Windows\system32\nsisvc.dll
14:11:15.0104 0x05b4 nsi - ok
14:11:15.0120 0x05b4 [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
14:11:15.0166 0x05b4 nsiproxy - ok
14:11:15.0229 0x05b4 [ 5E43D2B0EE64123D4880DFA6626DEFDE, 164413A22DE58B19EA2B4120034B46D6BE1F424B80C3421E10BE5C81153D049F ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
14:11:15.0307 0x05b4 Ntfs - ok
14:11:15.0338 0x05b4 [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null C:\Windows\system32\drivers\Null.sys
14:11:15.0385 0x05b4 Null - ok
14:11:15.0401 0x05b4 [ AF2EEC9580C1D32FB7EAF105D9784061, 6DAAE3BCA048ACD7FFD26A65C793C461933179070F03855FE3DC3C01F968163A ] nvraid C:\Windows\system32\drivers\nvraid.sys
14:11:15.0432 0x05b4 nvraid - ok
14:11:15.0463 0x05b4 [ 9283C58EBAA2618F93482EB5DABCEC82, 0BC119D4EAFDEA879E4C1CFBA5402499DBD1970EDF963C6D2034D4867C34D15E ] nvstor C:\Windows\system32\drivers\nvstor.sys
14:11:15.0495 0x05b4 nvstor - ok
14:11:15.0510 0x05b4 [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
14:11:15.0541 0x05b4 nv_agp - ok
14:11:15.0557 0x05b4 [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
14:11:15.0588 0x05b4 ohci1394 - ok
14:11:15.0620 0x05b4 [ C720C25B2D0C93DC425155F5B6A707F3, 1092DF31E7F61C418ED69C21A9B77E81C9E9C79D0C23A0FD15AF4D0E25884409 ] ossrv C:\Windows\system32\DRIVERS\ctoss2k.sys
14:11:15.0651 0x05b4 ossrv - ok
14:11:15.0713 0x05b4 [ F051107FF80F132882E71E3A5D302EC1, 1567A2B4E02E157DC0822FCB9E07789D4E0CD66B81D01FB35005E226A0EAFB64 ] P16X C:\Windows\system32\drivers\P16X.sys
14:11:15.0807 0x05b4 P16X - ok
14:11:15.0838 0x05b4 [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
14:11:15.0885 0x05b4 p2pimsvc - ok
14:11:15.0916 0x05b4 [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc C:\Windows\system32\p2psvc.dll
14:11:15.0979 0x05b4 p2psvc - ok
14:11:16.0010 0x05b4 [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport C:\Windows\system32\DRIVERS\parport.sys
14:11:16.0041 0x05b4 Parport - ok
14:11:16.0057 0x05b4 [ 3F34A1B4C5F6475F320C275E63AFCE9B, 31295D5121C0C3F2085E0EEBA260EEE4CA003993C026E2F81986D19158036E6B ] partmgr C:\Windows\system32\drivers\partmgr.sys
14:11:16.0088 0x05b4 partmgr - ok
14:11:16.0104 0x05b4 [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys
14:11:16.0151 0x05b4 Parvdm - ok
14:11:16.0182 0x05b4 [ 52954BE460EC6C54C0ACB2B3B126FFC6, 9F9878EC5ABC74C5A8EE8E1D940F0934F081895B07D844F42F80A638FE713F7B ] PcaSvc C:\Windows\System32\pcasvc.dll
14:11:16.0213 0x05b4 PcaSvc - ok
14:11:16.0245 0x05b4 [ 673E55C3498EB970088E812EA820AA8F, 1F81315664B8CBFDD569416C0ECCE4C6251F34577313A0858AB46609781303B5 ] pci C:\Windows\system32\drivers\pci.sys
14:11:16.0276 0x05b4 pci - ok
14:11:16.0291 0x05b4 [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide C:\Windows\system32\drivers\pciide.sys
14:11:16.0307 0x05b4 pciide - ok
14:11:16.0338 0x05b4 [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
14:11:16.0370 0x05b4 pcmcia - ok
14:11:16.0401 0x05b4 [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw C:\Windows\system32\drivers\pcw.sys
14:11:16.0432 0x05b4 pcw - ok
14:11:16.0463 0x05b4 [ AEBC369F7DC72AB3F5B9BDF34FA0D43F, 2A819154AC6C23E97C583D90B4D0C112188B7AE9D8D9B3F88811BFCED124E551 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
14:11:16.0541 0x05b4 PEAUTH - ok
14:11:16.0604 0x05b4 [ AF4D64D2A57B9772CF3801950B8058A6, C9C493A3775E6E1660CE5DF75DA574D0C04245FB88CF41B96217A725359C350D ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
14:11:16.0698 0x05b4 PeerDistSvc - ok
14:11:16.0745 0x05b4 [ C8A2D6FF660AC601B7BB9A9B16A5C25E, BBF97622AB15943F614AE3901860DE4B1380D5878FCC6EAA2384B4C9432C0B4B ] PfModNT C:\Windows\system32\drivers\PfModNT.sys
14:11:16.0776 0x05b4 PfModNT - detected UnsignedFile.Multi.Generic ( 1 )
14:11:19.0776 0x05b4 Detect skipped due to KSN trusted
14:11:19.0776 0x05b4 PfModNT - ok
14:11:19.0838 0x05b4 [ 414BBA67A3DED1D28437EB66AEB8A720, D6DF254E2615FA402044824DCD9004F579FC0DF74B90E44C99D5F0253CF8AD88 ] pla C:\Windows\system32\pla.dll
14:11:20.0010 0x05b4 pla - ok
14:11:20.0057 0x05b4 [ EC7BC28D207DA09E79B3E9FAF8B232CA, A42F8F69C3CD753D787A5D558659DEA2CC306C896D75B8C82549219CF654504F ] PlugPlay C:\Windows\system32\umpnpmgr.dll
14:11:20.0166 0x05b4 PlugPlay - ok
14:11:20.0182 0x05b4 [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
14:11:20.0229 0x05b4 PNRPAutoReg - ok
14:11:20.0260 0x05b4 [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
14:11:20.0307 0x05b4 PNRPsvc - ok
14:11:20.0338 0x05b4 [ 53946B69BA0836BD95B03759530C81EC, 7F14A34635354CCA0F5342C8D9DF5A6AA1B94F6A508BD8834029E9BACF252920 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
14:11:20.0510 0x05b4 PolicyAgent - ok
14:11:20.0541 0x05b4 [ F87D30E72E03D579A5199CCB3831D6EA, B09328E89954584F97908FA5946376BA990B8C650DABCBF3CA3B08719937C694 ] Power C:\Windows\system32\umpo.dll
14:11:20.0604 0x05b4 Power - ok
14:11:20.0620 0x05b4 [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
14:11:20.0682 0x05b4 PptpMiniport - ok
14:11:20.0713 0x05b4 [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor C:\Windows\system32\drivers\processr.sys
14:11:20.0745 0x05b4 Processor - ok
14:11:20.0776 0x05b4 [ FD9692A3D31E021207D3C2A9DDDC2BE3, 5295EFAD9BD4B59996935A41825392C12A4C968D161BEEA37797F90AF8E54229 ] ProfSvc C:\Windows\system32\profsvc.dll
14:11:20.0870 0x05b4 ProfSvc - ok
14:11:20.0885 0x05b4 [ 618BA9298726844DA4E9E53C7C8D4015, BCDA8D829E0D40DA8E30832D6A53A2B9882655E5B024E4171BA9732456549B3E ] ProtectedStorage C:\Windows\system32\lsass.exe
14:11:20.0932 0x05b4 ProtectedStorage - ok
14:11:20.0948 0x05b4 [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
14:11:20.0995 0x05b4 Psched - ok
14:11:21.0073 0x05b4 [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300 C:\Windows\system32\drivers\ql2300.sys
14:11:21.0260 0x05b4 ql2300 - ok
14:11:21.0291 0x05b4 [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
14:11:21.0323 0x05b4 ql40xx - ok
14:11:21.0354 0x05b4 [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE C:\Windows\system32\qwave.dll
14:11:21.0526 0x05b4 QWAVE - ok
14:11:21.0541 0x05b4 [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
14:11:21.0588 0x05b4 QWAVEdrv - ok
14:11:21.0604 0x05b4 [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
14:11:21.0666 0x05b4 RasAcd - ok
14:11:21.0682 0x05b4 [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
14:11:21.0729 0x05b4 RasAgileVpn - ok
14:11:21.0760 0x05b4 [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto C:\Windows\System32\rasauto.dll
14:11:21.0823 0x05b4 RasAuto - ok
14:11:21.0838 0x05b4 [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
14:11:21.0916 0x05b4 Rasl2tp - ok
14:11:21.0948 0x05b4 [ CB9E04DC05EACF5B9A36CA276D475006, 4D8C0AEF1D4F84F375AD2BAF786C9F6C52316A3E655B913449E71AD7C0FCA56E ] RasMan C:\Windows\System32\rasmans.dll
14:11:22.0026 0x05b4 RasMan - ok
14:11:22.0041 0x05b4 [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
14:11:22.0104 0x05b4 RasPppoe - ok
14:11:22.0135 0x05b4 [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
14:11:22.0213 0x05b4 RasSstp - ok
14:11:22.0245 0x05b4 [ D528BC58A489409BA40334EBF96A311B, C71E9A4B101DB6C3183B9F97B9098D73D6FE1B12C05C2EB3CE8A8041BEE6BA61 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
14:11:22.0338 0x05b4 rdbss - ok
14:11:22.0354 0x05b4 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
14:11:22.0432 0x05b4 rdpbus - ok
14:11:22.0432 0x05b4 [ 23DAE03F29D253AE74C44F99E515F9A1, 8FED93D10B2062F0526FE3508101F8FCF8F72DEB90AFB472EB7CBAE83A0EC430 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
14:11:22.0495 0x05b4 RDPCDD - ok
14:11:22.0526 0x05b4 [ B973FCFC50DC1434E1970A146F7E3885, BE797E5F5AE34D37F8DA1134CE94DD14DBE36D2BC405B97E992E2257848B7CA9 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
14:11:22.0573 0x05b4 RDPDR - ok
14:11:22.0588 0x05b4 [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
14:11:22.0635 0x05b4 RDPENCDD - ok
14:11:22.0666 0x05b4 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
14:11:22.0713 0x05b4 RDPREFMP - ok
14:11:22.0745 0x05b4 [ CD9214A6AE17D188D17C3CF8CB9CC693, 2E16FF1F7446F0600D6519010FD05A30B94D97167C16B3E7FC396A97D8139D60 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
14:11:22.0791 0x05b4 RDPWD - ok
14:11:22.0823 0x05b4 [ 518395321DC96FE2C9F0E96AC743B656, 5F6A0880B4F3EE7196259EA362DA9554B0687B0236F9A8E5CF7A4A77F01F1776 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
14:11:22.0854 0x05b4 rdyboost - ok
14:11:22.0870 0x05b4 [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess C:\Windows\System32\mprdim.dll
14:11:22.0948 0x05b4 RemoteAccess - ok
14:11:22.0963 0x05b4 [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry C:\Windows\system32\regsvc.dll
14:11:23.0026 0x05b4 RemoteRegistry - ok
14:11:23.0041 0x05b4 [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
14:11:23.0104 0x05b4 RpcEptMapper - ok
14:11:23.0120 0x05b4 [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator C:\Windows\system32\locator.exe
14:11:23.0166 0x05b4 RpcLocator - ok
14:11:23.0198 0x05b4 [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs C:\Windows\system32\rpcss.dll
14:11:23.0260 0x05b4 RpcSs - ok
14:11:23.0291 0x05b4 [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
14:11:23.0338 0x05b4 rspndr - ok
14:11:23.0370 0x05b4 [ 7DFD48E24479B68B258D8770121155A0, 3B5F7309403C46855DB888CF2058B07C9029690DBC7FB3224BAC7BE5547D2D57 ] RTL8167 C:\Windows\system32\DRIVERS\Rt86win7.sys
14:11:23.0416 0x05b4 RTL8167 - ok
14:11:23.0432 0x05b4 [ 7FA7F2E249A5DCBB7970630E15E1F482, 9633B193F3FDA67BC551C6DCA4788AB83E9F45F77763EE579D02FE5D6B80DEDF ] s3cap C:\Windows\system32\drivers\vms3cap.sys
14:11:23.0463 0x05b4 s3cap - ok
14:11:23.0479 0x05b4 [ 618BA9298726844DA4E9E53C7C8D4015, BCDA8D829E0D40DA8E30832D6A53A2B9882655E5B024E4171BA9732456549B3E ] SamSs C:\Windows\system32\lsass.exe
14:11:23.0526 0x05b4 SamSs - ok
14:11:23.0541 0x05b4 [ 05D860DA1040F111503AC416CCEF2BCA, DAE2F37D09A5A42F945BC8E27E4EA2303521081783A80CEE7FEE7C5A1C2CFC5E ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
14:11:23.0573 0x05b4 sbp2port - ok
14:11:23.0604 0x05b4 [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr C:\Windows\System32\SCardSvr.dll
14:11:23.0666 0x05b4 SCardSvr - ok
14:11:23.0698 0x05b4 [ 0693B5EC673E34DC147E195779A4DCF6, AF1B56FBF3ADABF94CD9DBA67586B8746DE135151F6B3D1B0EE315BC1E2DB670 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
14:11:23.0745 0x05b4 scfilter - ok
14:11:23.0791 0x05b4 [ A04BB13F8A72F8B6E8B4071723E4E336, E63287FF71C39CBF64C3347C455324C8437F9CF398153E269543588B65389502 ] Schedule C:\Windows\system32\schedsvc.dll
14:11:23.0885 0x05b4 Schedule - ok
14:11:23.0916 0x05b4 [ 319C6B309773D063541D01DF8AC6F55F, 182F392FE839499D159A30A3CD04B5D0C87219930BFB1A7456880B7DA75B9820 ] SCPolicySvc C:\Windows\System32\certprop.dll
14:11:23.0963 0x05b4 SCPolicySvc - ok
14:11:23.0995 0x05b4 [ 08236C4BCE5EDD0A0318A438AF28E0F7, 77727F963F63C4CEC11E7AAD5FB3836179701D512CA9436C3170B9E6A4E5F888 ] SDRSVC C:\Windows\System32\SDRSVC.dll
14:11:24.0041 0x05b4 SDRSVC - ok
14:11:24.0057 0x05b4 [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv C:\Windows\system32\drivers\secdrv.sys
14:11:24.0120 0x05b4 secdrv - ok
14:11:24.0135 0x05b4 [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon C:\Windows\system32\seclogon.dll
14:11:24.0198 0x05b4 seclogon - ok
14:11:24.0229 0x05b4 [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS C:\Windows\System32\sens.dll
14:11:24.0291 0x05b4 SENS - ok
14:11:24.0307 0x05b4 [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc C:\Windows\system32\sensrsvc.dll
14:11:24.0354 0x05b4 SensrSvc - ok
14:11:24.0370 0x05b4 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
14:11:24.0401 0x05b4 Serenum - ok
14:11:24.0432 0x05b4 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial C:\Windows\system32\DRIVERS\serial.sys
14:11:24.0463 0x05b4 Serial - ok
14:11:24.0495 0x05b4 [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse C:\Windows\system32\drivers\sermouse.sys
14:11:24.0526 0x05b4 sermouse - ok
14:11:24.0573 0x05b4 [ 4AE380F39A0032EAB7DD953030B26D28, C8F5F2DD59574E966FDF3057867BB959A554BAB6FD5DC6F1427094A6BC2B2809 ] SessionEnv C:\Windows\system32\sessenv.dll
14:11:24.0635 0x05b4 SessionEnv - ok
14:11:24.0651 0x05b4 [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
14:11:24.0682 0x05b4 sffdisk - ok
14:11:24.0713 0x05b4 [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
14:11:24.0745 0x05b4 sffp_mmc - ok
14:11:24.0760 0x05b4 [ 6D4CCAEDC018F1CF52866BBBAA235982, AAC41F5C97B3FE5A3DC0838457EB8CC9BB71FCA16D3EDBB67D603F0A9D46C131 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
14:11:24.0791 0x05b4 sffp_sd - ok
14:11:24.0823 0x05b4 [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
14:11:24.0854 0x05b4 sfloppy - ok
14:11:24.0885 0x05b4 [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess C:\Windows\System32\ipnathlp.dll
14:11:24.0948 0x05b4 SharedAccess - ok
14:11:24.0995 0x05b4 [ 414DA952A35BF5D50192E28263B40577, 9C9BAFB9880DA6CC728506A142BE124E186219610DCC3460657A3CA93C865DF1 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:11:25.0057 0x05b4 ShellHWDetection - ok
14:11:25.0073 0x05b4 [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp C:\Windows\system32\drivers\sisagp.sys
14:11:25.0104 0x05b4 sisagp - ok
14:11:25.0120 0x05b4 [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
14:11:25.0151 0x05b4 SiSRaid2 - ok
14:11:25.0182 0x05b4 [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
14:11:25.0198 0x05b4 SiSRaid4 - ok
14:11:25.0229 0x05b4 [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb C:\Windows\system32\DRIVERS\smb.sys
14:11:25.0354 0x05b4 Smb - ok
14:11:25.0385 0x05b4 [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
14:11:25.0432 0x05b4 SNMPTRAP - ok
14:11:25.0448 0x05b4 [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr C:\Windows\system32\drivers\spldr.sys
14:11:25.0463 0x05b4 spldr - ok
14:11:25.0510 0x05b4 [ 866A43013535DC8587C258E43579C764, B2BE846B5167A2ECD1E30C69A81385FCC6EAE6033394D08458A5583D311C4D82 ] Spooler C:\Windows\System32\spoolsv.exe
14:11:25.0635 0x05b4 Spooler - ok
14:11:25.0807 0x05b4 [ CF87A1DE791347E75B98885214CED2B8, 7AF4E03D751C951A4E5FBA28200DABFE6B3BF055490163EEEEA84EBA4D0F368A ] sppsvc C:\Windows\system32\sppsvc.exe
14:11:26.0010 0x05b4 sppsvc - ok
14:11:26.0041 0x05b4 [ B0180B20B065D89232A78A40FE56EAA6, 4D045B23AD58A8822BE9F20119744A8D47455469D54494745CEB099951DA60FF ] sppuinotify C:\Windows\system32\sppuinotify.dll
14:11:26.0104 0x05b4 sppuinotify - ok
14:11:26.0135 0x05b4 [ E4C2764065D66EA1D2D3EBC28FE99C46, 043AEF06A23069DD17675955C834690A5FD8F1948A05B3969F977E823C4E25F5 ] srv C:\Windows\system32\DRIVERS\srv.sys
14:11:26.0182 0x05b4 srv - ok
14:11:26.0213 0x05b4 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB, 4DF31206DF8F33C2975E23C7257ED930C4EDA8BC4E246D8FDA130BB583083ED0 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
14:11:26.0276 0x05b4 srv2 - ok
14:11:26.0291 0x05b4 [ BE6BD660CAA6F291AE06A718A4FA8ABC, CD38939CFBA80B882D38099194FC1EBAE15A9D27A4D941DD03C55EC745E52E59 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
14:11:26.0323 0x05b4 srvnet - ok
14:11:26.0354 0x05b4 [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
14:11:26.0416 0x05b4 SSDPSRV - ok
14:11:26.0432 0x05b4 [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc C:\Windows\system32\sstpsvc.dll
14:11:26.0510 0x05b4 SstpSvc - ok
14:11:26.0526 0x05b4 [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor C:\Windows\system32\drivers\stexstor.sys
14:11:26.0557 0x05b4 stexstor - ok
14:11:26.0588 0x05b4 [ E1FB3706030FB4578A0D72C2FC3689E4, A62EC9AA4514CAF2A10C0A3AEF7A36F593A7E7DA370A3F130C24E1B612E19427 ] StiSvc C:\Windows\System32\wiaservc.dll
14:11:26.0666 0x05b4 StiSvc - ok
14:11:26.0682 0x05b4 [ 472AF0311073DCECEAA8FA18BA2BDF89, 089414057EB2047E42C96C1ACE79D509967461DC5A4D2836F63C04268637A3FC ] storflt C:\Windows\system32\drivers\vmstorfl.sys
14:11:26.0713 0x05b4 storflt - ok
14:11:26.0729 0x05b4 [ 0BF669F0A910BEDA4A32258D363AF2A5, 83EEBACDE4F69A2866B69CAA633F5C8B3CB01D88CEDB01B6EA5988E0A25CEE47 ] StorSvc C:\Windows\system32\storsvc.dll
14:11:26.0776 0x05b4 StorSvc - ok
14:11:26.0791 0x05b4 [ DCAFFD62259E0BDB433DD67B5BB37619, CBD12FF9BBF33D18B0F3D322B12EC62E7DF3BF45C6AD43D2E91FF4C4762E05D0 ] storvsc C:\Windows\system32\drivers\storvsc.sys
14:11:26.0823 0x05b4 storvsc - ok
14:11:26.0823 0x05b4 [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
14:11:26.0870 0x05b4 swenum - ok
14:11:26.0901 0x05b4 [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv C:\Windows\System32\swprv.dll
14:11:26.0963 0x05b4 swprv - ok
14:11:27.0041 0x05b4 [ 36650D618CA34C9D357DFD3D89B2C56F, 7C3774E53DCF32CB3A4B3504E32D2A651E18467FA0A6AC4C7993C696741B704B ] SysMain C:\Windows\system32\sysmain.dll
14:11:27.0135 0x05b4 SysMain - ok
14:11:27.0166 0x05b4 [ 763FECDC3D30C815FE72DD57936C6CD1, 1A62C7E63E426D56894F4121C75D9C60FC9A14469ADBD0D6F0B94B8DE48CDA3E ] TabletInputService C:\Windows\System32\TabSvc.dll
14:11:27.0213 0x05b4 TabletInputService - ok
14:11:27.0245 0x05b4 [ 613BF4820361543956909043A265C6AC, FCFF02E466D2501630B452627FB218C01E5245A0921EE3D2117E7FD63AC7E98E ] TapiSrv C:\Windows\System32\tapisrv.dll
14:11:27.0307 0x05b4 TapiSrv - ok
14:11:27.0338 0x05b4 [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS C:\Windows\System32\tbssvc.dll
14:11:27.0401 0x05b4 TBS - ok
14:11:27.0463 0x05b4 [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
14:11:27.0557 0x05b4 Tcpip - ok
14:11:27.0635 0x05b4 [ 5579DD18546999F5D0EC39D018726C6B, 82432BACEE75C34F21222D9CC1607223C2940947118A63DB239777A4B1442AD3 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
14:11:27.0713 0x05b4 TCPIP6 - ok
14:11:27.0745 0x05b4 [ CCA24162E055C3714CE5A88B100C64ED, 9B7712E793B9478BA7A1EF71EA9CC03CCB9C4004C54EAA911F158958519EDCD9 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
14:11:27.0807 0x05b4 tcpipreg - ok
14:11:27.0838 0x05b4 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2, 879E2827354BB21573AC6A7CCEB746D44214540687E6882FFCB4089546FBD954 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
14:11:27.0885 0x05b4 TDPIPE - ok
14:11:27.0901 0x05b4 [ 2C2C5AFE7EE4F620D69C23C0617651A8, E828D974C3F9D7004A030C3AD448096C736FDB4C4C1707D043E567D08C845103 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
14:11:27.0932 0x05b4 TDTCP - ok
14:11:27.0948 0x05b4 [ B459575348C20E8121D6039DA063C704, 1B4328A9EA39FF5A57F258E02254D04B73455F1DF7C997C13702A8B2F12D0347 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
14:11:28.0010 0x05b4 tdx - ok
14:11:28.0026 0x05b4 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20, 0D81B427720637882077C5024D738191F858FC734ED040697872D906351EF663 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
14:11:28.0057 0x05b4 TermDD - ok
14:11:28.0104 0x05b4 [ FCFD4F50419B4BC72E80066DA10D2E54, 7C2314A57A404525F0444986332DBAE0964A3359374671598387051D7AAE72AE ] TermService C:\Windows\System32\termsrv.dll
14:11:28.0166 0x05b4 TermService - ok
14:11:28.0182 0x05b4 [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes C:\Windows\system32\themeservice.dll
14:11:28.0245 0x05b4 Themes - ok
14:11:28.0260 0x05b4 [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER C:\Windows\system32\mmcss.dll
14:11:28.0338 0x05b4 THREADORDER - ok
14:11:28.0354 0x05b4 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks C:\Windows\System32\trkwks.dll
14:11:28.0432 0x05b4 TrkWks - ok
14:11:28.0448 0x05b4 [ 2C49B175AEE1D4364B91B531417FE583, 6C7995E18F84E465C376D1D5F153C15ACB66CDEA86EE5BF186677F572E7E129B ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:11:28.0510 0x05b4 TrustedInstaller - ok
14:11:28.0541 0x05b4 [ 6C5139E4283249518F7743D7043775B3, 58684E8C90EBAC65459A97C905CDCFE3A915CFF7E8E96071DE1AC3489F85E67F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
14:11:28.0588 0x05b4 tssecsrv - ok
14:11:28.0604 0x05b4 [ FD1D6C73E6333BE727CBCC6054247654, 6F7B9AE1A5986204DB3348D13B303F30FC17624939DA74D6BD114FAEED0FB30E ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
14:11:28.0651 0x05b4 TsUsbFlt - ok
14:11:28.0666 0x05b4 [ 01246F0BAAD7B68EC0F472AA41E33282, 51F975AF029AD015576FFFA3E88F5DBB8B40C7CD30ECDEDE8AFABCB08C954199 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
14:11:28.0698 0x05b4 TsUsbGD - ok
14:11:28.0729 0x05b4 [ B2FA25D9B17A68BB93D58B0556E8C90D, 0146931B733CAB1CD87F94C35F97E110D6ED6C55EAFF03345400A29AEDE99BDE ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
14:11:28.0776 0x05b4 tunnel - ok
14:11:28.0807 0x05b4 [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
14:11:28.0823 0x05b4 uagp35 - ok
14:11:28.0854 0x05b4 [ EE43346C7E4B5E63E54F927BABBB32FF, BAD6FC3BEE45E644D5A6A0A31428F5B2AEC72A0AA0C74EF8177B1FE23EEF3AA9 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
14:11:28.0916 0x05b4 udfs - ok
14:11:28.0963 0x05b4 [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect C:\Windows\system32\UI0Detect.exe
14:11:28.0995 0x05b4 UI0Detect - ok
14:11:29.0010 0x05b4 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
14:11:29.0057 0x05b4 uliagpkx - ok
14:11:29.0073 0x05b4 [ D295BED4B898F0FD999FCFA9B32B071B, D4130DB4AE76EE6DC0B8E7A4FEF5CB8B26EBD822C21021F6FA78FD29C1E211C2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
14:11:29.0104 0x05b4 umbus - ok
14:11:29.0135 0x05b4 [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass C:\Windows\system32\drivers\umpass.sys
14:11:29.0166 0x05b4 UmPass - ok
14:11:29.0182 0x05b4 [ 409994A8EACEEE4E328749C0353527A0, FFC57B647147DE2957A7DE4B330CC534DE7AC892A2FCE3BB164F7A516CAB1B56 ] UmRdpService C:\Windows\System32\umrdp.dll
14:11:29.0229 0x05b4 UmRdpService - ok
14:11:29.0276 0x05b4 [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost C:\Windows\System32\upnphost.dll
14:11:29.0354 0x05b4 upnphost - ok
14:11:29.0385 0x05b4 [ 0803FBA9FE829D61AE26EC0BCC910C46, 30D00E2C7DFC630C99C1599587D4F9C272BC30D444E07C961AA05BF84587806B ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
14:11:29.0416 0x05b4 usbccgp - ok
14:11:29.0432 0x05b4 [ 2352AB5F9F8F097BF9D41D5A4718A041, 25BC7828C625B9B2A5110C25B230C5828CEC18EC97ECF9EC4745E8930CBF472C ] usbcir C:\Windows\system32\drivers\usbcir.sys
14:11:29.0479 0x05b4 usbcir - ok
14:11:29.0510 0x05b4 [ D40855F89B69305140BBD7E9A3BA2DA6, 745DC6D770666F6B19C2B6AA89C21D1A314732E291453BFA2367F9AF86F97C3C ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
14:11:29.0541 0x05b4 usbehci - ok
14:11:29.0573 0x05b4 [ EDF2DF71C4F1E13A6AC75F5224DE655A, 1764D155C6B99201774B57195349304259232A12868ECFC2069CA49443EBDC2C ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
14:11:29.0635 0x05b4 usbhub - ok
14:11:29.0651 0x05b4 [ 9828C8D14CC2676421778F0DE638CF97, 479A28211FFB85190A01FAB0283B927588805D2C0CDB03F85F8F814B88E4F453 ] usbohci C:\Windows\system32\drivers\usbohci.sys
14:11:29.0682 0x05b4 usbohci - ok
14:11:29.0698 0x05b4 [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
14:11:29.0745 0x05b4 usbprint - ok
14:11:29.0760 0x05b4 [ FC6B21DB4B5B398AB93DBE59CBF11036, A94094C208F376405C07822A6143001EF1B12AE93205CD8002E87F6EB45F6374 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
14:11:29.0791 0x05b4 usbscan - ok
14:11:29.0823 0x05b4 [ BF63EBFC6979FEFB2BC03DF7989A0C1A, AFEF764A3E5D52CDBB5074F0E87F2B5EBCDF8D9B6E8F88EE235602B80145BE31 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:11:29.0870 0x05b4 USBSTOR - ok
14:11:29.0885 0x05b4 [ 800AABFD625EEFF899F7E5496BDE37AB, 3EB7ED07760CB348FCA9A06C2B838EF79B51A83C5F70A9C9EAAEAE54480067E2 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
14:11:29.0916 0x05b4 usbuhci - ok
14:11:29.0948 0x05b4 [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms C:\Windows\System32\uxsms.dll
14:11:30.0010 0x05b4 UxSms - ok
14:11:30.0026 0x05b4 [ 618BA9298726844DA4E9E53C7C8D4015, BCDA8D829E0D40DA8E30832D6A53A2B9882655E5B024E4171BA9732456549B3E ] VaultSvc C:\Windows\system32\lsass.exe
14:11:30.0057 0x05b4 VaultSvc - ok
14:11:30.0088 0x05b4 [ EA9ADB96A31020D4D3E5167FE31427DE, 5635513F58CF89AF87B7A5CE570B348A932C5C74D3FBAF575D708198B174D641 ] VBoxAswDrv C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys
14:11:30.0213 0x05b4 VBoxAswDrv - ok
14:11:30.0229 0x05b4 [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
14:11:30.0260 0x05b4 vdrvroot - ok
14:11:30.0307 0x05b4 [ C3CD30495687C2A2F66A65CA6FD89BE9, 582E4706C1D6A151020D14B26C7BF166F4E42BDD6E410F30EC452469270C5E9B ] vds C:\Windows\System32\vds.exe
14:11:30.0385 0x05b4 vds - ok
14:11:30.0416 0x05b4 [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
14:11:30.0448 0x05b4 vga - ok
14:11:30.0463 0x05b4 [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave C:\Windows\System32\drivers\vga.sys
14:11:30.0526 0x05b4 VgaSave - ok
14:11:30.0541 0x05b4 [ 5461686CCA2FDA57B024547733AB42E3, 2721D0659AA890172FCAD4EC4D926B58ACD0EE4887DA51545DC7237420D5BF84 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
14:11:30.0573 0x05b4 vhdmp - ok
14:11:30.0604 0x05b4 [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp C:\Windows\system32\drivers\viaagp.sys
14:11:30.0635 0x05b4 viaagp - ok
14:11:30.0651 0x05b4 [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7 C:\Windows\system32\drivers\viac7.sys
14:11:30.0760 0x05b4 ViaC7 - ok
14:11:30.0776 0x05b4 [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide C:\Windows\system32\drivers\viaide.sys
14:11:30.0791 0x05b4 viaide - ok
14:11:30.0823 0x05b4 [ C2F2911156FDC7817C52829C86DA494E, FE499F189B5016FCE0018AA3DE3970B72275B7B15F3D4D608117F6DDEC6B90DC ] vmbus C:\Windows\system32\drivers\vmbus.sys
14:11:30.0885 0x05b4 vmbus - ok
14:11:30.0901 0x05b4 [ D4D77455211E204F370D08F4963063CE, 2018B2A84C73E0834200A594C02A9D28C74906F126DAD3CCDDFC9CD9A61669E2 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
14:11:30.0932 0x05b4 VMBusHID - ok
14:11:30.0963 0x05b4 [ 4C63E00F2F4B5F86AB48A58CD990F212, 9796BD4B9CFEEEAF57C5E332A732EFC2770B21F9B35301A5D202F5FC52C1E035 ] volmgr C:\Windows\system32\drivers\volmgr.sys
14:11:30.0995 0x05b4 volmgr - ok
14:11:31.0026 0x05b4 [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
14:11:31.0073 0x05b4 volmgrx - ok
14:11:31.0104 0x05b4 [ F497F67932C6FA693D7DE2780631CFE7, DAE544ED99D2CF570DA31343BD87D2F856D0D13529656D38E1BF854C77F017F6 ] volsnap C:\Windows\system32\drivers\volsnap.sys
14:11:31.0135 0x05b4 volsnap - ok
14:11:31.0166 0x05b4 [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
14:11:31.0198 0x05b4 vsmraid - ok
14:11:31.0260 0x05b4 [ 209A3B1901B83AEB8527ED211CCE9E4C, 1A431F6409F8E0531F600F8F988ECECECB902DA26BBAAF1DE74A5CAC29A7CB44 ] VSS C:\Windows\system32\vssvc.exe
14:11:31.0401 0x05b4 VSS - ok
14:11:31.0416 0x05b4 [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
14:11:31.0463 0x05b4 vwifibus - ok
14:11:31.0495 0x05b4 [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time C:\Windows\system32\w32time.dll
14:11:31.0573 0x05b4 W32Time - ok
14:11:31.0604 0x05b4 [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
14:11:31.0651 0x05b4 WacomPen - ok
14:11:31.0666 0x05b4 [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
14:11:31.0713 0x05b4 WANARP - ok
14:11:31.0729 0x05b4 [ 3C3C78515F5AB448B022BDF5B8FFDD2E, 35284174A42039C3C1FF8A3C8BC187A5E067C7782FC62D19749C2CB28C4E36C7 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
14:11:31.0791 0x05b4 Wanarpv6 - ok
14:11:31.0854 0x05b4 [ 691E3285E53DCA558E1A84667F13E15A, 12EDB66EF8FC100402BEA221F354D3BD5542F6DDF715B6E7D873D6BAE7E3D329 ] wbengine C:\Windows\system32\wbengine.exe
14:11:31.0948 0x05b4 wbengine - ok
14:11:31.0979 0x05b4 [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
14:11:32.0026 0x05b4 WbioSrvc - ok
14:11:32.0057 0x05b4 [ 34EEE0DFAADB4F691D6D5308A51315DC, A040A03E25A0C78B9E26F86C2DF95BCAF8E7EC90183CEB295615D3265350EBEE ] wcncsvc C:\Windows\System32\wcncsvc.dll
14:11:32.0104 0x05b4 wcncsvc - ok
14:11:32.0135 0x05b4 [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:11:32.0182 0x05b4 WcsPlugInService - ok
14:11:32.0182 0x05b4 [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd C:\Windows\system32\drivers\wd.sys
14:11:32.0213 0x05b4 Wd - ok
14:11:32.0260 0x05b4 [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
14:11:32.0307 0x05b4 Wdf01000 - ok
14:11:32.0338 0x05b4 [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiServiceHost C:\Windows\system32\wdi.dll
14:11:32.0401 0x05b4 WdiServiceHost - ok
14:11:32.0416 0x05b4 [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiSystemHost C:\Windows\system32\wdi.dll
14:11:32.0526 0x05b4 WdiSystemHost - ok
14:11:32.0541 0x05b4 [ A9D880F97530D5B8FEE278923349929D, 6A293E2DB9B7C434EA8B4CD4861E11905D46BD60E014AE27B74DC8C4B2DDF834 ] WebClient C:\Windows\System32\webclnt.dll
14:11:32.0635 0x05b4 WebClient - ok
14:11:32.0666 0x05b4 [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc C:\Windows\system32\wecsvc.dll
14:11:32.0745 0x05b4 Wecsvc - ok
14:11:32.0776 0x05b4 [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport C:\Windows\System32\wercplsupport.dll
14:11:32.0885 0x05b4 wercplsupport - ok
14:11:32.0901 0x05b4 [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc C:\Windows\System32\WerSvc.dll
14:11:32.0963 0x05b4 WerSvc - ok
14:11:32.0979 0x05b4 [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
14:11:33.0041 0x05b4 WfpLwf - ok
14:11:33.0057 0x05b4 [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount C:\Windows\system32\drivers\wimmount.sys
14:11:33.0104 0x05b4 WIMMount - ok
14:11:33.0151 0x05b4 [ 082CF481F659FAE0DE51AD060881EB47, BB67D2AF0BB9192D4CCF66C23D80CE5A1B38715556D94E2561DBF8F805FA30A5 ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
14:11:33.0213 0x05b4 WinDefend - ok
14:11:33.0245 0x05b4 WinHttpAutoProxySvc - ok
14:11:33.0276 0x05b4 [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
14:11:33.0323 0x05b4 Winmgmt - ok
14:11:33.0401 0x05b4 [ 1B91CD34EA3A90AB6A4EF0550174F4CC, 5B6618615EBFBA594C945AD35F5C68DA8C6053892B6D12D626BB6120910D80DC ] WinRM C:\Windows\system32\WsmSvc.dll
14:11:33.0510 0x05b4 WinRM - ok
14:11:33.0557 0x05b4 [ A67E5F9A400F3BD1BE3D80613B45F708, E170A8BD31A779403DC9C43ED6483DA8E186512D3EE700B87F6BA292E284E367 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
14:11:33.0588 0x05b4 WinUsb - ok
14:11:33.0651 0x05b4 [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc C:\Windows\System32\wlansvc.dll
14:11:33.0745 0x05b4 Wlansvc - ok
14:11:33.0760 0x05b4 [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
14:11:33.0791 0x05b4 WmiAcpi - ok
14:11:33.0838 0x05b4 [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
14:11:33.0870 0x05b4 wmiApSrv - ok
14:11:33.0932 0x05b4 [ 3B40D3A61AA8C21B88AE57C58AB3122E, 6C67DCB007C3CDF2EB0BBF5FD89C32CD7800C20F7166872F8C387BE262C5CD21 ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
14:11:34.0026 0x05b4 WMPNetworkSvc - ok
14:11:34.0041 0x05b4 [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc C:\Windows\System32\wpcsvc.dll
14:11:34.0135 0x05b4 WPCSvc - ok
14:11:34.0151 0x05b4 [ AA53356D60AF47EACC85BC617A4F3F66, 155CB8112AA382D841C1891750FF29EF4F1BF716CD9CDF0F2243209E2CCCAC98 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
14:11:34.0198 0x05b4 WPDBusEnum - ok
14:11:34.0213 0x05b4 [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
14:11:34.0276 0x05b4 ws2ifsl - ok
14:11:34.0291 0x05b4 [ 6F5D49EFE0E7164E03AE773A3FE25340, 15B6AFF7455538189A96F8863CC995A271E02C6FBDAC15B037D44DDA65E61339 ] wscsvc C:\Windows\System32\wscsvc.dll
14:11:34.0338 0x05b4 wscsvc - ok
14:11:34.0354 0x05b4 WSearch - ok
14:11:34.0479 0x05b4 [ 7E5C454A3F986FEBAD075DB8D915917E, 9E9147DDACD075958689523130DB92FC4ED0E38433461D8AB8792BCFBD9376DA ] wuauserv C:\Windows\system32\wuaueng.dll
14:11:34.0666 0x05b4 wuauserv - ok
14:11:34.0698 0x05b4 [ E714A1C0354636837E20CCBF00888EE7, 0E31F0DB0AA318E3B0DACD26C0D3B11519B42F2A996AE580BE67FA8B3C42C436 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
14:11:34.0745 0x05b4 WudfPf - ok
14:11:34.0776 0x05b4 [ 1023EE888C9B47178C5293ED5336AB69, 62221C80C3F719A585266247482A64F7CB2F5EF69AFA8FA07D563CA2B0A37561 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
14:11:34.0838 0x05b4 WUDFRd - ok
14:11:34.0854 0x05b4 [ 8D1E1E529A2C9E9B6A85B55A345F7629, 64B637CFE2AF58A4F7CE6D8C3D603F8EFD527500F7137E0A37840313C712CA93 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
14:11:34.0916 0x05b4 wudfsvc - ok
14:11:34.0932 0x05b4 [ FF2D745B560F7C71B31F30F4D49F73D2, B2FBF7E5F58E34AC64FE6CF65800F1F07939279203BDE89375FAC92B884A4F37 ] WwanSvc C:\Windows\System32\wwansvc.dll
14:11:34.0995 0x05b4 WwanSvc - ok
14:11:35.0026 0x05b4 ================ Scan global ===============================
14:11:35.0041 0x05b4 [ DAB748AE0439955ED2FA22357533DDDB, 73EDD402C7479DDCE1998D0C7E99E1EC2974F64EFC33A851439CC85D09EDCDF9 ] C:\Windows\system32\basesrv.dll
14:11:35.0073 0x05b4 [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
14:11:35.0104 0x05b4 [ 51BB04243DF6196C06E125898127E397, E1B6C83FC6E455F6806185027C5B56F8BA9ECDF1CD69E97301EC0291F0D3466E ] C:\Windows\system32\winsrv.dll
14:11:35.0135 0x05b4 [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
14:11:35.0166 0x05b4 [ 0780A42DBD7D9969F9BF4A19AA4285B5, 8EA41124A4E97732C5DAA616457FBA7111CB38986F3427FA776ED00BC1407171 ] C:\Windows\system32\services.exe
14:11:35.0198 0x05b4 [ Global ] - ok
14:11:35.0198 0x05b4 ================ Scan MBR ==================================
14:11:35.0213 0x05b4 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
14:11:35.0354 0x05b4 \Device\Harddisk0\DR0 - ok
14:11:35.0354 0x05b4 ================ Scan VBR ==================================
14:11:35.0354 0x05b4 [ 0DF480920CF0D389DFBD0009DE12BE93 ] \Device\Harddisk0\DR0\Partition1
14:11:35.0370 0x05b4 \Device\Harddisk0\DR0\Partition1 - ok
14:11:35.0370 0x05b4 [ BAF5FE09BCFEA917BDBC2EC72FB1E8E9 ] \Device\Harddisk0\DR0\Partition2
14:11:35.0370 0x05b4 \Device\Harddisk0\DR0\Partition2 - ok
14:11:35.0385 0x05b4 ================ Scan generic autorun ======================
14:11:35.0432 0x05b4 [ 048EA4B978851788E9F5E8E4F081DF7A, EB62719AC0DCC18FF056F2CD84438BF14B61E38F0619617C81961C6257BDFCEC ] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
14:11:35.0495 0x05b4 Adobe ARM - ok
14:11:35.0510 0x05b4 [ C419DF63E0121D72411285780C2FC6CC, F47F854D327C589D174D3BB5B55D5C05F5ACA73DF52A6BEF47596B9010190291 ] C:\Windows\UpdReg.EXE
14:11:35.0526 0x05b4 UpdReg - detected UnsignedFile.Multi.Generic ( 1 )
14:11:38.0307 0x05b4 Detect skipped due to KSN trusted
14:11:38.0307 0x05b4 UpdReg - ok
14:11:38.0323 0x05b4 [ 8EB2419F6228651874B99A338696A77D, B25DDAC49E59F6848D5F7357F54A48FF5522757ED99523ECE4A109DCAC5707DA ] C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
14:11:38.0338 0x05b4 diagent - detected UnsignedFile.Multi.Generic ( 1 )
14:11:41.0041 0x05b4 Detect skipped due to KSN trusted
14:11:41.0041 0x05b4 diagent - ok
14:11:41.0104 0x05b4 [ 4D5D968FE6AE6BF94A807F73F7FF6B3D, 3D5D5D775EE251C2B903AA8DA804AE4D1632DD59A8A0A36C545FE984FCFE06DD ] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
14:11:41.0182 0x05b4 BrMfcWnd - detected UnsignedFile.Multi.Generic ( 1 )
14:11:43.0963 0x05b4 Detect skipped due to KSN trusted
14:11:43.0963 0x05b4 BrMfcWnd - ok
14:11:43.0979 0x05b4 [ 4DE3EF07E0854547309C6B40235A9D44, F73D8E6D98583865D1C8DB728058D83C72A3908E21E04EF313FCB829C040A1EC ] C:\Program Files\Brother\ControlCenter3\brctrcen.exe
14:11:43.0995 0x05b4 ControlCenter3 - detected UnsignedFile.Multi.Generic ( 1 )
14:11:46.0729 0x05b4 Detect skipped due to KSN trusted
14:11:46.0729 0x05b4 ControlCenter3 - ok
14:11:46.0963 0x05b4 [ 06964B7DE858BB6317164BF184E9C766, ADE3D2A7256A8F3F11B6E35979413850EB22B9BBADCE3EC73BE04A1622512126 ] C:\Program Files\AVAST Software\Avast\AvastUI.exe
14:11:47.0198 0x05b4 AvastUI.exe - ok
14:11:47.0276 0x05b4 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files\Windows Sidebar\Sidebar.exe
14:11:47.0370 0x05b4 Sidebar - ok
14:11:47.0385 0x05b4 [ BBA1A5B86134F496B926DDAF247DB871, 636990AE49C55189B7EF69C419787440B57EC0BAD98A9C280E1028F741BB222E ] C:\Windows\System32\mctadmin.exe
14:11:47.0416 0x05b4 mctadmin - ok
14:11:47.0479 0x05b4 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files\Windows Sidebar\Sidebar.exe
14:11:47.0557 0x05b4 Sidebar - ok
14:11:47.0573 0x05b4 [ BBA1A5B86134F496B926DDAF247DB871, 636990AE49C55189B7EF69C419787440B57EC0BAD98A9C280E1028F741BB222E ] C:\Windows\System32\mctadmin.exe
14:11:47.0620 0x05b4 mctadmin - ok
14:11:47.0901 0x05b4 [ 1F014EA12ECB13C909DA9395E9CD3D18, FA4E7090E3778A954AB82B304B9E3711F35E30E5DE7B9020F4E820B6E3B1CF85 ] C:\Program Files\CCleaner\CCleaner.exe
14:11:48.0151 0x05b4 CCleaner Monitoring - ok
14:11:48.0182 0x05b4 Waiting for KSN requests completion. In queue: 6
14:11:49.0182 0x05b4 Waiting for KSN requests completion. In queue: 6
14:11:50.0182 0x05b4 Waiting for KSN requests completion. In queue: 6
14:11:51.0213 0x05b4 AV detected via SS2: avast! Antivirus, C:\Program Files\AVAST Software\Avast\VisthAux.exe ( 10.2.2215.880 ), 0x41000 ( enabled : updated )
14:11:51.0229 0x05b4 Win FW state via NFP2: enabled
14:11:53.0948 0x05b4 ============================================================
14:11:53.0948 0x05b4 Scan finished
14:11:53.0948 0x05b4 ============================================================
14:11:53.0963 0x0bac Detected object count: 0
14:11:53.0963 0x0bac Actual detected object count: 0
|
|
21.05.2015, 07:52
| #4 |
| /// the machine /// TB-Ausbilder | Browser extrem langsam hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.05.2015, 12:15
| #5 |
| | Browser extrem langsam Combofix Code:
ATTFilter ComboFix 15-05-19.01 - Worthmann 21.05.2015 8:59.1.1 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.1023.333 [GMT 2:00]
ausgeführt von:: c:\users\Worthmann\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-04-21 bis 2015-05-21 ))))))))))))))))))))))))))))))
.
.
2015-05-21 07:11 . 2015-05-21 07:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-05-20 11:55 . 2015-05-20 11:55 -------- d-----w- c:\programdata\Malwarebytes
2015-05-20 11:54 . 2015-05-20 12:07 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-05-20 11:54 . 2015-05-20 11:54 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-05-20 11:53 . 2015-05-20 11:53 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-05-19 19:58 . 2015-05-19 20:00 -------- d-----w- C:\FRST
2015-05-19 10:59 . 2015-05-03 03:42 9265072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CFA80B87-5FDE-4C04-80F4-0AD0C9E33DED}\mpengine.dll
2015-05-18 13:17 . 2015-05-18 13:23 -------- d-----w- c:\program files\FreePDF_XP
2015-05-18 13:17 . 2015-05-18 13:22 -------- d-----w- c:\programdata\FreePDF
2015-05-18 13:16 . 2015-05-18 13:16 -------- d-----w- c:\program files\gs
2015-05-18 13:02 . 2015-05-18 13:05 -------- d-----w- c:\users\Worthmann\AppData\Roaming\PDF Architect 3
2015-05-18 12:57 . 2015-05-18 13:14 -------- d-----w- c:\programdata\PDF Architect 3
2015-05-18 12:57 . 2015-05-18 13:15 -------- d-----w- c:\program files\PDFCreator
2015-05-18 12:52 . 2015-05-18 12:52 -------- d-----w- c:\program files\Microsoft.NET
2015-05-18 12:48 . 2015-05-18 12:48 -------- d-----w- c:\users\Worthmann\AppData\Local\Programs
2015-05-17 18:35 . 2015-05-17 18:51 -------- d-----w- c:\users\Worthmann\AppData\Roaming\Ableton
2015-05-17 18:35 . 2015-05-17 18:35 -------- d-----w- c:\program files\Common Files\Propellerhead Software
2015-05-17 18:32 . 2015-05-17 19:39 -------- d-----w- c:\programdata\Ableton
2015-05-13 22:50 . 2015-05-01 13:16 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:52 . 2015-05-13 08:52 -------- d-----w- c:\program files\CCleaner
2015-05-10 19:13 . 2015-05-12 16:51 -------- d-----w- c:\users\Worthmann\AppData\Roaming\vlc
2015-05-10 19:11 . 2015-05-10 19:11 -------- d-----w- c:\program files\VideoLAN
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-17 08:50 . 2013-06-24 10:29 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-04-17 08:50 . 2013-06-24 10:29 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-03-30 20:51 . 2014-08-07 17:30 24144 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-03-30 20:51 . 2014-04-13 11:54 106912 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-03-30 20:51 . 2013-06-20 11:48 81728 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-03-30 20:51 . 2013-06-20 11:48 427736 ----a-w- c:\windows\system32\drivers\aswSP.sys
2015-03-30 20:51 . 2013-06-20 11:48 49904 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-03-30 20:51 . 2013-06-20 11:48 208024 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-03-30 20:51 . 2013-06-20 11:48 73440 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-03-30 20:51 . 2015-03-30 20:51 291312 ----a-w- c:\windows\system32\aswBoot.exe
2015-03-30 20:51 . 2015-03-30 20:51 43112 ----a-w- c:\windows\avastSS.scr
2015-03-30 20:51 . 2013-06-20 11:48 788272 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2015-03-25 03:00 . 2015-04-17 08:21 92672 ----a-w- c:\windows\system32\wudriver.dll
2015-03-25 03:00 . 2015-04-17 08:21 566784 ----a-w- c:\windows\system32\wuapi.dll
2015-03-25 03:00 . 2015-04-17 08:21 35328 ----a-w- c:\windows\system32\wups2.dll
2015-03-25 03:00 . 2015-04-17 08:21 3088384 ----a-w- c:\windows\system32\wucltux.dll
2015-03-25 03:00 . 2015-04-17 08:21 29696 ----a-w- c:\windows\system32\wups.dll
2015-03-25 03:00 . 2015-04-17 08:21 173056 ----a-w- c:\windows\system32\wuwebv.dll
2015-03-25 03:00 . 2015-04-17 08:21 2020864 ----a-w- c:\windows\system32\wuaueng.dll
2015-03-25 03:00 . 2015-04-17 08:21 50176 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-03-25 03:00 . 2015-04-17 08:21 11776 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:00 . 2015-04-17 08:21 33792 ----a-w- c:\windows\system32\wuapp.exe
2015-03-25 03:00 . 2015-04-17 08:21 131584 ----a-w- c:\windows\system32\wuauclt.exe
2015-03-17 05:01 . 2015-04-17 08:23 3920824 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-03-17 05:01 . 2015-04-17 08:23 3976632 ----a-w- c:\windows\system32\ntkrnlpa.exe
2015-03-17 04:59 . 2015-04-17 08:23 1306112 ----a-w- c:\windows\system32\ntdll.dll
2015-03-17 04:57 . 2015-04-17 08:23 400896 ----a-w- c:\windows\system32\srcore.dll
2015-03-17 04:57 . 2015-04-17 08:23 43008 ----a-w- c:\windows\system32\srclient.dll
2015-03-17 04:56 . 2015-04-17 08:23 38912 ----a-w- c:\windows\system32\csrsrv.dll
2015-03-17 04:56 . 2015-04-17 08:23 69632 ----a-w- c:\windows\system32\smss.exe
2015-03-17 04:56 . 2015-04-17 08:23 262656 ----a-w- c:\windows\system32\rstrui.exe
2015-03-17 04:50 . 2015-04-17 08:23 6656 ----a-w- c:\windows\system32\apisetschema.dll
2015-03-10 03:08 . 2015-04-17 08:21 1237504 ----a-w- c:\windows\system32\msxml3.dll
2015-03-10 03:05 . 2015-04-17 08:21 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-03-05 04:06 . 2015-04-17 08:23 305152 ----a-w- c:\windows\system32\gdi32.dll
2015-03-04 04:16 . 2015-04-17 08:23 249784 ----a-w- c:\windows\system32\clfs.sys
2015-03-04 04:10 . 2015-04-17 08:23 58880 ----a-w- c:\windows\system32\clfsw32.dll
2015-02-25 03:03 . 2015-04-17 08:21 514560 ----a-w- c:\windows\system32\drivers\http.sys
2015-02-24 02:23 . 2013-06-20 12:17 246920 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-03-30 20:51 644608 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2015-04-23 6278424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-02 135264]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-03-30 5512912]
.
c:\users\Worthmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2015-03-30 106912]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-04-21 102912]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2015-03-30 788272]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2015-03-30 427736]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2015-03-30 24144]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2015-03-30 73440]
S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-03-30 220240]
S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-03-30 3205216]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-05-15 16:50 988488 ----a-w- c:\program files\Google\Chrome\Application\42.0.2311.152\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-05-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-24 08:50]
.
2015-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-08-08 21:22]
.
2015-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-08-08 21:22]
.
.
------- Zusätzlicher Suchlauf -------
.
TCP: DhcpNameServer = 83.169.185.161 83.169.185.225
FF - ProfilePath - c:\users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\
FF - prefs.js: browser.search.defaulturl - hxxps://www.google.com/search/?trackid=sp-006
FF - prefs.js: browser.search.selectedEngine - Google (avast)
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/?trackid=sp-006
FF - prefs.js: keyword.URL - hxxps://www.google.com/search/?trackid=sp-006
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-05-21 09:14:43
ComboFix-quarantined-files.txt 2015-05-21 07:14
.
Vor Suchlauf: 7 Verzeichnis(se), 69.338.935.296 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 69.384.855.552 Bytes frei
.
- - End Of File - - 4A5516F3DD6CDDBA6CA2A4C81BA0A1FF
A36C5E4F47E84449FF07ED3517B43A31
|
|
22.05.2015, 06:54
| #6 |
| /// the machine /// TB-Ausbilder | Browser extrem langsam Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Browser extrem langsam |
|
25.05.2015, 20:02
| #7 |
| | Browser extrem langsam mbam Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 25.05.2015 Suchlauf-Zeit: 20:09:23 Logdatei: mbam.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.25.05 Rootkit Datenbank: v2015.05.24.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Worthmann Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 309921 Verstrichene Zeit: 10 Min, 1 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 1 PUP.Optional.MindSpark.A, C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\Allin1Convert_8h, In Quarantäne, [f0e9494ef79313239e4532abd62d9c64], Dateien: 3 PUP.Optional.MindSpark.A, C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\Allin1Convert_8h\575ED2C0-E9E1-4D49-8BCC-940BFA4390F4.sqlite, In Quarantäne, [f0e9494ef79313239e4532abd62d9c64], PUP.Optional.Mindspark.A, C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\searchplugins\ask-web-search.xml, In Quarantäne, [1abf5443b9d1e74f49f0a56fd430a858], PUP.Optional.ASK.A, C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.homepage.tb", "hxxp://home.tb.ask.com/index.jhtml?ptb=575ED2C0-E9E1-4D49-8BCC-940BFA4390F4&n=781af583&p2=^AYY^xdm070^LADEDE^de&si=flvrunner");), Ersetzt,[52878512f59539fd495680eba1652cd4] Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.205 - Bericht erstellt 25/05/2015 um 20:31:02
# Aktualisiert 21/05/2015 von Xplode
# Datenbank : 2015-05-25.3 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x86)
# Benutzername : Worthmann - WORTHMANN-PC
# Gestarted von : C:\Users\Worthmann\Desktop\AdwCleaner_4.205.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Worthmann\AppData\Roaming\Company Name
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.1 (x86 de)
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.prev", "Google");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.savedPrev", "true");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.defaultenginename.tb", "Ask Web Search");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.prev", "Google");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.savedPrev", "true");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.search.selectedEngine.tb", "Ask Web Search");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.homepage.savedPrev", "true");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.homepage.tb", "hxxp://home.tb.ask.com/index.jhtml?ptb=575ED2C0-E9E1-4D49-8BCC-940BFA4390F4&n=781af583&p2=^AYY^xdm070^LADEDE^de&si=fl[...]
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.page.savedPrev", 1);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.startup.page.tb", 1);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.browser.version.last", "36.0");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.firstKnownVersion", "6.85.6.1415");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.homepage", "hxxp://home.tb.ask.com/index.jhtml?ptb=575ED2C0-E9E1-4D49-8BCC-940BFA4390F4&n=781af583&p2=^AYY^xdm070^LADEDE^de&si=flvrunner");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.hp.enabled", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.hp.guardType", "HPR");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.hp.user.defined", false);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.initialized", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installKeysSource", "LocalStorage");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installType", "XPI");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.contextKey", "");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.installDate", "2015032707");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerId", "^AYY^xdm070^LADEDE^de");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.partnerSubId", "flvrunner");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.pixelUrl", "hxxp://download.allin1convert.com/install_pixels.jhtml?partner=^AYY^xdm070^LADEDE^de&sub_id=flvrunner&coId=1605a6f0ed354caa[...]
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.success", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.installation.toolbarId", "575ED2C0-E9E1-4D49-8BCC-940BFA4390F4");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.isCompliantUninstallImplementation", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastActivePing", "1427749885945");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.lastKnownVersion", "6.85.6.1415");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.defaultSearch", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.homePageEnabled", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.keywordEnabled", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.options.tabEnabled", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.partnerPixelFired", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.searchHistory", "firefox");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.successUrl", "hxxp://flvrunner.com/thankyou.php");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.toolbar.ownSearch", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.toolbarCollapsed", false);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark._8hMembers_.weather.location", "10001");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "allin1convert@mindspark.com");
[ppthaokc.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com");
-\\ Google Chrome v43.0.2357.65
*************************
AdwCleaner[R0].txt - [6733 Bytes] - [25/05/2015 20:27:32]
AdwCleaner[S0].txt - [7040 Bytes] - [25/05/2015 20:31:02]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7099 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.7.9 (05.24.2015:1)
OS: Windows 7 Professional x86
Ran by Worthmann on 25.05.2015 at 20:38:13,19
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Worthmann\AppData\Roaming\mozilla\firefox\profiles\ppthaokc.default\minidumps [152 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.05.2015 at 20:43:11,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-05-2015
Ran by Worthmann (administrator) on WORTHMANN-PC on 25-05-2015 20:48:35
Running from C:\Users\Worthmann\Desktop
Loaded Profiles: Worthmann (Available Profiles: Worthmann)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM\...\Run: [diagent] => C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe [135264 2002-04-03] (Creative Technology Ltd)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-03-30] (Avast Software s.r.o.)
HKLM\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\79ff0dba-e2bb-49b9-b76e-76cd8537d32a.exe [183232 2015-05-25] (AVAST Software)
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6278424 2015-04-23] (Piriform Ltd)
Startup: C:\Users\Worthmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2013-06-28]
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-03-30] (Avast Software s.r.o.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-03-30] (Avast Software s.r.o.)
Tcpip\Parameters: [DhcpNameServer] 83.169.185.161 83.169.185.225
FireFox:
========
FF ProfilePath: C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default
FF DefaultSearchEngine: Google (avast)
FF DefaultSearchUrl: https://www.google.com/search/?trackid=sp-006
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: Google (avast)
FF Homepage: https://www.google.com/?trackid=sp-006
FF Keyword.URL: https://www.google.com/search/?trackid=sp-006
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-17] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\searchplugins\google-avast.xml [2015-04-03]
FF Extension: Adblock Plus - C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-10]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-20]
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-08]
CHR Extension: (Google Drive) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-08]
CHR Extension: (YouTube) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-08]
CHR Extension: (Google Search) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-08]
CHR Extension: (Bookmark Manager) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (Avast Online Security) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-21]
CHR Extension: (Google Wallet) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-08]
CHR Extension: (Gmail) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-08]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-30]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-30] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3205216 2015-03-30] (Avast Software)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-03-30] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [73440 2015-03-30] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-03-30] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-03-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788272 2015-03-30] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427736 2015-03-30] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-03-30] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208024 2015-03-30] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 P16X; C:\Windows\System32\drivers\P16X.sys [1330048 2003-09-22] (Creative Technology Ltd.)
R2 PfModNT; C:\Windows\system32\drivers\PfModNT.sys [15840 2003-03-05] (Creative Technology Ltd.) []
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220240 2015-03-30] (Avast Software)
S3 catchme; \??\C:\Users\WORTHM~1\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 20:47 - 2015-05-25 20:47 - 00000000 ____D () C:\Users\Worthmann\Desktop\FRST-OlderVersion
2015-05-25 20:43 - 2015-05-25 20:43 - 00000741 _____ () C:\Users\Worthmann\Desktop\JRT.txt
2015-05-25 20:38 - 2015-05-25 20:38 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-WORTHMANN-PC-Windows-7-Professional-(32-bit).dat
2015-05-25 20:38 - 2015-05-25 20:38 - 00000000 ____D () C:\RegBackup
2015-05-25 20:37 - 2015-05-25 20:37 - 02945770 _____ (Thisisu) C:\Users\Worthmann\Desktop\JRT.exe
2015-05-25 20:33 - 2015-05-25 20:33 - 00007179 _____ () C:\Users\Worthmann\Desktop\AdwCleaner[S0].txt
2015-05-25 20:27 - 2015-05-25 20:31 - 00000000 ____D () C:\AdwCleaner
2015-05-25 20:26 - 2015-05-25 20:27 - 02222592 _____ () C:\Users\Worthmann\Desktop\AdwCleaner_4.205.exe
2015-05-25 20:26 - 2015-05-25 20:26 - 00002104 _____ () C:\Users\Worthmann\Desktop\mbam.txt
2015-05-25 20:08 - 2015-05-25 20:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-25 20:08 - 2015-05-25 20:08 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-05-25 20:08 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-25 20:08 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-25 20:05 - 2015-05-25 20:07 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Worthmann\Downloads\mbam-setup-2.1.6.1022.exe
2015-05-24 21:55 - 2015-05-25 20:32 - 00000912 _____ () C:\Windows\PFRO.log
2015-05-21 15:08 - 2015-05-21 18:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-05-21 09:14 - 2015-05-21 09:14 - 00010713 _____ () C:\ComboFix.txt
2015-05-21 08:56 - 2015-05-21 09:14 - 00000000 ____D () C:\Qoobox
2015-05-21 08:56 - 2015-05-21 09:12 - 00000000 ____D () C:\Windows\erdnt
2015-05-21 08:56 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-21 08:56 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-21 08:56 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-21 08:54 - 2015-05-21 08:55 - 05627500 ____R (Swearware) C:\Users\Worthmann\Desktop\ComboFix.exe
2015-05-20 20:53 - 2015-05-20 20:53 - 00015843 _____ () C:\Users\Worthmann\Desktop\bewerbung möbius.odt
2015-05-20 14:08 - 2015-05-20 14:08 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Worthmann\Desktop\tdsskiller.exe
2015-05-20 13:55 - 2015-05-25 20:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-20 13:54 - 2015-05-25 20:09 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-20 13:54 - 2015-05-20 14:07 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-20 13:53 - 2015-05-20 14:07 - 00000000 ____D () C:\Users\Worthmann\Desktop\mbar
2015-05-20 13:53 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-20 13:52 - 2015-05-20 13:52 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Worthmann\Desktop\mbar-1.09.1.1004.exe
2015-05-19 22:13 - 2015-05-19 22:13 - 00010764 _____ () C:\Users\Worthmann\Desktop\gmer.log
2015-05-19 22:01 - 2015-05-19 22:01 - 00380416 _____ () C:\Users\Worthmann\Desktop\Gmer-19357.exe
2015-05-19 21:59 - 2015-05-19 22:00 - 00018392 _____ () C:\Users\Worthmann\Desktop\Addition.txt
2015-05-19 21:58 - 2015-05-25 20:48 - 00009921 _____ () C:\Users\Worthmann\Desktop\FRST.txt
2015-05-19 21:58 - 2015-05-25 20:48 - 00000000 ____D () C:\FRST
2015-05-19 21:57 - 2015-05-25 20:47 - 01147392 _____ (Farbar) C:\Users\Worthmann\Desktop\FRST.exe
2015-05-19 21:56 - 2015-05-19 21:57 - 00000480 _____ () C:\Users\Worthmann\Desktop\defogger_disable.log
2015-05-19 21:56 - 2015-05-19 21:56 - 00000000 _____ () C:\Users\Worthmann\defogger_reenable
2015-05-19 21:55 - 2015-05-19 21:55 - 00050477 _____ () C:\Users\Worthmann\Desktop\Defogger.exe
2015-05-19 21:03 - 2015-05-25 20:32 - 00000392 _____ () C:\Windows\setupact.log
2015-05-19 21:03 - 2015-05-19 21:03 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-19 15:53 - 2015-05-19 15:53 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-05-18 15:17 - 2015-05-18 15:23 - 00000000 ____D () C:\Program Files\FreePDF_XP
2015-05-18 15:17 - 2015-05-18 15:22 - 00000000 ____D () C:\ProgramData\FreePDF
2015-05-18 15:16 - 2015-05-18 15:16 - 12666892 _____ () C:\Users\Worthmann\Downloads\gs907w32.exe
2015-05-18 15:16 - 2015-05-18 15:16 - 00000000 ____D () C:\Program Files\gs
2015-05-18 15:14 - 2015-05-18 15:14 - 02561536 _____ (Microsoft Corporation) C:\Users\Worthmann\Downloads\freepdf4.14.exe
2015-05-18 15:04 - 2015-05-18 15:04 - 00014900 _____ () C:\Users\Worthmann\Desktop\bewerbung pannekoekschip.odt
2015-05-18 15:02 - 2015-05-18 15:05 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\PDF Architect 3
2015-05-18 14:57 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files\PDFCreator
2015-05-18 14:57 - 2015-05-18 15:14 - 00000000 ____D () C:\ProgramData\PDF Architect 3
2015-05-18 14:52 - 2015-05-18 14:52 - 00000000 ____D () C:\Program Files\Microsoft.NET
2015-05-18 14:48 - 2015-05-18 14:48 - 27837984 _____ (pdfforge ) C:\Users\Worthmann\Downloads\PDFCreator-2_1_1-setup.exe
2015-05-18 14:44 - 2015-05-18 14:44 - 00014743 _____ () C:\Users\Worthmann\Desktop\Lebenslauf.odt
2015-05-17 21:00 - 2015-05-17 21:39 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-05-17 20:46 - 2015-05-17 20:47 - 00000000 ____D () C:\Users\Worthmann\Documents\Ableton
2015-05-17 20:35 - 2015-05-17 20:51 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\Ableton
2015-05-17 20:35 - 2015-05-17 20:35 - 00000000 ____D () C:\Program Files\Common Files\Propellerhead Software
2015-05-17 20:32 - 2015-05-17 21:39 - 00000000 ____D () C:\ProgramData\Ableton
2015-05-14 00:50 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 10:52 - 2015-05-13 10:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-05-13 10:52 - 2015-05-13 10:52 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-13 10:51 - 2015-05-13 10:51 - 06484352 _____ (Piriform Ltd) C:\Users\Worthmann\Downloads\ccsetup505.exe
2015-05-13 09:56 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 09:56 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 09:56 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 09:56 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 09:56 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 09:56 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 09:56 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 09:56 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 09:56 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 09:56 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 09:56 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 09:56 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 09:56 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 09:56 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 09:56 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 09:56 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 09:56 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 09:56 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 09:56 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 09:56 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 09:56 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 09:56 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 09:56 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 09:56 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 09:56 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 09:56 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 09:56 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 09:56 - 2015-04-04 05:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 09:56 - 2015-04-04 05:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 09:56 - 2015-04-04 05:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 09:56 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 09:56 - 2015-04-04 05:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 09:56 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 09:56 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 09:56 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 09:55 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 09:55 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 09:55 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 09:55 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 09:55 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 09:55 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 09:55 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 09:55 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 09:55 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 09:55 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 09:55 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 09:55 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 09:55 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 09:55 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-10 21:13 - 2015-05-12 18:51 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\vlc
2015-05-10 21:12 - 2015-05-10 21:12 - 00000988 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-05-10 21:12 - 2015-05-10 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-05-10 21:11 - 2015-05-10 21:11 - 00000000 ____D () C:\Program Files\VideoLAN
2015-05-10 21:09 - 2015-05-10 21:10 - 28849904 _____ () C:\Users\Worthmann\Downloads\vlc-2.2.1-win32.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-25 20:47 - 2009-07-14 06:34 - 00022544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-25 20:47 - 2009-07-14 06:34 - 00022544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-25 20:39 - 2013-06-20 12:54 - 01708893 _____ () C:\Windows\WindowsUpdate.log
2015-05-25 20:37 - 2010-11-20 23:01 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-25 20:33 - 2014-08-08 23:22 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-25 20:32 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 19:55 - 2014-08-08 23:22 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-25 19:50 - 2014-04-13 13:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-24 22:58 - 2014-08-08 23:23 - 00002081 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-24 21:55 - 2013-06-20 14:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-05-21 09:14 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2015-05-21 09:14 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-05-21 09:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-19 21:56 - 2013-06-20 13:11 - 00000000 ____D () C:\Users\Worthmann
2015-05-19 20:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-19 20:06 - 2013-06-20 13:11 - 00000000 ____D () C:\Users\Worthmann\AppData\Local\VirtualStore
2015-05-18 14:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-14 14:04 - 2011-04-12 03:39 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 12:04 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-05-14 11:14 - 2009-07-14 06:33 - 00292320 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 00:50 - 2013-08-12 00:49 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-14 00:45 - 2013-06-20 14:28 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 10:53 - 2013-06-20 13:50 - 00000000 ____D () C:\Windows\Panther
Some files in TEMP:
====================
C:\Users\Worthmann\AppData\Local\Temp\Quarantine.exe
C:\Users\Worthmann\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-25 12:39
==================== End of log ============================
|
|
26.05.2015, 17:37
| #8 |
| /// the machine /// TB-Ausbilder | Browser extrem langsamESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.05.2015, 21:56
| #9 |
| | Browser extrem langsam eset Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=eb713ae7f83a9d44aac4453438e07a00
# engine=24035
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-26 08:39:09
# local_time=2015-05-26 10:39:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Internet Security'
# compatibility_mode=779 16777213 85 72 53085 197093239 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 35215 184303940 0 0
# scanned=84464
# found=1
# cleaned=0
# scan_time=5235
sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Worthmann\Downloads\PDFCreator-2_1_1-setup.exe"
Code:
ATTFilter Results of screen317's Security Check version 1.001
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Adobe Flash Player 17.0.0.169
Adobe Reader XI
Mozilla Firefox (38.0.1)
Mozilla Thunderbird (31.7.0)
Google Chrome (43.0.2357.65)
Google Chrome (43.0.2357.81)
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast ng vbox\AvastVBoxSVC.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-05-2015
Ran by Worthmann (administrator) on WORTHMANN-PC on 26-05-2015 22:51:26
Running from C:\Users\Worthmann\Desktop
Loaded Profiles: Worthmann (Available Profiles: Worthmann)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(Creative Technology Ltd) C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\BrccMCtl.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
() C:\Program Files\Opera\29.0.1795.54644\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
(Opera Software) C:\Program Files\Opera\29.0.1795.54644\opera.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM\...\Run: [diagent] => C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe [135264 2002-04-03] (Creative Technology Ltd)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-03-30] (Avast Software s.r.o.)
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6278424 2015-04-23] (Piriform Ltd)
Startup: C:\Users\Worthmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk [2013-06-28]
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-03-30] (Avast Software s.r.o.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1696922312-3565181748-3259631844-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-03-30] (Avast Software s.r.o.)
Tcpip\Parameters: [DhcpNameServer] 83.169.185.161 83.169.185.225
FireFox:
========
FF ProfilePath: C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default
FF DefaultSearchEngine: Google (avast)
FF DefaultSearchUrl: https://www.google.com/search/?trackid=sp-006
FF SearchEngineOrder.1: Google (avast)
FF SelectedSearchEngine: Google (avast)
FF Homepage: https://www.google.com/?trackid=sp-006
FF Keyword.URL: https://www.google.com/search/?trackid=sp-006
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-17] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\searchplugins\google-avast.xml [2015-04-03]
FF Extension: Adblock Plus - C:\Users\Worthmann\AppData\Roaming\Mozilla\Firefox\Profiles\ppthaokc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-10]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-20]
Chrome:
=======
CHR Profile: C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-08]
CHR Extension: (Google Drive) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-08]
CHR Extension: (YouTube) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-08]
CHR Extension: (Google Search) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-08]
CHR Extension: (Bookmark Manager) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-22]
CHR Extension: (Avast Online Security) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-21]
CHR Extension: (Google Wallet) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-08]
CHR Extension: (Gmail) - C:\Users\Worthmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-08]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-30]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-30] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3205216 2015-03-30] (Avast Software)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-03-30] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [73440 2015-03-30] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-03-30] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-03-30] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788272 2015-03-30] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427736 2015-03-30] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-03-30] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208024 2015-03-30] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 P16X; C:\Windows\System32\drivers\P16X.sys [1330048 2003-09-22] (Creative Technology Ltd.)
R2 PfModNT; C:\Windows\system32\drivers\PfModNT.sys [15840 2003-03-05] (Creative Technology Ltd.) []
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220240 2015-03-30] (Avast Software)
S3 catchme; \??\C:\Users\WORTHM~1\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-26 22:50 - 2015-05-26 22:50 - 00000884 _____ () C:\Users\Worthmann\Desktop\checkup.txt
2015-05-26 22:42 - 2015-05-26 22:42 - 00852630 _____ () C:\Users\Worthmann\Desktop\SecurityCheck.exe
2015-05-26 22:40 - 2015-05-26 22:41 - 00001000 _____ () C:\Users\Worthmann\Desktop\eset.txt
2015-05-26 21:05 - 2015-05-26 21:05 - 02347384 _____ (ESET) C:\Users\Worthmann\Downloads\esetsmartinstaller_deu.exe
2015-05-26 18:48 - 2015-05-26 18:48 - 00001057 _____ () C:\Users\Public\Desktop\Opera.lnk
2015-05-26 18:48 - 2015-05-26 18:48 - 00001057 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-05-26 18:46 - 2015-05-26 18:46 - 00683976 _____ (Opera Software) C:\Users\Worthmann\Downloads\Opera_NI_stable.exe
2015-05-26 17:49 - 2015-05-26 17:49 - 00000000 __SHD () C:\Users\Worthmann\AppData\Local\EmieUserList
2015-05-26 17:49 - 2015-05-26 17:49 - 00000000 __SHD () C:\Users\Worthmann\AppData\Local\EmieSiteList
2015-05-26 17:49 - 2015-05-26 17:49 - 00000000 __SHD () C:\Users\Worthmann\AppData\Local\EmieBrowserModeList
2015-05-26 16:47 - 2015-05-26 18:48 - 00000000 ____D () C:\Program Files\Opera
2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\Opera Software
2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D () C:\Users\Worthmann\AppData\Local\Opera Software
2015-05-25 20:47 - 2015-05-25 20:47 - 00000000 ____D () C:\Users\Worthmann\Desktop\FRST-OlderVersion
2015-05-25 20:43 - 2015-05-25 20:43 - 00000741 _____ () C:\Users\Worthmann\Desktop\JRT.txt
2015-05-25 20:38 - 2015-05-25 20:38 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-WORTHMANN-PC-Windows-7-Professional-(32-bit).dat
2015-05-25 20:38 - 2015-05-25 20:38 - 00000000 ____D () C:\RegBackup
2015-05-25 20:37 - 2015-05-25 20:37 - 02945770 _____ (Thisisu) C:\Users\Worthmann\Desktop\JRT.exe
2015-05-25 20:33 - 2015-05-25 20:33 - 00007179 _____ () C:\Users\Worthmann\Desktop\AdwCleaner[S0].txt
2015-05-25 20:27 - 2015-05-25 20:31 - 00000000 ____D () C:\AdwCleaner
2015-05-25 20:26 - 2015-05-25 20:27 - 02222592 _____ () C:\Users\Worthmann\Desktop\AdwCleaner_4.205.exe
2015-05-25 20:26 - 2015-05-25 20:26 - 00002104 _____ () C:\Users\Worthmann\Desktop\mbam.txt
2015-05-25 20:08 - 2015-05-25 20:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-25 20:08 - 2015-05-25 20:08 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-05-25 20:08 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-25 20:08 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-25 20:05 - 2015-05-25 20:07 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Worthmann\Downloads\mbam-setup-2.1.6.1022.exe
2015-05-21 15:08 - 2015-05-21 18:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-05-21 09:14 - 2015-05-21 09:14 - 00010713 _____ () C:\ComboFix.txt
2015-05-21 08:56 - 2015-05-21 09:14 - 00000000 ____D () C:\Qoobox
2015-05-21 08:56 - 2015-05-21 09:12 - 00000000 ____D () C:\Windows\erdnt
2015-05-21 08:56 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-21 08:56 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-21 08:56 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-21 08:56 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-21 08:54 - 2015-05-21 08:55 - 05627500 ____R (Swearware) C:\Users\Worthmann\Desktop\ComboFix.exe
2015-05-20 20:53 - 2015-05-20 20:53 - 00015843 _____ () C:\Users\Worthmann\Desktop\bewerbung möbius.odt
2015-05-20 14:08 - 2015-05-20 14:08 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Worthmann\Desktop\tdsskiller.exe
2015-05-20 13:55 - 2015-05-25 20:08 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-20 13:54 - 2015-05-25 20:09 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-20 13:54 - 2015-05-20 14:07 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-20 13:53 - 2015-05-20 14:07 - 00000000 ____D () C:\Users\Worthmann\Desktop\mbar
2015-05-20 13:53 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-20 13:52 - 2015-05-20 13:52 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Worthmann\Desktop\mbar-1.09.1.1004.exe
2015-05-19 22:13 - 2015-05-19 22:13 - 00010764 _____ () C:\Users\Worthmann\Desktop\gmer.log
2015-05-19 22:01 - 2015-05-19 22:01 - 00380416 _____ () C:\Users\Worthmann\Desktop\Gmer-19357.exe
2015-05-19 21:59 - 2015-05-19 22:00 - 00018392 _____ () C:\Users\Worthmann\Desktop\Addition.txt
2015-05-19 21:58 - 2015-05-26 22:51 - 00010601 _____ () C:\Users\Worthmann\Desktop\FRST.txt
2015-05-19 21:58 - 2015-05-26 22:51 - 00000000 ____D () C:\FRST
2015-05-19 21:57 - 2015-05-25 20:47 - 01147392 _____ (Farbar) C:\Users\Worthmann\Desktop\FRST.exe
2015-05-19 21:56 - 2015-05-19 21:57 - 00000480 _____ () C:\Users\Worthmann\Desktop\defogger_disable.log
2015-05-19 21:56 - 2015-05-19 21:56 - 00000000 _____ () C:\Users\Worthmann\defogger_reenable
2015-05-19 21:55 - 2015-05-19 21:55 - 00050477 _____ () C:\Users\Worthmann\Desktop\Defogger.exe
2015-05-19 15:53 - 2015-05-19 15:53 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-05-18 15:17 - 2015-05-18 15:23 - 00000000 ____D () C:\Program Files\FreePDF_XP
2015-05-18 15:17 - 2015-05-18 15:22 - 00000000 ____D () C:\ProgramData\FreePDF
2015-05-18 15:16 - 2015-05-18 15:16 - 12666892 _____ () C:\Users\Worthmann\Downloads\gs907w32.exe
2015-05-18 15:16 - 2015-05-18 15:16 - 00000000 ____D () C:\Program Files\gs
2015-05-18 15:14 - 2015-05-18 15:14 - 02561536 _____ (Microsoft Corporation) C:\Users\Worthmann\Downloads\freepdf4.14.exe
2015-05-18 15:04 - 2015-05-18 15:04 - 00014900 _____ () C:\Users\Worthmann\Desktop\bewerbung pannekoekschip.odt
2015-05-18 15:02 - 2015-05-18 15:05 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\PDF Architect 3
2015-05-18 14:57 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files\PDFCreator
2015-05-18 14:57 - 2015-05-18 15:14 - 00000000 ____D () C:\ProgramData\PDF Architect 3
2015-05-18 14:52 - 2015-05-18 14:52 - 00000000 ____D () C:\Program Files\Microsoft.NET
2015-05-18 14:48 - 2015-05-18 14:48 - 27837984 _____ (pdfforge ) C:\Users\Worthmann\Downloads\PDFCreator-2_1_1-setup.exe
2015-05-18 14:44 - 2015-05-18 14:44 - 00014743 _____ () C:\Users\Worthmann\Desktop\Lebenslauf.odt
2015-05-17 21:00 - 2015-05-17 21:39 - 00000000 ____D () C:\Windows\system32\appmgmt
2015-05-17 20:46 - 2015-05-17 20:47 - 00000000 ____D () C:\Users\Worthmann\Documents\Ableton
2015-05-17 20:35 - 2015-05-17 20:51 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\Ableton
2015-05-17 20:35 - 2015-05-17 20:35 - 00000000 ____D () C:\Program Files\Common Files\Propellerhead Software
2015-05-17 20:32 - 2015-05-17 21:39 - 00000000 ____D () C:\ProgramData\Ableton
2015-05-14 00:50 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 10:52 - 2015-05-13 10:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-05-13 10:52 - 2015-05-13 10:52 - 00000000 ____D () C:\Program Files\CCleaner
2015-05-13 09:56 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 09:56 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 09:56 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 09:56 - 2015-04-21 18:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 09:56 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 09:56 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 09:56 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 09:56 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 09:56 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 09:56 - 2015-04-21 17:58 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 09:56 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 09:56 - 2015-04-21 17:51 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 09:56 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 09:56 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 09:56 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 09:56 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 09:56 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 09:56 - 2015-04-21 17:26 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 09:56 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 09:56 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 09:56 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 09:56 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 09:56 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 09:56 - 2015-04-20 04:56 - 00909312 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 09:56 - 2015-04-20 04:03 - 02382336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 09:56 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 09:56 - 2015-04-13 05:19 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 09:56 - 2015-04-04 05:10 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 09:56 - 2015-04-04 05:10 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 09:56 - 2015-04-04 05:05 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 09:56 - 2015-04-04 05:05 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 09:56 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 09:56 - 2015-04-04 05:04 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 09:56 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 09:56 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 09:56 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 09:55 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 09:55 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 09:55 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 09:55 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 09:55 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 09:55 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 09:55 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 09:55 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 09:55 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 09:55 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 09:55 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 09:55 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 09:55 - 2015-04-08 05:14 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 09:55 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-10 21:13 - 2015-05-26 19:17 - 00000000 ____D () C:\Users\Worthmann\AppData\Roaming\vlc
2015-05-10 21:12 - 2015-05-10 21:12 - 00000988 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-05-10 21:12 - 2015-05-10 21:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-05-10 21:11 - 2015-05-10 21:11 - 00000000 ____D () C:\Program Files\VideoLAN
2015-05-10 21:09 - 2015-05-10 21:10 - 28849904 _____ () C:\Users\Worthmann\Downloads\vlc-2.2.1-win32.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-26 22:50 - 2014-04-13 13:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-26 22:01 - 2013-06-20 12:54 - 01755103 _____ () C:\Windows\WindowsUpdate.log
2015-05-26 21:56 - 2014-08-08 23:22 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-26 15:55 - 2014-08-08 23:22 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-26 08:07 - 2009-07-14 06:34 - 00022544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-26 08:07 - 2009-07-14 06:34 - 00022544 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-26 07:58 - 2010-11-20 23:01 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-26 07:54 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 22:09 - 2014-08-08 23:23 - 00002081 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-05-24 21:55 - 2013-06-20 14:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-05-21 09:14 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2015-05-21 09:14 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-05-21 09:11 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-05-19 21:56 - 2013-06-20 13:11 - 00000000 ____D () C:\Users\Worthmann
2015-05-19 20:55 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-05-19 20:06 - 2013-06-20 13:11 - 00000000 ____D () C:\Users\Worthmann\AppData\Local\VirtualStore
2015-05-18 14:57 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2015-05-14 14:04 - 2011-04-12 03:39 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-14 12:04 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2015-05-14 11:14 - 2009-07-14 06:33 - 00292320 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-14 00:50 - 2013-08-12 00:49 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-14 00:45 - 2013-06-20 14:28 - 137310008 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 10:53 - 2013-06-20 13:50 - 00000000 ____D () C:\Windows\Panther
Some files in TEMP:
====================
C:\Users\Worthmann\AppData\Local\Temp\Quarantine.exe
C:\Users\Worthmann\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-25 12:39
==================== End of log ============================
|
|
27.05.2015, 18:15
| #10 |
| /// the machine /// TB-Ausbilder | Browser extrem langsam Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Worthmann\Downloads\PDFCreator-2_1_1-setup.exe
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Besser?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.05.2015, 15:18
| #11 |
| | Browser extrem langsamCode:
ATTFilter Fix result of Farbar Recovery Scan Tool (x86) Version: 25-05-2015
Ran by Worthmann at 2015-05-27 21:07:26 Run:1
Running from C:\Users\Worthmann\Desktop
Loaded Profiles: Worthmann (Available Profiles: Worthmann)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\Users\Worthmann\Downloads\PDFCreator-2_1_1-setup.exe
Emptytemp:
*****************
C:\Users\Worthmann\Downloads\PDFCreator-2_1_1-setup.exe => Moved successfully.
EmptyTemp: => Removed 131.7 MB temporary data.
The system needed a reboot.
==== End of Fixlog 21:07:36 ====
Hey schrauber, Danke für deine Hilfe, haben ja offenbar ein paar schädliche Dateien entfernt. Letztendlich habe ich jetzt den Haken in den Firefox-Einstellungen bei "Hardware Beschleunigung aktivieren" weggemacht und es läuft wieder super. Noch irgendwas zu tun bevor wir hier zu machen? Ok, habe jetzt das alte Profil wieder fertiggemacht, weil meine Eltern gerne Passwörter, Chronik etc. behalten wollten. Nun habe ich versucht eine Verbindung zu google herzustellen und Firefox warnt mich mit dem Text "Dieser Verbindung wird nicht vertraut etc pp". Habe ich jetzt versehentlich aus dem alten Profilordner schädliche Dateien in den neu installierten Browser kopiert? :P |
|
29.05.2015, 06:58
| #12 |
| /// the machine /// TB-Ausbilder | Browser extrem langsam Setz den Ff nochmal zurück.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.05.2015, 11:42
| #13 |
| | Browser extrem langsam Ok, jetzt ist eigentlich alles wieder gut. Danke dir! |
|
30.05.2015, 08:56
| #14 |
| /// the machine /// TB-Ausbilder | Browser extrem langsam Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.05.2015, 10:03
| #15 |
| | Browser extrem langsam Großes Dankeschön, schrauber! |
|
| Themen zu Browser extrem langsam |
| arten, beginnt, browser, ccleaner, ccsetup, ebenfalls, ergebnis, extrem, klick, klickt, kurzem, laden, langsam, link, neustarten, nichts, poste, posten, scan, seite, sekunden, sämtliche, verzögert, virenscan, wirklich, öffnen |
WARNUNG an die MITLESER: 
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
