| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Avira Antivir Live CD erkennt 27 TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
26.05.2015, 15:12
| #1 |
| |  Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Hallo erstmal  Ich habe gerade eben meinen PC mit einer Live-CD von Avira Antivir gescannt und war ziemlich überrascht von den 27 Funden. Ich hoffe ihr könnt mir helfen diese loszuwerden. Hier das Logfile von Avira: Code:
ATTFilter Scan Report
Start: 12:08:07 End: 13:37:50
Detections: 27
Files treated: 27
Files scanned: 204786
Engine version: 8.3.30.38
VDF version: 7.11.235.54
Scan status: Finished
Update Report
Update finished successfully!Updated files:
vbase021.vdf 7.11.233.14 -> 7.11.233.89
vbase022.vdf 7.11.233.15 -> 7.11.233.149
vbase023.vdf 7.11.233.16 -> 7.11.234.176
vbase024.vdf 7.11.233.17 -> 7.11.234.231
vbase025.vdf 7.11.233.18 -> 7.11.234.232
vbase026.vdf 7.11.233.19 -> 7.11.234.233
vbase027.vdf 7.11.233.20 -> 7.11.234.234
vbase028.vdf 7.11.233.21 -> 7.11.234.235
vbase029.vdf 7.11.233.22 -> 7.11.234.236
vbase030.vdf 7.11.233.23 -> 7.11.234.237
vbase031.vdf 7.11.233.78 -> 7.11.235.54
aevdf.dat 7.11.233.78 -> 7.11.235.54
aecore.so 8.3.4.0 -> 8.3.6.2
aeheur.so 8.1.4.1684 -> 8.1.4.1702
aepack.so 8.4.0.76 -> 8.4.0.80
aescript.so 8.2.2.64 -> 8.2.2.66
aesbx.so 8.2.20.34 -> 8.2.21.0
aeset.dat 8.3.30.34 -> 8.3.30.38
Update finished successfully
Details
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/inbox.vir
Virus name: TR/Crypt.ZPACK.145794 (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/trash.vir
Virus name: TR/Crypt.Xpack.188403 (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/inbox.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/trash.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/inbox.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/trash.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox.vir
Virus name: TR/Dldr.JRAF (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/trash.vir
Virus name: TR/Dldr.JRAF (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.gmx.net/inbox
Virus name: TR/Matsnu.A.113 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.gmx.net/trash
Virus name: TR/Matsnu.A.113 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web-1.de/inbox
Virus name: TR/Downloader.Gen7 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web-1.de/trash
Virus name: TR/Matsnu.A.166 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web.de/inbox
Virus name: TR/Crypt.Xpack.87566 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web.de/trash
Virus name: TR/Crypt.ZPACK.Gen7 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox
Virus name: TR/Dldr.JRAF file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/vwl.uni-freiburg.de/trash
Virus name: TR/Dldr.JRAF file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-05 235354/backup files 2.zip
Virus name: TR/Dldr.JRAF file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 1.zip
Virus name: TR/Yakes.ceky file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 15.zip
Virus name: TR/Crypt.EPACK.33213 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 18.zip
Virus name: TR/Downloader.Gen7 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 19.zip
Virus name: TR/Yakes.ceky file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 1.zip
Virus name: TR/Yakes.ceky file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 6.zip
Virus name: TR/Cabhot.vuze file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 7.zip
Virus name: TR/Matsnu.A.260 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 1.zip
Virus name: TR/Matsnu.A.260 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 4.zip
Virus name: TR/Cabhot.vuze file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 5.zip
Virus name: TR/Crypt.EPACK.33697 file renamed
Virus Type: trojan
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:47 on 26/05/2015 (Thomas)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by Thomas (administrator) on THOMAS-PC on 26-05-2015 15:51:14
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(AddGadgets) C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Spotify Ltd) C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe
(Oracle Corporation) C:\Program Files (x86)\PCremote\mojjre\bin\javaw.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [558672 2013-09-11] (Lavasoft)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] ()
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [OneDrive] => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [Spotify Web Helper] => C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2022968 2015-05-25] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-26]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2014-12-21]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ET6.lnk [2015-02-22]
ShortcutTarget: ET6.lnk -> C:\Program Files (x86)\GIGABYTE\ET6\ET6SC.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-27]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Windows\Installer\{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}\OC_GURU.exe1_5588D686D23B4C9DBDFA2A7875CD3722.exe (Macrovision Corporation)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCMeterV0.4.lnk [2014-11-26]
ShortcutTarget: PCMeterV0.4.lnk -> C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe (AddGadgets)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCremote.lnk [2015-01-04]
ShortcutTarget: PCremote.lnk -> C:\Program Files (x86)\PCremote\PCremote.exe (JakuSoft)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660
FF DefaultSearchEngine: dict.cc DE-EN
FF SelectedSearchEngine: LEO Eng-Deu
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-18] ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-18] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-26] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\searchplugins\dictcc-de-en.xml [2015-01-29]
FF Extension: WOT - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-12]
FF Extension: Pushbullet - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\jid1-BYcQOfYfmBMd9A@jetpack.xpi [2015-04-14]
FF Extension: Dict.cc Translation - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\searchdictcc@roughael.xpi [2015-01-03]
FF Extension: Tile Tabs - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\tiletabs@DW-dev.xpi [2015-04-09]
FF Extension: Adblock Plus - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-27]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-02-07]
Chrome:
=======
CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-26]
CHR Extension: (Google Docs) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-26]
CHR Extension: (Google Drive) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-26]
CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-26]
CHR Extension: (Google Sheets) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-26]
CHR Extension: (Avira Browser Safety) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-26]
CHR Extension: (Google Wallet) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-26]
CHR Extension: (Lavasoft NewTab) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole [2015-01-21]
CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-26]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\chrome-newtab-search.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) []
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) []
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-28] ()
R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-26] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 WinRing0_1_2_0; \??\C:\Users\Thomas\AppData\Local\Temp\tmp4F57.tmp [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-26 15:51 - 2015-05-26 15:51 - 00020694 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-05-26 15:50 - 2015-05-26 15:51 - 00000000 ____D () C:\FRST
2015-05-26 15:50 - 2015-05-26 15:50 - 02108928 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-05-26 15:47 - 2015-05-26 15:47 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-05-26 15:43 - 2015-05-26 15:43 - 00000000 ___HD () C:\OneDriveTemp
2015-05-25 17:17 - 2015-05-25 17:17 - 00011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2015-05-25 16:58 - 2015-05-25 16:58 - 00000000 ____D () C:\Users\Thomas\Desktop\Neuer Ordner (3)
2015-05-25 14:20 - 2015-05-25 14:20 - 00003172 _____ () C:\Windows\System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90}
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\Program Files\Oracle
2015-05-25 14:20 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-25 14:20 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-25 14:18 - 2015-05-25 14:19 - 111273672 _____ (Oracle Corporation) C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe
2015-05-22 18:49 - 2015-05-25 16:56 - 00000000 ____D () C:\Users\Thomas\Desktop\Bilder mit Séverine
2015-05-19 23:29 - 2015-05-20 15:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-19 16:54 - 2015-05-19 16:54 - 00949621 _____ () C:\Users\Thomas\Desktop\WhatsApp Chat mit Séverine Sandmann.txt
2015-05-19 16:24 - 2015-05-19 16:30 - 659742720 _____ () C:\Users\Thomas\Desktop\rescue-system.iso
2015-05-18 15:15 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-16 02:39 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 02:39 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 12:47 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-15 12:47 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-15 12:47 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-15 12:47 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-15 12:47 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-15 12:47 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-15 12:47 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-15 12:47 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-15 12:47 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-15 12:47 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-15 12:47 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-15 12:47 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-15 12:47 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-15 12:47 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-15 12:47 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-15 12:47 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-15 12:47 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-15 12:47 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-15 12:47 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-15 12:47 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-15 12:47 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-15 12:47 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-15 12:47 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-15 12:47 - 2015-04-04 05:29 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-15 12:47 - 2015-04-04 05:29 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-15 12:47 - 2015-04-04 05:22 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:20 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-15 12:47 - 2015-04-04 05:17 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:17 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-15 12:47 - 2015-04-04 05:15 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-15 12:47 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-15 12:46 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-15 12:46 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-15 12:46 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-15 12:46 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 12:46 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 12:46 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-15 12:46 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-15 12:46 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 17:10 - 2015-05-13 17:10 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-06 23:06 - 2015-05-06 23:12 - 00000000 ____D () C:\Users\Thomas\Desktop\06.05.2015 - Yannick Garten
2015-04-28 00:34 - 2015-04-28 00:34 - 06479272 _____ (Neat Image team, ABSoft ) C:\Users\Thomas\Downloads\NeatSetup3274.exe
2015-04-28 00:34 - 2015-04-28 00:34 - 00001103 _____ () C:\Users\Thomas\Desktop\Neat Image (32-bit).lnk
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\NeatImage SL 32
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neat Image Standalone (32-bit)
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Program Files (x86)\Neat Image Standalone
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-26 15:51 - 2011-04-12 09:43 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2015-05-26 15:51 - 2011-04-12 09:43 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2015-05-26 15:51 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-26 15:50 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-26 15:50 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-26 15:47 - 2014-11-26 16:23 - 00000000 ____D () C:\Users\Thomas
2015-05-26 15:46 - 2014-11-26 16:23 - 02046586 _____ () C:\Windows\WindowsUpdate.log
2015-05-26 15:43 - 2015-03-04 12:00 - 00005144 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC
2015-05-26 15:43 - 2015-02-22 18:41 - 00030528 _____ () C:\Windows\GVTDrv64.sys
2015-05-26 15:43 - 2015-02-22 18:41 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref
2015-05-26 15:43 - 2015-02-22 18:40 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-05-26 15:43 - 2015-01-07 20:25 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2015-05-26 15:43 - 2014-11-26 21:00 - 00047064 _____ () C:\Users\Thomas\Network_Meter_Data.js
2015-05-26 15:43 - 2014-11-26 20:31 - 00020607 _____ () C:\Users\Thomas\IP_Log_Data.js
2015-05-26 15:43 - 2014-11-26 20:12 - 00000000 ___RD () C:\Users\Thomas\OneDrive
2015-05-26 15:43 - 2014-11-26 16:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-26 15:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-26 15:43 - 2009-07-14 06:51 - 00069284 _____ () C:\Windows\setupact.log
2015-05-26 14:04 - 2014-11-27 01:32 - 00000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-26 13:24 - 2014-11-26 16:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-25 23:15 - 2014-11-28 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-25 22:14 - 2014-11-26 17:02 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Spotify
2015-05-25 17:17 - 2014-11-26 16:53 - 00000000 ____D () C:\Users\Thomas\.gimp-2.8
2015-05-25 16:56 - 2014-12-04 13:36 - 00000000 ____D () C:\Users\Thomas\AppData\Local\gtk-2.0
2015-05-25 15:49 - 2014-11-26 17:05 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Spotify
2015-05-25 14:41 - 2014-11-26 19:46 - 00000000 ____D () C:\Users\Thomas\.VirtualBox
2015-05-25 14:20 - 2014-11-26 19:46 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-05-21 22:05 - 2014-11-26 20:12 - 00002141 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-21 14:39 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-20 15:00 - 2010-11-21 05:47 - 00361018 _____ () C:\Windows\PFRO.log
2015-05-19 14:00 - 2014-11-26 20:01 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-18 14:17 - 2014-11-26 16:59 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:17 - 2014-11-26 16:59 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-18 14:14 - 2014-11-28 18:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-18 14:14 - 2014-11-28 18:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-18 14:14 - 2014-11-28 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-18 14:14 - 2014-11-26 20:34 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe
2015-05-17 22:05 - 2014-11-26 17:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-17 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-17 21:18 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 21:18 - 2009-07-14 06:45 - 00502448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-16 02:42 - 2014-11-26 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-16 02:40 - 2014-11-26 18:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-15 22:51 - 2014-11-26 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 17:10 - 2014-11-24 13:06 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 13:18 - 2014-11-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-04 20:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-27 16:39 - 2015-02-06 16:27 - 00000000 ____D () C:\Users\Thomas\Desktop\Bachelorarbeit
==================== Files in the root of some directories =======
2014-11-26 20:31 - 2014-12-02 00:11 - 0000626 _____ () C:\Users\Thomas\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-11-26 20:34 - 2014-11-26 20:47 - 0000841 _____ () C:\Users\Thomas\AppData\Roaming\Drives Meter_Settings.ini
2014-11-26 20:32 - 2015-01-13 16:02 - 0000292 _____ () C:\Users\Thomas\AppData\Roaming\GPU MeterV2_Settings.ini
2014-11-26 20:32 - 2014-11-26 20:33 - 0001328 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Settings.ini
2014-11-27 01:32 - 2015-05-26 14:04 - 0000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-25 17:17 - 2015-05-25 17:17 - 0011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2014-11-26 21:24 - 2015-04-06 00:04 - 0007604 _____ () C:\Users\Thomas\AppData\Local\Resmon.ResmonCfg
Files to move or delete:
====================
C:\Users\Thomas\IP_Log_Data.js
C:\Users\Thomas\Network_Meter_Data.js
Some files in TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
C:\Users\Thomas\AppData\Local\Temp\DelayInst.exe
C:\Users\Thomas\AppData\Local\Temp\gkey.exe
C:\Users\Thomas\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.5.575.exe
C:\Users\Thomas\AppData\Local\Temp\installservice.exe
C:\Users\Thomas\AppData\Local\Temp\pkeyui.exe
C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Thomas\AppData\Local\Temp\sfextra.dll
C:\Users\Thomas\AppData\Local\Temp\sp-downloader.exe
C:\Users\Thomas\AppData\Local\Temp\sqlite3.dll
C:\Users\Thomas\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Thomas\AppData\Local\Temp\wabk.exe
C:\Users\Thomas\AppData\Local\Temp\_is8E1B.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-25 17:46
==================== End of log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-05-2015
Ran by Thomas at 2015-05-26 15:51:39
Running from C:\Users\Thomas\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1093152027-101576897-1014639688-500 - Administrator - Disabled)
Gast (S-1-5-21-1093152027-101576897-1014639688-501 - Limited - Disabled)
Thomas (S-1-5-21-1093152027-101576897-1014639688-1000 - Administrator - Enabled) => C:\Users\Thomas
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 1.0.1.110 - Lavasoft)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Ahnenblatt 2.83 (HKLM-x32\...\Ahnenblatt_is1) (Version: 2.83.0.1 - Dirk Böttcher)
AMD Catalyst Install Manager (HKLM\...\{AF88A32E-BC54-2AA3-2FC8-D63D86DF4A7A}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games)
Brother MFL-Pro Suite MFC-J4410DW (HKLM-x32\...\{DD98C438-D769-4677-AA87-3481FA32D20C}) (Version: 2.0.0.0 - Brother Industries, Ltd.)
Capture One 6.4 (HKLM\...\CaptureOne6_is1) (Version: 6.4.65508.156 - Phase One A/S)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.5.0.11 - Swiss Academic Software)
Cities: Skylines (HKLM-x32\...\Steam App 255710) (Version: - Colossal Order Ltd.)
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.2.1 - Crystal Dew World)
Easy Tune 6 B12.1121.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.1121.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.118 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.118 - Etron Technology) Hidden
foobar2000 v1.3.5 (HKLM-x32\...\foobar2000) (Version: 1.3.5 - Peter Pawlowski)
GIGABYTE OC_GURU II (HKLM-x32\...\InstallShield_{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}) (Version: 1.74.0000 - GIGABYTE Technology Co.,Ltd.)
GIGABYTE OC_GURU II (x32 Version: 1.74.0000 - GIGABYTE Technology Co.,Ltd.) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM-x32\...\{DDCA236C-A28B-3979-8855-B7475BCAD806}) (Version: 66.30.49223 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
LibreOffice 4.3.4.1 (HKLM-x32\...\{7D983A32-F645-48AB-8E38-4ACD234F40BC}) (Version: 4.3.4.1 - The Document Foundation)
Logon Screen (HKLM\...\{1730D13B-7517-4321-A88B-64627CF67CDC}_is1) (Version: - Daniel Rebelo)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4719.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.2.0 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
Neat Image v7.4.0 Demo Standalone (32-bit) (HKLM-x32\...\Neat Image Standalone (32-bit)_is1) (Version: - Neat Image team, ABSoft)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5}) (Version: 4.3.28 - Oracle Corporation)
PCremote (HKLM-x32\...\PCremote) (Version: 1.4 - JakuSoft)
PDF Split And Merge Basic (HKLM\...\{9A40D2F8-9458-458B-95E3-B57797C574E1}) (Version: 2.2.4 - Andrea Vacondio)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.311.0 - Tracker Software Products Ltd)
Platform (x32 Version: 1.42 - VIA Technologies, Inc.) Hidden
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 6.21 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.21.104 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Spotify) (Version: 1.0.5.186.ga9c24d6a - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.42 - VIA Technologies, Inc.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows-Treiberpaket - Leaf Imaging Ltd. Image (02/11/2010 ) (HKLM\...\A35BD68D4A1B3E191138E3C9AA417190A9468F7E) (Version: 02/11/2010 - Leaf Imaging Ltd.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{25815CC0-43F4-3C75-8C3A-A139D9ADE740}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{5b55a44a-d008-49aa-9234-86fb7709bc0a}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
ATTENTION: System Restore is disabled
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {18493AC0-8A63-4389-B336-1D92ED6135B7} - System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90} => pcalua.exe -a C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe -d C:\Users\Thomas\Downloads
Task: {1E95EF8B-B3CF-48DA-ACAE-76E088C853E8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-26] (Google Inc.)
Task: {5F2736EE-ED71-4488-BF62-BD100C3C84C7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-26] (Google Inc.)
Task: {62093B6E-3116-4B9C-8035-0F588B18822C} - System32\Tasks\{C40D0927-D71A-45F4-8600-AE005A2E4FF8} => pcalua.exe -a "C:\Users\Thomas\Downloads\Eraser 6.0.10.2620.exe" -d C:\Users\Thomas\Downloads
Task: {6ECFD5BE-A3DC-4D73-AAAB-1962EC749502} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-18] (Adobe Systems Incorporated)
Task: {7F4CE648-3226-437E-9028-5CD75C4117BD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-05-19] (Microsoft Corporation)
Task: {A770A092-9852-44CD-A276-4BC7B2D2E0CE} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {AAF9D9C9-A304-47D2-8F54-2F8BD97217B7} - System32\Tasks\Microsoft\Windows\OC GURU => C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe [2014-10-28] (GIGABYTE Technology Co.,Ltd.)
Task: {C4E76C96-AD0D-4135-A27B-DD96E19A86A9} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {D8161A5C-DBD7-4F97-8A79-605882FA8881} - System32\Tasks\PCMeter\Startup => C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe [2014-11-26] (AddGadgets)
Task: {D913D2E1-85D4-452F-A0EF-E6793C82C497} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-03-10] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2014-11-26 20:01 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-11-26 18:58 - 2005-04-22 06:36 - 00143360 _____ () C:\Windows\system32\BrSNMP64.dll
2012-01-13 15:04 - 2012-01-13 15:04 - 00219760 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
2014-11-26 16:41 - 2012-11-14 09:22 - 00078456 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2014-11-26 16:41 - 2012-11-14 09:22 - 00386168 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00012520 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\CoreTempReader.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00015080 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\GetCoreTempInfoNET.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00014056 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\SystemInfo.dll
2012-08-06 13:07 - 2012-08-06 13:07 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-11-14 15:44 - 2012-11-14 15:44 - 02875463 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Normal.dll
2012-11-14 11:42 - 2012-11-14 11:42 - 00651331 _____ () C:\Program Files (x86)\GIGABYTE\ET6\work.dll
2012-09-17 17:25 - 2012-09-17 17:25 - 00106496 _____ () C:\Program Files (x86)\GIGABYTE\ET6\SF.dll
2008-05-07 16:22 - 2008-05-07 16:22 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\CIAMIB.dll
2012-05-08 16:01 - 2012-05-08 16:01 - 00069632 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GPTT.dll
2011-09-14 18:12 - 2011-09-14 18:12 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\ycc.dll
2010-06-24 16:50 - 2010-06-24 16:50 - 00094208 _____ () C:\Program Files (x86)\GIGABYTE\ET6\IccLibDll.dll
2011-03-01 20:00 - 2011-03-01 20:00 - 00126976 _____ () C:\Program Files (x86)\GIGABYTE\ET6\StabilityLib.dll
2011-10-18 10:26 - 2011-10-18 10:26 - 00024576 _____ () C:\Program Files (x86)\GIGABYTE\ET6\STT.dll
2012-11-14 15:00 - 2012-11-14 15:00 - 01499204 _____ () C:\Program Files (x86)\GIGABYTE\ET6\OCK.dll
2012-09-18 15:45 - 2012-09-18 15:45 - 01335362 _____ () C:\Program Files (x86)\GIGABYTE\ET6\HM.dll
2012-11-09 17:51 - 2012-11-09 17:51 - 01429582 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GVTunner.dll
2003-02-14 15:11 - 2003-02-14 15:11 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Sound.dll
2010-06-10 16:52 - 2010-06-10 16:52 - 00110592 _____ () C:\Program Files (x86)\GIGABYTE\ET6\AMD8.dll
2010-03-12 06:40 - 2010-03-12 06:40 - 04449632 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Platform.dll
2010-03-12 06:40 - 2010-03-12 06:40 - 00423256 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Device.dll
2012-11-20 18:38 - 2012-11-20 18:38 - 00311296 _____ () C:\Program Files (x86)\GIGABYTE\ET6\MFCCPU.DLL
2014-11-26 18:58 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 03350640 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-11-26 16:36 - 2013-09-16 13:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER Error getting ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Spotify => "C:\Users\Thomas\AppData\Roaming\Spotify\Spotify.exe" -autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{868C0CDC-65DA-49AC-A1F2-6BFDDA2C89C3}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{1BD1A2B2-A869-4EF7-8E3B-D7EDB93AE82A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{23CEE1FD-936A-4506-98EA-5E99C37A376F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F306B483-0C4E-4FF2-BD80-74C5F1308B97}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{38FC26EE-E98A-4F73-97E2-4411B432EE9A}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{2C908DCC-349F-4DE1-A735-D4342075F8A1}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{858FAFD6-071B-4747-918E-B7216F59DD7E}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [{B46A5642-828F-4332-95F7-F2DA44D54F15}] => (Allow) C:\Program Files (x86)\Brother\Brmfl12b\FAXRX.exe
FirewallRules: [{CD6C1ABC-B2F5-45AB-A118-D780458897E4}] => (Allow) C:\Program Files (x86)\Brother\Brmfl12b\FAXRX.exe
FirewallRules: [{4415A1CA-2A15-4FB4-8FC2-AABAF4289610}] => (Allow) LPort=54925
FirewallRules: [{9876341E-0FD3-493B-A3D9-FE17E2B4C5A0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{123B2200-788A-4F2F-8145-102BEDCEFEF7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{FAB2983B-0E34-481C-927A-A37F369778A0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{4000D441-7151-4E3E-A21D-5F0F0FBB4387}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{37485AC4-EFED-46D7-861A-89EAE634B670}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{4AC3ED3E-14E5-4FDD-AB67-45D300398043}] => (Allow) C:\Users\Thomas\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{99B295D4-B8AA-416E-ABA2-64B44CB6E71D}C:\program files (x86)\pc remote\pc remote\pcremote.exe] => (Allow) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [UDP Query User{0104D30B-0C24-410C-B9BD-6BB96605A62B}C:\program files (x86)\pc remote\pc remote\pcremote.exe] => (Allow) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [{E78A5DAA-7DA4-4FF7-A704-D57DF575717C}] => (Block) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [{033682DD-EB38-4EE5-B3B3-27DAECDB7146}] => (Block) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [TCP Query User{935720BD-85C1-4E6B-97D3-BB32EE4E5A16}C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe] => (Block) C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe
FirewallRules: [UDP Query User{75D46140-7539-43FB-A209-64BC0DDB3503}C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe] => (Block) C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe
FirewallRules: [TCP Query User{753A2F2A-4632-4D29-91CD-085B1093243F}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{19FF9810-C30E-4BB5-AD4B-931AF788F2F1}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{D5EB4939-26EE-4A68-9C38-688CBCA91483}C:\program files (x86)\pcremote\mojjre\bin\javaw.exe] => (Allow) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [UDP Query User{620ED441-6F2C-44CB-ABB6-CA2E62106FEB}C:\program files (x86)\pcremote\mojjre\bin\javaw.exe] => (Allow) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{1686B007-6F2A-4D11-BE1A-1C023CDF9EA0}] => (Block) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{9E566A22-31D9-43B4-B910-15F7D5F4B50F}] => (Block) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{7B93A4F7-8817-4069-B342-F87046567E0E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5647E22E-EE4A-44E9-8E02-4EFBA294A997}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{AAC701D3-A708-4DA7-9EE1-5AE17BC6859F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{B1EF69DD-51A0-4595-B586-FD80D90D50D3}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{CA3FDC85-CCC6-4E0A-B41B-7AF5D365F013}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{DE1D455A-49AB-438B-A038-22B5FD24EA79}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{A6CE0C0A-401A-4494-8537-63BE8FA0A718}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{FC283BB9-E760-4735-AE9D-1D003822E500}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{6D451505-D915-4EFA-8C15-8C0DAA1B4BCD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{3671EBD3-F019-440B-814A-406EBC73A18C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{3C113845-913E-494A-875D-92392CE2E4E8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{806A2F9B-08A4-48B9-84A9-DE297F5320DB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{C2645181-F524-4335-877D-75BF4581A73F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/26/2015 03:44:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:18:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:17:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6a8
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3
Error: (05/26/2015 00:32:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 00:30:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6b0
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3
Error: (05/25/2015 11:21:46 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
Error: (05/25/2015 11:21:46 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x5; CorrelationId: {DE97D441-3E5D-4AE9-A1FC-CEF5590E90C3}
Error: (05/25/2015 11:54:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 11:52:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6b0
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3
Error: (05/24/2015 11:21:37 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
System errors:
=============
Error: (05/26/2015 03:43:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/26/2015 01:17:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/26/2015 00:30:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/25/2015 11:52:19 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/24/2015 10:15:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/23/2015 11:56:45 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (05/22/2015 04:04:19 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Error: (05/22/2015 04:04:18 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Error: (05/22/2015 04:04:18 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Error: (05/22/2015 04:04:17 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Microsoft Office:
=========================
Error: (05/26/2015 03:44:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:18:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:17:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56a801d097a57e42f680C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dllc1d526bf-0398-11e5-9f3d-94de8027c9ce
Error: (05/26/2015 00:32:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 00:30:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56b001d0979f02baff4eC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dll463f932a-0392-11e5-ba73-94de8027c9ce
Error: (05/25/2015 11:21:46 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
Error: (05/25/2015 11:21:46 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x5; CorrelationId: {DE97D441-3E5D-4AE9-A1FC-CEF5590E90C3}
Error: (05/25/2015 11:54:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 11:52:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56b001d096d077332206C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dllbade77c8-02c3-11e5-a1db-94de8027c9ce
Error: (05/24/2015 11:21:37 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 30%
Total physical RAM: 8150.18 MB
Available physical RAM: 5703.33 MB
Total Pagefile: 16298.55 MB
Available Pagefile: 13267.79 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:238.47 GB) (Free:113.38 GB) NTFS
Drive d: (UUI) (Removable) (Total:3.91 GB) (Free:3.91 GB) FAT32
Drive e: (Daten) (Fixed) (Total:481.41 GB) (Free:328.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 1265228A)
Partition 1: (Not Active) - (Size=238.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E7E83165)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=481.4 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 3.9 GB) (Disk ID: 6E652072)
No partition Table on disk 2.
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-26 15:57:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Crucial_CT256MX100SSD1 rev.MU01 238,47GB
Running: Gmer-19357.exe; Driver: C:\Users\Thomas\AppData\Local\Temp\uwdiipoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
---- EOF - GMER 2.1 ----
|
|
26.05.2015, 15:16
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner hi,
__________________Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ |
|
26.05.2015, 15:36
| #3 |
| | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Mbar hat nichts gefunden:
__________________Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org
Database version:
main: v2015.05.26.04
rootkit: v2015.05.24.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17801
Thomas :: THOMAS-PC [administrator]
26.05.2015 16:19:22
mbar-log-2015-05-26 (16-19-22).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 363694
Time elapsed: 6 minute(s), 43 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter 16:33:21.0078 0x0388 TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
16:33:24.0697 0x0388 ============================================================
16:33:24.0697 0x0388 Current date / time: 2015/05/26 16:33:24.0697
16:33:24.0697 0x0388 SystemInfo:
16:33:24.0697 0x0388
16:33:24.0697 0x0388 OS Version: 6.1.7601 ServicePack: 1.0
16:33:24.0697 0x0388 Product type: Workstation
16:33:24.0697 0x0388 ComputerName: THOMAS-PC
16:33:24.0697 0x0388 UserName: Thomas
16:33:24.0697 0x0388 Windows directory: C:\Windows
16:33:24.0697 0x0388 System windows directory: C:\Windows
16:33:24.0697 0x0388 Running under WOW64
16:33:24.0697 0x0388 Processor architecture: Intel x64
16:33:24.0697 0x0388 Number of processors: 4
16:33:24.0697 0x0388 Page size: 0x1000
16:33:24.0697 0x0388 Boot type: Normal boot
16:33:24.0698 0x0388 ============================================================
16:33:24.0989 0x0388 KLMD registered as C:\Windows\system32\drivers\27990223.sys
16:33:25.0220 0x0388 System UUID: {7E23A272-A7B0-491E-3234-B66A7D1BCB63}
16:33:28.0488 0x0388 Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:33:28.0489 0x0388 Drive \Device\Harddisk0\DR0 - Size: 0x3B9E656000 ( 238.47 Gb ), SectorSize: 0x200, Cylinders: 0x799A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:33:28.0492 0x0388 Drive \Device\Harddisk2\DR2 - Size: 0xFB500000 ( 3.93 Gb ), SectorSize: 0x200, Cylinders: 0x200, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
16:33:28.0506 0x0388 ============================================================
16:33:28.0506 0x0388 \Device\Harddisk1\DR1:
16:33:28.0506 0x0388 MBR partitions:
16:33:28.0506 0x0388 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:33:28.0506 0x0388 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x38432800, BlocksNum 0x3C2D3000
16:33:28.0506 0x0388 \Device\Harddisk0\DR0:
16:33:28.0506 0x0388 MBR partitions:
16:33:28.0506 0x0388 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1DCF2000
16:33:28.0506 0x0388 \Device\Harddisk2\DR2:
16:33:28.0507 0x0388 MBR partitions:
16:33:28.0507 0x0388 ============================================================
16:33:28.0508 0x0388 C: <-> \Device\Harddisk0\DR0\Partition1
16:33:28.0509 0x0388 E: <-> \Device\Harddisk1\DR1\Partition2
16:33:28.0509 0x0388 ============================================================
16:33:28.0509 0x0388 Initialize success
16:33:28.0509 0x0388 ============================================================
16:33:43.0127 0x12cc ============================================================
16:33:43.0127 0x12cc Scan started
16:33:43.0127 0x12cc Mode: Manual; SigCheck; TDLFS;
16:33:43.0127 0x12cc ============================================================
16:33:43.0127 0x12cc KSN ping started
16:33:47.0583 0x12cc KSN ping finished: true
16:33:47.0880 0x12cc ================ Scan system memory ========================
16:33:47.0880 0x12cc System memory - ok
16:33:47.0880 0x12cc ================ Scan services =============================
16:33:47.0914 0x12cc [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
16:33:47.0949 0x12cc 1394ohci - ok
16:33:47.0959 0x12cc [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
16:33:47.0971 0x12cc ACPI - ok
16:33:47.0974 0x12cc [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
16:33:47.0987 0x12cc AcpiPmi - ok
16:33:47.0992 0x12cc [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:33:47.0999 0x12cc AdobeARMservice - ok
16:33:48.0028 0x12cc [ 00CC35F515079F5F94FABC3AC5C7D363, 7CE8B1715009602059DEDD6CBCA9C18EF079EDA344E7809813D6C0A395622B82 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
16:33:48.0038 0x12cc AdobeFlashPlayerUpdateSvc - ok
16:33:48.0048 0x12cc [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
16:33:48.0063 0x12cc adp94xx - ok
16:33:48.0070 0x12cc [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\drivers\adpahci.sys
16:33:48.0082 0x12cc adpahci - ok
16:33:48.0087 0x12cc [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
16:33:48.0096 0x12cc adpu320 - ok
16:33:48.0101 0x12cc [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
16:33:48.0146 0x12cc AeLookupSvc - ok
16:33:48.0156 0x12cc [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD C:\Windows\system32\drivers\afd.sys
16:33:48.0172 0x12cc AFD - ok
16:33:48.0176 0x12cc [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
16:33:48.0183 0x12cc agp440 - ok
16:33:48.0186 0x12cc [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
16:33:48.0197 0x12cc ALG - ok
16:33:48.0199 0x12cc [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
16:33:48.0205 0x12cc aliide - ok
16:33:48.0211 0x12cc [ B3B263B419FC9E7B1D41E61FDAE45BD9, AB4BA2472BB56B4BEB8B18D95B9F44BBF0B7FBF3C3914F5549CD24C5E4428664 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
16:33:48.0230 0x12cc AMD External Events Utility - ok
16:33:48.0233 0x12cc [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
16:33:48.0239 0x12cc amdide - ok
16:33:48.0243 0x12cc [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
16:33:48.0251 0x12cc AmdK8 - ok
16:33:48.0408 0x12cc [ 9A6E9363F7A5E5A06629D9DDC76EE6B5, F97553FF6D79CDA5A1B445E4A8F8799D9F5EE8BF31B11869DE0294C562845F7E ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
16:33:48.0586 0x12cc amdkmdag - ok
16:33:48.0601 0x12cc [ 957A4C13E1981B1701E600EF1E823C68, F8760C09F09F347D607FBE8A4F67E8B35CB82B5168954B04E8EB10B73412A609 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
16:33:48.0615 0x12cc amdkmdap - ok
16:33:48.0619 0x12cc [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
16:33:48.0627 0x12cc AmdPPM - ok
16:33:48.0631 0x12cc [ 6EC6D772EAE38DC17C14AED9B178D24B, B4FB936B31B1265B8CC6B426C64965C34D0CCF1638E645ACD65E88F4AFFC57A6 ] amdsata C:\Windows\system32\drivers\amdsata.sys
16:33:48.0639 0x12cc amdsata - ok
16:33:48.0644 0x12cc [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
16:33:48.0653 0x12cc amdsbs - ok
16:33:48.0655 0x12cc [ 1142A21DB581A84EA5597B03A26EBAA0, F94EB140D0CD068760D7EB081FF75154C75DAC75E5E24B6DE4E4F9CE65A70343 ] amdxata C:\Windows\system32\drivers\amdxata.sys
16:33:48.0662 0x12cc amdxata - ok
16:33:48.0682 0x12cc [ D908096B873B940BB438CE63BA35BD1E, F1C79C907E6CDBC2770C16AFFAE0D6F9B9B7DA21F5074D602AC5FE1597975748 ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
16:33:48.0701 0x12cc AntiVirMailService - ok
16:33:48.0710 0x12cc [ EC705D6ED3A7F3D9AE42F6239707D9FE, B50F6BB0FC308E7403B1807DF2AAF87BEDE0B044128C580970A26801CCABC43F ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
16:33:48.0721 0x12cc AntiVirSchedulerService - ok
16:33:48.0730 0x12cc [ EC705D6ED3A7F3D9AE42F6239707D9FE, B50F6BB0FC308E7403B1807DF2AAF87BEDE0B044128C580970A26801CCABC43F ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
16:33:48.0740 0x12cc AntiVirService - ok
16:33:48.0760 0x12cc [ 0F3D12E5FAE0082DB3F306095CA6B027, 726D054357031F45B43C87D798E84FA93439ECA6C691EB8C76FE524B50C25B32 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
16:33:48.0783 0x12cc AntiVirWebService - ok
16:33:48.0787 0x12cc [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID C:\Windows\system32\drivers\appid.sys
16:33:48.0797 0x12cc AppID - ok
16:33:48.0800 0x12cc [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc C:\Windows\System32\appidsvc.dll
16:33:48.0807 0x12cc AppIDSvc - ok
16:33:48.0810 0x12cc [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
16:33:48.0819 0x12cc Appinfo - ok
16:33:48.0824 0x12cc [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt C:\Windows\System32\appmgmts.dll
16:33:48.0834 0x12cc AppMgmt - ok
16:33:48.0838 0x12cc [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\drivers\arc.sys
16:33:48.0845 0x12cc arc - ok
16:33:48.0849 0x12cc [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\drivers\arcsas.sys
16:33:48.0856 0x12cc arcsas - ok
16:33:48.0867 0x12cc [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
16:33:48.0875 0x12cc aspnet_state - ok
16:33:48.0878 0x12cc [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
16:33:48.0898 0x12cc AsyncMac - ok
16:33:48.0901 0x12cc [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
16:33:48.0907 0x12cc atapi - ok
16:33:48.0911 0x12cc [ B0790FF0E25B7A2674296052F2162C1A, 930D1A09E93117E081C532D6EDB1E870736AE3806D13AE7F0C7748FD4EAB3D89 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
16:33:48.0963 0x12cc AtiHDAudioService - ok
16:33:48.0976 0x12cc [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
16:33:48.0995 0x12cc AudioEndpointBuilder - ok
16:33:49.0008 0x12cc [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv C:\Windows\System32\Audiosrv.dll
16:33:49.0024 0x12cc AudioSrv - ok
16:33:49.0029 0x12cc [ 43B6D229C7DBA9F0FC0FC0C318DB5350, F5A525DBD71FC4A323E92839C6D27F323FB304B7E9FFA35E89E9B419570AA4C8 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
16:33:49.0037 0x12cc avgntflt - ok
16:33:49.0042 0x12cc [ 626D1BAD7A1975A8FEE8876A8AD0EEA7, 59772746A2DF3B7E8D021756B8A64569AC8468CA1C802EB594494224354F1E60 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
16:33:49.0049 0x12cc avipbb - ok
16:33:49.0055 0x12cc [ 0D32033DCB359FD98B4C3513EF849FE6, 5870D67526BC29D888DAF8DBAB04B1E97ED5C7C51484ED400A5E65D0EB61576A ] Avira.OE.ServiceHost C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
16:33:49.0062 0x12cc Avira.OE.ServiceHost - ok
16:33:49.0065 0x12cc [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
16:33:49.0072 0x12cc avkmgr - ok
16:33:49.0075 0x12cc [ 13253E5E3B6BDF945B63B336A8C9489B, 671C716E43F89D4BDDAA2BE045CDEBBB569C85BC2BA334E1F550187B79A7740D ] avnetflt C:\Windows\system32\DRIVERS\avnetflt.sys
16:33:49.0081 0x12cc avnetflt - ok
16:33:49.0085 0x12cc [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
16:33:49.0103 0x12cc AxInstSV - ok
16:33:49.0112 0x12cc [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
16:33:49.0127 0x12cc b06bdrv - ok
16:33:49.0134 0x12cc [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
16:33:49.0145 0x12cc b57nd60a - ok
16:33:49.0150 0x12cc [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
16:33:49.0159 0x12cc BDESVC - ok
16:33:49.0162 0x12cc [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
16:33:49.0182 0x12cc Beep - ok
16:33:49.0196 0x12cc [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
16:33:49.0215 0x12cc BFE - ok
16:33:49.0231 0x12cc [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\System32\qmgr.dll
16:33:49.0295 0x12cc BITS - ok
16:33:49.0298 0x12cc [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
16:33:49.0306 0x12cc blbdrive - ok
16:33:49.0309 0x12cc [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
16:33:49.0318 0x12cc bowser - ok
16:33:49.0320 0x12cc [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
16:33:49.0329 0x12cc BrFiltLo - ok
16:33:49.0331 0x12cc [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
16:33:49.0340 0x12cc BrFiltUp - ok
16:33:49.0345 0x12cc [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
16:33:49.0355 0x12cc Browser - ok
16:33:49.0361 0x12cc [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
16:33:49.0374 0x12cc Brserid - ok
16:33:49.0377 0x12cc [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
16:33:49.0386 0x12cc BrSerWdm - ok
16:33:49.0389 0x12cc [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
16:33:49.0398 0x12cc BrUsbMdm - ok
16:33:49.0400 0x12cc [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
16:33:49.0407 0x12cc BrUsbSer - ok
16:33:49.0413 0x12cc [ DB109DA005B6FE2A350C5DD7CA768DFD, 241A0BFAEFB1B165C00EE75E8CA382B5935F5DF447DAD5AE9022B2B78317668E ] BrYNSvc C:\Program Files (x86)\Browny02\BrYNSvc.exe
16:33:49.0420 0x12cc BrYNSvc - detected UnsignedFile.Multi.Generic ( 1 )
16:33:51.0956 0x12cc Detect skipped due to KSN trusted
16:33:51.0956 0x12cc BrYNSvc - ok
16:33:51.0960 0x12cc [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
16:33:51.0971 0x12cc BTHMODEM - ok
16:33:51.0975 0x12cc [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
16:33:51.0997 0x12cc bthserv - ok
16:33:52.0001 0x12cc [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
16:33:52.0022 0x12cc cdfs - ok
16:33:52.0027 0x12cc [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
16:33:52.0036 0x12cc cdrom - ok
16:33:52.0039 0x12cc [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
16:33:52.0060 0x12cc CertPropSvc - ok
16:33:52.0063 0x12cc [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\drivers\circlass.sys
16:33:52.0072 0x12cc circlass - ok
16:33:52.0080 0x12cc [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS C:\Windows\system32\CLFS.sys
16:33:52.0093 0x12cc CLFS - ok
16:33:52.0140 0x12cc [ 42C5B8010D47EF3F4BAE6D1B427E80F4, 721C24522C43D50081EA01FD521D68EB365B91561CCF2E7AD1F091FBD61E67FB ] ClickToRunSvc C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
16:33:52.0186 0x12cc ClickToRunSvc - ok
16:33:52.0193 0x12cc [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:33:52.0200 0x12cc clr_optimization_v2.0.50727_32 - ok
16:33:52.0205 0x12cc [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:33:52.0213 0x12cc clr_optimization_v2.0.50727_64 - ok
16:33:52.0221 0x12cc [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:33:52.0230 0x12cc clr_optimization_v4.0.30319_32 - ok
16:33:52.0234 0x12cc [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:33:52.0244 0x12cc clr_optimization_v4.0.30319_64 - ok
16:33:52.0246 0x12cc [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
16:33:52.0254 0x12cc CmBatt - ok
16:33:52.0256 0x12cc [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
16:33:52.0263 0x12cc cmdide - ok
16:33:52.0272 0x12cc [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG C:\Windows\system32\Drivers\cng.sys
16:33:52.0288 0x12cc CNG - ok
16:33:52.0291 0x12cc [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
16:33:52.0298 0x12cc Compbatt - ok
16:33:52.0300 0x12cc [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
16:33:52.0309 0x12cc CompositeBus - ok
16:33:52.0311 0x12cc COMSysApp - ok
16:33:52.0314 0x12cc [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
16:33:52.0320 0x12cc crcdisk - ok
16:33:52.0326 0x12cc [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc C:\Windows\system32\cryptsvc.dll
16:33:52.0337 0x12cc CryptSvc - ok
16:33:52.0347 0x12cc [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC C:\Windows\system32\drivers\csc.sys
16:33:52.0363 0x12cc CSC - ok
16:33:52.0376 0x12cc [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService C:\Windows\System32\cscsvc.dll
16:33:52.0395 0x12cc CscService - ok
16:33:52.0398 0x12cc [ 44BDDEB03C84A1C993C992FFB5700357, 29080E9A434BB2A932783B0B5104BC9E3C514A0FFB387123B75F4F4045E353BC ] CVirtA C:\Windows\system32\DRIVERS\CVirtA64.sys
16:33:52.0403 0x12cc CVirtA - ok
16:33:52.0428 0x12cc [ 98C413E1A2FB6E5A4C101C25B3D0B275, 86C02211285F1807A6B276F07C56DE1A54BD5947E513884D8D971A22F4362849 ] CVPND C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
16:33:52.0455 0x12cc CVPND - ok
16:33:52.0463 0x12cc [ 79AF0E203D089AF442A3F70ED00A37FB, BF28BF9AEE23A3052D5ADA6C1B4C255C5F09DED69BB88D2CA3C011D2C3CFA8C1 ] CVPNDRVA C:\Windows\system32\Drivers\CVPNDRVA.sys
16:33:52.0473 0x12cc CVPNDRVA - ok
16:33:52.0486 0x12cc [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
16:33:52.0514 0x12cc DcomLaunch - ok
16:33:52.0521 0x12cc [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
16:33:52.0546 0x12cc defragsvc - ok
16:33:52.0550 0x12cc [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
16:33:52.0573 0x12cc DfsC - ok
16:33:52.0580 0x12cc [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
16:33:52.0605 0x12cc Dhcp - ok
16:33:52.0608 0x12cc [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
16:33:52.0630 0x12cc discache - ok
16:33:52.0633 0x12cc [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\drivers\disk.sys
16:33:52.0640 0x12cc Disk - ok
16:33:52.0643 0x12cc [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc C:\Windows\system32\drivers\dmvsc.sys
16:33:52.0652 0x12cc dmvsc - ok
16:33:52.0656 0x12cc [ 05CB5910B3CA6019FC3CCA815EE06FFB, 8FA532ED500BB1F08E8034A6125BDD53B74D5E6AB0A83A6185B07AAFCD90AA82 ] DNE C:\Windows\system32\DRIVERS\dne64x.sys
16:33:52.0663 0x12cc DNE - ok
16:33:52.0669 0x12cc [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
16:33:52.0680 0x12cc Dnscache - ok
16:33:52.0687 0x12cc [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
16:33:52.0711 0x12cc dot3svc - ok
16:33:52.0716 0x12cc [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
16:33:52.0738 0x12cc DPS - ok
16:33:52.0740 0x12cc [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
16:33:52.0747 0x12cc drmkaud - ok
16:33:52.0764 0x12cc [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
16:33:52.0787 0x12cc DXGKrnl - ok
16:33:52.0791 0x12cc [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
16:33:52.0813 0x12cc EapHost - ok
16:33:52.0865 0x12cc [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\drivers\evbda.sys
16:33:52.0925 0x12cc ebdrv - ok
16:33:52.0930 0x12cc [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] EFS C:\Windows\System32\lsass.exe
16:33:52.0938 0x12cc EFS - ok
16:33:52.0952 0x12cc [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
16:33:52.0973 0x12cc ehRecvr - ok
16:33:52.0977 0x12cc [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
16:33:52.0986 0x12cc ehSched - ok
16:33:52.0996 0x12cc [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\drivers\elxstor.sys
16:33:53.0010 0x12cc elxstor - ok
16:33:53.0013 0x12cc [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
16:33:53.0020 0x12cc ErrDev - ok
16:33:53.0023 0x12cc [ 84486624268E078255BC7AA47F0960BC, EC2540698B974572F0AC4A93D57C63295BAF66BF50F7416B9DFF5DE790EBDBE7 ] etdrv C:\Windows\etdrv.sys
16:33:53.0029 0x12cc etdrv - ok
16:33:53.0032 0x12cc [ FD291A75ECAF197F07BD2040C2A7322A, B4DE1B8A75928C8E6DF870A7B6F286EAA0B9A5D9443E99B66633F8B60013AC67 ] EtronHub3 C:\Windows\system32\Drivers\EtronHub3.sys
16:33:53.0040 0x12cc EtronHub3 - ok
16:33:53.0043 0x12cc [ DDE9068F9BAC0210195F217AA39B9276, 3AE8CE03B0F93EF6006B46F8DFD5523F6C1951D98FB9A411EA90261C368A453F ] EtronXHCI C:\Windows\system32\Drivers\EtronXHCI.sys
16:33:53.0051 0x12cc EtronXHCI - ok
16:33:53.0061 0x12cc [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
16:33:53.0088 0x12cc EventSystem - ok
16:33:53.0094 0x12cc [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
16:33:53.0117 0x12cc exfat - ok
16:33:53.0123 0x12cc [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
16:33:53.0146 0x12cc fastfat - ok
16:33:53.0159 0x12cc [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
16:33:53.0177 0x12cc Fax - ok
16:33:53.0181 0x12cc [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\drivers\fdc.sys
16:33:53.0189 0x12cc fdc - ok
16:33:53.0191 0x12cc [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
16:33:53.0212 0x12cc fdPHost - ok
16:33:53.0215 0x12cc [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
16:33:53.0236 0x12cc FDResPub - ok
16:33:53.0239 0x12cc [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
16:33:53.0246 0x12cc FileInfo - ok
16:33:53.0249 0x12cc [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
16:33:53.0269 0x12cc Filetrace - ok
16:33:53.0272 0x12cc [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
16:33:53.0279 0x12cc flpydisk - ok
16:33:53.0286 0x12cc [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
16:33:53.0296 0x12cc FltMgr - ok
16:33:53.0316 0x12cc [ E612E86FA15EA1EF9A52433A2743C447, 8A66164541D2EE2334B6DE3995C31138EA85E3A06BC7FD901E60D345E4E1E8A8 ] FontCache C:\Windows\system32\FntCache.dll
16:33:53.0343 0x12cc FontCache - ok
16:33:53.0347 0x12cc [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:33:53.0353 0x12cc FontCache3.0.0.0 - ok
16:33:53.0356 0x12cc [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
16:33:53.0362 0x12cc FsDepends - ok
16:33:53.0365 0x12cc [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
16:33:53.0371 0x12cc Fs_Rec - ok
16:33:53.0377 0x12cc [ 1F7B25B858FA27015169FE95E54108ED, 72DD12E924AA7273B3E4BDD2A2C581DECE304C8EF3D44EA79ABB032F3F95DCE5 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
16:33:53.0388 0x12cc fvevol - ok
16:33:53.0392 0x12cc [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
16:33:53.0399 0x12cc gagp30kx - ok
16:33:53.0402 0x12cc [ 7907E14F9BCF3A4689C9A74A1A873CB6, 17927B93B2D6AB4271C158F039CAE2D60591D6A14458F5A5690AEC86F5D54229 ] gdrv C:\Windows\gdrv.sys
16:33:53.0407 0x12cc gdrv - ok
16:33:53.0410 0x12cc [ 5D4DF0BAC74E9AC62AF6BC99440B050B, 655110646BFF890C448C0951E11132DC3592BDA6E080696341B930D090224723 ] GPCIDrv C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys
16:33:53.0414 0x12cc GPCIDrv - ok
16:33:53.0428 0x12cc [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
16:33:53.0460 0x12cc gpsvc - ok
16:33:53.0465 0x12cc [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:33:53.0471 0x12cc gupdate - ok
16:33:53.0475 0x12cc [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:33:53.0481 0x12cc gupdatem - ok
16:33:53.0484 0x12cc [ 8126331FBD4ED29EB3B356F9C905064D, A58BCE904591DD762410E99960FD956FB579C2CE78FA7BF1406075D29537EF82 ] GVTDrv64 C:\Windows\GVTDrv64.sys
16:33:53.0490 0x12cc GVTDrv64 - ok
16:33:53.0492 0x12cc [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
16:33:53.0500 0x12cc hcw85cir - ok
16:33:53.0507 0x12cc [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
16:33:53.0522 0x12cc HdAudAddService - ok
16:33:53.0526 0x12cc [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
16:33:53.0536 0x12cc HDAudBus - ok
16:33:53.0539 0x12cc [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
16:33:53.0546 0x12cc HidBatt - ok
16:33:53.0550 0x12cc [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\drivers\hidbth.sys
16:33:53.0560 0x12cc HidBth - ok
16:33:53.0563 0x12cc [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\drivers\hidir.sys
16:33:53.0572 0x12cc HidIr - ok
16:33:53.0575 0x12cc [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\system32\hidserv.dll
16:33:53.0595 0x12cc hidserv - ok
16:33:53.0598 0x12cc [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
16:33:53.0606 0x12cc HidUsb - ok
16:33:53.0609 0x12cc [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
16:33:53.0631 0x12cc hkmsvc - ok
16:33:53.0636 0x12cc [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
16:33:53.0648 0x12cc HomeGroupListener - ok
16:33:53.0654 0x12cc [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
16:33:53.0664 0x12cc HomeGroupProvider - ok
16:33:53.0667 0x12cc [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
16:33:53.0674 0x12cc HpSAMD - ok
16:33:53.0689 0x12cc [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP C:\Windows\system32\drivers\HTTP.sys
16:33:53.0709 0x12cc HTTP - ok
16:33:53.0712 0x12cc [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
16:33:53.0718 0x12cc hwpolicy - ok
16:33:53.0722 0x12cc [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
16:33:53.0730 0x12cc i8042prt - ok
16:33:53.0739 0x12cc [ 3DF4395A7CF8B7A72A5F4606366B8C2D, 483588B8FC6E05488ED631C4E1CFC398553FEBFA2CD2BB527B4DF12D19774F80 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
16:33:53.0752 0x12cc iaStorV - ok
16:33:53.0757 0x12cc [ 33D4D4A24791587E83F7EE05A446FB7E, 081E48AF76D7D3A71850A4C910EFBB0B280235E2A5303178B0338230F4BA2DE2 ] ICCS C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
16:33:53.0763 0x12cc ICCS - detected UnsignedFile.Multi.Generic ( 1 )
16:33:56.0304 0x12cc Detect skipped due to KSN trusted
16:33:56.0304 0x12cc ICCS - ok
16:33:56.0308 0x12cc [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
16:33:56.0314 0x12cc IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
16:33:58.0861 0x12cc Detect skipped due to KSN trusted
16:33:58.0861 0x12cc IDriverT - ok
16:33:58.0876 0x12cc [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:33:58.0897 0x12cc idsvc - ok
16:33:58.0899 0x12cc IEEtwCollectorService - ok
16:33:58.0902 0x12cc [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\drivers\iirsp.sys
16:33:58.0909 0x12cc iirsp - ok
16:33:58.0924 0x12cc [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
16:33:58.0945 0x12cc IKEEXT - ok
16:33:58.0960 0x12cc [ DAE6C3099D291EED8922A65C29ABCF52, AD0A932345382824122F84AF97A8609BAE1B916A3B9FD608779A1411E37D3643 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
16:33:58.0976 0x12cc Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 )
16:34:01.0527 0x12cc Detect skipped due to KSN trusted
16:34:01.0528 0x12cc Intel(R) Capability Licensing Service Interface - ok
16:34:01.0542 0x12cc [ D45226E3E7A25F1E7CE8DF8FD0A2A098, 7BD74E9E3CB0A83D26BA3FD8177C6B9BA46A8695B6569CF7887FDC87947DA2D6 ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
16:34:01.0561 0x12cc Intel(R) Capability Licensing Service TCP IP Interface - ok
16:34:01.0564 0x12cc [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
16:34:01.0571 0x12cc intelide - ok
16:34:01.0574 0x12cc [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
16:34:01.0582 0x12cc intelppm - ok
16:34:01.0586 0x12cc [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
16:34:01.0608 0x12cc IPBusEnum - ok
16:34:01.0612 0x12cc [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:34:01.0632 0x12cc IpFilterDriver - ok
16:34:01.0643 0x12cc [ A34A587FFFD45FA649FBA6D03784D257, C9A2BCD4E2A5EB6E320092A3AFD5737ECDCDA0B83EE42314A23C4978F2974767 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
16:34:01.0671 0x12cc iphlpsvc - ok
16:34:01.0675 0x12cc [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
16:34:01.0683 0x12cc IPMIDRV - ok
16:34:01.0687 0x12cc [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
16:34:01.0709 0x12cc IPNAT - ok
16:34:01.0712 0x12cc [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
16:34:01.0722 0x12cc IRENUM - ok
16:34:01.0724 0x12cc [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
16:34:01.0730 0x12cc isapnp - ok
16:34:01.0736 0x12cc [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
16:34:01.0747 0x12cc iScsiPrt - ok
16:34:01.0749 0x12cc [ B2381712638B0B714D0EEAB9A1F7C640, 113BCA8868057156EFDC7C079171308C1EBA4F979C85EB1265F42F95A499B086 ] iusb3hcs C:\Windows\system32\DRIVERS\iusb3hcs.sys
16:34:01.0755 0x12cc iusb3hcs - ok
16:34:01.0762 0x12cc [ FD2C6457232E95C014DAD21DEBC64867, 4CC4F488A2555761208D8401265788281B6EC76A8F16C8E115778E571450B90B ] iusb3hub C:\Windows\system32\DRIVERS\iusb3hub.sys
16:34:01.0772 0x12cc iusb3hub - ok
16:34:01.0787 0x12cc [ F6A2B5D030BE7EDF8ADC12C9A40825A8, 03EFAFD6B7801D83D7689435DED8DC321D153AAC4FD69D46ED8C9D7E7F56B44A ] iusb3xhc C:\Windows\system32\DRIVERS\iusb3xhc.sys
16:34:01.0805 0x12cc iusb3xhc - ok
16:34:01.0810 0x12cc [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
16:34:01.0818 0x12cc jhi_service - ok
16:34:01.0821 0x12cc [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
16:34:01.0827 0x12cc kbdclass - ok
16:34:01.0830 0x12cc [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
16:34:01.0838 0x12cc kbdhid - ok
16:34:01.0840 0x12cc [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] KeyIso C:\Windows\system32\lsass.exe
16:34:01.0847 0x12cc KeyIso - ok
16:34:01.0850 0x12cc [ C93EB3A92540830168F2057ECA7DE49A, 91DAEAD52B517E1E7CE9AAAE478493732156AA3122E6D16F7E8BD37116BB501C ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
16:34:01.0858 0x12cc KSecDD - ok
16:34:01.0862 0x12cc [ 43F45C59A472993E5063F2DB2D22C509, E21B48733619B49272F46E01432D76072AC9241F55CDF08E84AF6277E3BF972A ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
16:34:01.0870 0x12cc KSecPkg - ok
16:34:01.0873 0x12cc [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
16:34:01.0893 0x12cc ksthunk - ok
16:34:01.0901 0x12cc [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
16:34:01.0927 0x12cc KtmRm - ok
16:34:01.0931 0x12cc [ 7867CACBF7B23AD04F5D18657BF15FA2, 153763A0C4A347526BCC2A502B5B0BC323AEC4035F1D7A8C85479FEDA0AD8A0C ] L1C C:\Windows\system32\DRIVERS\L1C62x64.sys
16:34:01.0939 0x12cc L1C - ok
16:34:01.0944 0x12cc [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\system32\srvsvc.dll
16:34:01.0968 0x12cc LanmanServer - ok
16:34:01.0972 0x12cc [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
16:34:01.0994 0x12cc LanmanWorkstation - ok
16:34:01.0998 0x12cc [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
16:34:02.0019 0x12cc lltdio - ok
16:34:02.0026 0x12cc [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
16:34:02.0053 0x12cc lltdsvc - ok
16:34:02.0055 0x12cc [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
16:34:02.0077 0x12cc lmhosts - ok
16:34:02.0085 0x12cc [ 3DE66F47365AA8CEB18B1EE272F4FEBA, 8DDD6AB4AEDE3B2FEA0D3B63DD24E3F3422D6ADE067756A3919FCED53C349167 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
16:34:02.0096 0x12cc LMS - ok
16:34:02.0101 0x12cc [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
16:34:02.0108 0x12cc LSI_FC - ok
16:34:02.0112 0x12cc [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
16:34:02.0119 0x12cc LSI_SAS - ok
16:34:02.0122 0x12cc [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
16:34:02.0129 0x12cc LSI_SAS2 - ok
16:34:02.0133 0x12cc [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
16:34:02.0140 0x12cc LSI_SCSI - ok
16:34:02.0144 0x12cc [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
16:34:02.0166 0x12cc luafv - ok
16:34:02.0169 0x12cc [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
16:34:02.0178 0x12cc Mcx2Svc - ok
16:34:02.0181 0x12cc [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\drivers\megasas.sys
16:34:02.0187 0x12cc megasas - ok
16:34:02.0193 0x12cc [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
16:34:02.0204 0x12cc MegaSR - ok
16:34:02.0208 0x12cc [ E0EF6C1399A9B1AAA0B28590411BED04, 10C193D1ED434A6DC2AD8C450012B9AF1C848A0A0B3B775F13495648FB77E009 ] MEIx64 C:\Windows\system32\DRIVERS\TeeDriverx64.sys
16:34:02.0214 0x12cc MEIx64 - ok
16:34:02.0218 0x12cc [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
16:34:02.0239 0x12cc MMCSS - ok
16:34:02.0242 0x12cc [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
16:34:02.0263 0x12cc Modem - ok
16:34:02.0265 0x12cc [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
16:34:02.0274 0x12cc monitor - ok
16:34:02.0277 0x12cc [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
16:34:02.0284 0x12cc mouclass - ok
16:34:02.0286 0x12cc [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
16:34:02.0294 0x12cc mouhid - ok
16:34:02.0298 0x12cc [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
16:34:02.0305 0x12cc mountmgr - ok
16:34:02.0310 0x12cc [ DD370A8148862150BA81A3F5C56A1E40, F56B84297BDC32266CB69D10FB2D66B8B332D60CAB7E64E4E3AC2BB749BBD31B ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
16:34:02.0318 0x12cc MozillaMaintenance - ok
16:34:02.0323 0x12cc [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
16:34:02.0331 0x12cc mpio - ok
16:34:02.0335 0x12cc [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
16:34:02.0357 0x12cc mpsdrv - ok
16:34:02.0372 0x12cc [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
16:34:02.0405 0x12cc MpsSvc - ok
16:34:02.0410 0x12cc [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
16:34:02.0419 0x12cc MRxDAV - ok
16:34:02.0424 0x12cc [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
16:34:02.0433 0x12cc mrxsmb - ok
16:34:02.0440 0x12cc [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:34:02.0452 0x12cc mrxsmb10 - ok
16:34:02.0456 0x12cc [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:34:02.0464 0x12cc mrxsmb20 - ok
16:34:02.0467 0x12cc [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\DRIVERS\msahci.sys
16:34:02.0473 0x12cc msahci - ok
16:34:02.0478 0x12cc [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
16:34:02.0486 0x12cc msdsm - ok
16:34:02.0490 0x12cc [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
16:34:02.0500 0x12cc MSDTC - ok
16:34:02.0505 0x12cc [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
16:34:02.0526 0x12cc Msfs - ok
16:34:02.0529 0x12cc [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
16:34:02.0549 0x12cc mshidkmdf - ok
16:34:02.0552 0x12cc [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
16:34:02.0558 0x12cc msisadrv - ok
16:34:02.0562 0x12cc [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
16:34:02.0585 0x12cc MSiSCSI - ok
16:34:02.0587 0x12cc msiserver - ok
16:34:02.0589 0x12cc [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
16:34:02.0609 0x12cc MSKSSRV - ok
16:34:02.0612 0x12cc [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
16:34:02.0632 0x12cc MSPCLOCK - ok
16:34:02.0634 0x12cc [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
16:34:02.0654 0x12cc MSPQM - ok
16:34:02.0662 0x12cc [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
16:34:02.0674 0x12cc MsRPC - ok
16:34:02.0678 0x12cc [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
16:34:02.0684 0x12cc mssmbios - ok
16:34:02.0686 0x12cc [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
16:34:02.0706 0x12cc MSTEE - ok
16:34:02.0709 0x12cc [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
16:34:02.0716 0x12cc MTConfig - ok
16:34:02.0719 0x12cc [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
16:34:02.0726 0x12cc Mup - ok
16:34:02.0735 0x12cc [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
16:34:02.0763 0x12cc napagent - ok
16:34:02.0770 0x12cc [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
16:34:02.0785 0x12cc NativeWifiP - ok
16:34:02.0802 0x12cc [ 79B47FD40D9A817E932F9D26FAC0A81C, 53E260B8BFC50BA45FA73BFCF4E58C233890D0EAA9DEFDCCBB55FD3EB992FF2D ] NDIS C:\Windows\system32\drivers\ndis.sys
16:34:02.0826 0x12cc NDIS - ok
16:34:02.0829 0x12cc [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
16:34:02.0849 0x12cc NdisCap - ok
16:34:02.0852 0x12cc [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
16:34:02.0872 0x12cc NdisTapi - ok
16:34:02.0875 0x12cc [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
16:34:02.0896 0x12cc Ndisuio - ok
16:34:02.0900 0x12cc [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
16:34:02.0923 0x12cc NdisWan - ok
16:34:02.0926 0x12cc [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
16:34:02.0946 0x12cc NDProxy - ok
16:34:02.0949 0x12cc [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
16:34:02.0970 0x12cc NetBIOS - ok
16:34:02.0977 0x12cc [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
16:34:03.0000 0x12cc NetBT - ok
16:34:03.0003 0x12cc [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] Netlogon C:\Windows\system32\lsass.exe
16:34:03.0010 0x12cc Netlogon - ok
16:34:03.0017 0x12cc [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
16:34:03.0043 0x12cc Netman - ok
16:34:03.0048 0x12cc [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0058 0x12cc NetMsmqActivator - ok
16:34:03.0061 0x12cc [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0070 0x12cc NetPipeActivator - ok
16:34:03.0079 0x12cc [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
16:34:03.0107 0x12cc netprofm - ok
16:34:03.0111 0x12cc [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0119 0x12cc NetTcpActivator - ok
16:34:03.0123 0x12cc [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0132 0x12cc NetTcpPortSharing - ok
16:34:03.0134 0x12cc [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
16:34:03.0141 0x12cc nfrd960 - ok
16:34:03.0148 0x12cc [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc C:\Windows\System32\nlasvc.dll
16:34:03.0160 0x12cc NlaSvc - ok
16:34:03.0163 0x12cc [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
16:34:03.0183 0x12cc Npfs - ok
16:34:03.0186 0x12cc [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
16:34:03.0207 0x12cc nsi - ok
16:34:03.0210 0x12cc [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
16:34:03.0230 0x12cc nsiproxy - ok
16:34:03.0258 0x12cc [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
16:34:03.0292 0x12cc Ntfs - ok
16:34:03.0295 0x12cc [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
16:34:03.0316 0x12cc Null - ok
16:34:03.0320 0x12cc [ 5D9FD91F3D38DC9DA01E3CB5FA89CD48, 7738785DE8B50D69993F4408498B812D0283FEE5C04FF5B89C20F149B44E9737 ] nvraid C:\Windows\system32\drivers\nvraid.sys
16:34:03.0329 0x12cc nvraid - ok
16:34:03.0333 0x12cc [ F7CD50FE7139F07E77DA8AC8033D1832, DA96F4B15C8165E6AE1D00E03A062C66CA3A3089E4FF0E9E11CE00B154DD12EC ] nvstor C:\Windows\system32\drivers\nvstor.sys
16:34:03.0342 0x12cc nvstor - ok
16:34:03.0346 0x12cc [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
16:34:03.0354 0x12cc nv_agp - ok
16:34:03.0357 0x12cc [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
16:34:03.0365 0x12cc ohci1394 - ok
16:34:03.0369 0x12cc [ 30B5F9FB0C35AE6B4A0851D24CE2EE8B, 0340E77E8EC2ADC21B8DDD9C9CC95B3F4BCAFD54618A333C72D7D9587D593B83 ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:34:03.0378 0x12cc ose - ok
16:34:03.0458 0x12cc [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:34:03.0550 0x12cc osppsvc - ok
16:34:03.0561 0x12cc [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
16:34:03.0575 0x12cc p2pimsvc - ok
16:34:03.0584 0x12cc [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
16:34:03.0598 0x12cc p2psvc - ok
16:34:03.0602 0x12cc [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\drivers\parport.sys
16:34:03.0610 0x12cc Parport - ok
16:34:03.0614 0x12cc [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
16:34:03.0621 0x12cc partmgr - ok
16:34:03.0626 0x12cc [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc C:\Windows\System32\pcasvc.dll
16:34:03.0637 0x12cc PcaSvc - ok
16:34:03.0642 0x12cc [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
16:34:03.0650 0x12cc pci - ok
16:34:03.0652 0x12cc [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
16:34:03.0658 0x12cc pciide - ok
16:34:03.0664 0x12cc [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
16:34:03.0673 0x12cc pcmcia - ok
16:34:03.0676 0x12cc [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
16:34:03.0682 0x12cc pcw - ok
16:34:03.0694 0x12cc [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
16:34:03.0712 0x12cc PEAUTH - ok
16:34:03.0735 0x12cc [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
16:34:03.0765 0x12cc PeerDistSvc - ok
16:34:03.0788 0x12cc [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
16:34:03.0796 0x12cc PerfHost - ok
16:34:03.0822 0x12cc [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
16:34:03.0865 0x12cc pla - ok
16:34:03.0875 0x12cc [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
16:34:03.0889 0x12cc PlugPlay - ok
16:34:03.0892 0x12cc [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
16:34:03.0900 0x12cc PNRPAutoReg - ok
16:34:03.0907 0x12cc [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
16:34:03.0918 0x12cc PNRPsvc - ok
16:34:03.0928 0x12cc [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
16:34:03.0956 0x12cc PolicyAgent - ok
16:34:03.0962 0x12cc [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
16:34:03.0986 0x12cc Power - ok
16:34:03.0990 0x12cc [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
16:34:04.0011 0x12cc PptpMiniport - ok
16:34:04.0014 0x12cc [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\drivers\processr.sys
16:34:04.0022 0x12cc Processor - ok
16:34:04.0027 0x12cc [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc C:\Windows\system32\profsvc.dll
16:34:04.0038 0x12cc ProfSvc - ok
16:34:04.0041 0x12cc [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] ProtectedStorage C:\Windows\system32\lsass.exe
16:34:04.0048 0x12cc ProtectedStorage - ok
16:34:04.0052 0x12cc [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
16:34:04.0073 0x12cc Psched - ok
16:34:04.0098 0x12cc [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
16:34:04.0130 0x12cc ql2300 - ok
16:34:04.0135 0x12cc [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
16:34:04.0143 0x12cc ql40xx - ok
16:34:04.0149 0x12cc [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
16:34:04.0163 0x12cc QWAVE - ok
16:34:04.0166 0x12cc [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
16:34:04.0176 0x12cc QWAVEdrv - ok
16:34:04.0178 0x12cc [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
16:34:04.0199 0x12cc RasAcd - ok
16:34:04.0202 0x12cc [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
16:34:04.0223 0x12cc RasAgileVpn - ok
16:34:04.0227 0x12cc [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
16:34:04.0249 0x12cc RasAuto - ok
16:34:04.0253 0x12cc [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
16:34:04.0275 0x12cc Rasl2tp - ok
16:34:04.0282 0x12cc [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
16:34:04.0308 0x12cc RasMan - ok
16:34:04.0312 0x12cc [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
16:34:04.0333 0x12cc RasPppoe - ok
16:34:04.0337 0x12cc [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
16:34:04.0358 0x12cc RasSstp - ok
16:34:04.0365 0x12cc [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
16:34:04.0390 0x12cc rdbss - ok
16:34:04.0393 0x12cc [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
16:34:04.0402 0x12cc rdpbus - ok
16:34:04.0404 0x12cc [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
16:34:04.0423 0x12cc RDPCDD - ok
16:34:04.0429 0x12cc [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
16:34:04.0439 0x12cc RDPDR - ok
16:34:04.0442 0x12cc [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
16:34:04.0461 0x12cc RDPENCDD - ok
16:34:04.0465 0x12cc [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
16:34:04.0485 0x12cc RDPREFMP - ok
16:34:04.0490 0x12cc [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
16:34:04.0501 0x12cc RDPWD - ok
16:34:04.0506 0x12cc [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
16:34:04.0515 0x12cc rdyboost - ok
16:34:04.0522 0x12cc [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
16:34:04.0544 0x12cc RemoteAccess - ok
16:34:04.0549 0x12cc [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
16:34:04.0573 0x12cc RemoteRegistry - ok
16:34:04.0576 0x12cc [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
16:34:04.0598 0x12cc RpcEptMapper - ok
16:34:04.0600 0x12cc [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
16:34:04.0608 0x12cc RpcLocator - ok
16:34:04.0618 0x12cc [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
16:34:04.0645 0x12cc RpcSs - ok
16:34:04.0648 0x12cc [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
16:34:04.0670 0x12cc rspndr - ok
16:34:04.0673 0x12cc [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap C:\Windows\system32\drivers\vms3cap.sys
16:34:04.0680 0x12cc s3cap - ok
16:34:04.0682 0x12cc [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] SamSs C:\Windows\system32\lsass.exe
16:34:04.0689 0x12cc SamSs - ok
16:34:04.0692 0x12cc [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
16:34:04.0700 0x12cc sbp2port - ok
16:34:04.0705 0x12cc [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
16:34:04.0729 0x12cc SCardSvr - ok
16:34:04.0731 0x12cc [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
16:34:04.0751 0x12cc scfilter - ok
16:34:04.0769 0x12cc [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
16:34:04.0813 0x12cc Schedule - ok
16:34:04.0817 0x12cc [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
16:34:04.0838 0x12cc SCPolicySvc - ok
16:34:04.0843 0x12cc [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
16:34:04.0854 0x12cc SDRSVC - ok
16:34:04.0857 0x12cc [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
16:34:04.0877 0x12cc secdrv - ok
16:34:04.0880 0x12cc [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
16:34:04.0901 0x12cc seclogon - ok
16:34:04.0904 0x12cc [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\System32\sens.dll
16:34:04.0926 0x12cc SENS - ok
16:34:04.0929 0x12cc [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
16:34:04.0937 0x12cc SensrSvc - ok
16:34:04.0939 0x12cc [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
16:34:04.0946 0x12cc Serenum - ok
16:34:04.0950 0x12cc [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
16:34:04.0958 0x12cc Serial - ok
16:34:04.0961 0x12cc [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\drivers\sermouse.sys
16:34:04.0968 0x12cc sermouse - ok
16:34:04.0975 0x12cc [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
16:34:04.0997 0x12cc SessionEnv - ok
16:34:05.0000 0x12cc [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
16:34:05.0000 0x12cc sffdisk - ok
16:34:05.0000 0x12cc [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
16:34:05.0016 0x12cc sffp_mmc - ok
16:34:05.0016 0x12cc [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
16:34:05.0016 0x12cc sffp_sd - ok
16:34:05.0031 0x12cc [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
16:34:05.0031 0x12cc sfloppy - ok
16:34:05.0047 0x12cc [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
16:34:05.0063 0x12cc SharedAccess - ok
16:34:05.0078 0x12cc [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
16:34:05.0094 0x12cc ShellHWDetection - ok
16:34:05.0109 0x12cc [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
16:34:05.0109 0x12cc SiSRaid2 - ok
16:34:05.0109 0x12cc [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
16:34:05.0125 0x12cc SiSRaid4 - ok
16:34:05.0125 0x12cc [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
16:34:05.0141 0x12cc Smb - ok
16:34:05.0141 0x12cc [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
16:34:05.0156 0x12cc SNMPTRAP - ok
16:34:05.0156 0x12cc [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
16:34:05.0172 0x12cc spldr - ok
16:34:05.0172 0x12cc [ B96C17B5DC1424D56EEA3A99E97428CD, AF0A85066A7983878DC1C663811CE61C6CA1912DC956184F878B7B82DB93C651 ] Spooler C:\Windows\System32\spoolsv.exe
16:34:05.0203 0x12cc Spooler - ok
16:34:05.0265 0x12cc [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
16:34:05.0343 0x12cc sppsvc - ok
16:34:05.0343 0x12cc [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
16:34:05.0375 0x12cc sppuinotify - ok
16:34:05.0375 0x12cc [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
16:34:05.0390 0x12cc srv - ok
16:34:05.0406 0x12cc [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
16:34:05.0406 0x12cc srv2 - ok
16:34:05.0421 0x12cc [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
16:34:05.0421 0x12cc srvnet - ok
16:34:05.0437 0x12cc [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
16:34:05.0453 0x12cc SSDPSRV - ok
16:34:05.0453 0x12cc [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
16:34:05.0484 0x12cc SstpSvc - ok
16:34:05.0499 0x12cc [ 5317D001B40EAF91ECA71644F1B984C6, 43F2D5E025527EE19483D0FCA1C8559740556B8F60EE1B4D6AC4BFB826F4162D ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
16:34:05.0515 0x12cc Steam Client Service - ok
16:34:05.0515 0x12cc [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\drivers\stexstor.sys
16:34:05.0531 0x12cc stexstor - ok
16:34:05.0531 0x12cc [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam C:\Windows\system32\DRIVERS\serscan.sys
16:34:05.0531 0x12cc StillCam - ok
16:34:05.0546 0x12cc [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
16:34:05.0562 0x12cc stisvc - ok
16:34:05.0562 0x12cc [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt C:\Windows\system32\drivers\vmstorfl.sys
16:34:05.0577 0x12cc storflt - ok
16:34:05.0577 0x12cc [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc C:\Windows\system32\storsvc.dll
16:34:05.0577 0x12cc StorSvc - ok
16:34:05.0593 0x12cc [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc C:\Windows\system32\drivers\storvsc.sys
16:34:05.0593 0x12cc storvsc - ok
16:34:05.0593 0x12cc [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
16:34:05.0624 0x12cc swenum - ok
16:34:05.0624 0x12cc [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
16:34:05.0655 0x12cc swprv - ok
16:34:05.0687 0x12cc [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
16:34:05.0718 0x12cc SysMain - ok
16:34:05.0733 0x12cc [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
16:34:05.0733 0x12cc TabletInputService - ok
16:34:05.0749 0x12cc [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
16:34:05.0765 0x12cc TapiSrv - ok
16:34:05.0780 0x12cc [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
16:34:05.0796 0x12cc TBS - ok
16:34:05.0827 0x12cc [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
16:34:05.0858 0x12cc Tcpip - ok
16:34:05.0889 0x12cc [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
16:34:05.0921 0x12cc TCPIP6 - ok
16:34:05.0936 0x12cc [ DF687E3D8836BFB04FCC0615BF15A519, 7C5B1E72673B4299DFC21E869F0FBB28198CA54DF4F4AF7080005F2D82467784 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
16:34:05.0952 0x12cc tcpipreg - ok
16:34:05.0952 0x12cc [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
16:34:05.0967 0x12cc TDPIPE - ok
16:34:05.0967 0x12cc [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
16:34:05.0967 0x12cc TDTCP - ok
16:34:05.0983 0x12cc [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
16:34:05.0999 0x12cc tdx - ok
16:34:06.0077 0x12cc [ 4ACFC5853A3F0C6C2F54E537C23EE90F, 47D81F471A250696A1A0D19294FC553EB88D813612A8351C89F65D7BF99C8532 ] TeamViewer9 C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
16:34:06.0155 0x12cc TeamViewer9 - ok
16:34:06.0155 0x12cc [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
16:34:06.0170 0x12cc TermDD - ok
16:34:06.0170 0x12cc [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService C:\Windows\System32\termsrv.dll
16:34:06.0186 0x12cc TermService - ok
16:34:06.0201 0x12cc [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
16:34:06.0201 0x12cc Themes - ok
16:34:06.0217 0x12cc [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
16:34:06.0233 0x12cc THREADORDER - ok
16:34:06.0233 0x12cc [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
16:34:06.0264 0x12cc TrkWks - ok
16:34:06.0264 0x12cc [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
16:34:06.0279 0x12cc TrustedInstaller - ok
16:34:06.0295 0x12cc [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
16:34:06.0295 0x12cc tssecsrv - ok
16:34:06.0295 0x12cc [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
16:34:06.0311 0x12cc TsUsbFlt - ok
16:34:06.0311 0x12cc [ 9CC2CCAE8A84820EAECB886D477CBCB8, 50D8AA2D7477A6618A0C31BB4D1C4887B457865FB1105E2E7B984EEFA337B804 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
16:34:06.0326 0x12cc TsUsbGD - ok
16:34:06.0326 0x12cc [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
16:34:06.0342 0x12cc tunnel - ok
16:34:06.0342 0x12cc [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
16:34:06.0357 0x12cc uagp35 - ok
16:34:06.0357 0x12cc [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
16:34:06.0389 0x12cc udfs - ok
16:34:06.0389 0x12cc [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
16:34:06.0404 0x12cc UI0Detect - ok
16:34:06.0404 0x12cc [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
16:34:06.0404 0x12cc uliagpkx - ok
16:34:06.0420 0x12cc [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\DRIVERS\umbus.sys
16:34:06.0420 0x12cc umbus - ok
16:34:06.0420 0x12cc [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\drivers\umpass.sys
16:34:06.0435 0x12cc UmPass - ok
16:34:06.0435 0x12cc [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService C:\Windows\System32\umrdp.dll
16:34:06.0451 0x12cc UmRdpService - ok
16:34:06.0451 0x12cc [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
16:34:06.0482 0x12cc upnphost - ok
16:34:06.0482 0x12cc [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
16:34:06.0498 0x12cc usbccgp - ok
16:34:06.0498 0x12cc [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
16:34:06.0513 0x12cc usbcir - ok
16:34:06.0513 0x12cc [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\drivers\usbehci.sys
16:34:06.0513 0x12cc usbehci - ok
16:34:06.0529 0x12cc [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
16:34:06.0545 0x12cc usbhub - ok
16:34:06.0545 0x12cc [ 58E546BBAF87664FC57E0F6081E4F609, 1DD99D57369A0069654432AB5325AFD8F7D422D531E053EA05FF664BA6BDAEF9 ] usbohci C:\Windows\system32\drivers\usbohci.sys
16:34:06.0545 0x12cc usbohci - ok
16:34:06.0545 0x12cc [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\drivers\usbprint.sys
16:34:06.0560 0x12cc usbprint - ok
16:34:06.0560 0x12cc [ D76510CFA0FC09023077F22C2F979D86, 5662281C6D515423255D3C262EA368DBAFC250235E535FBFA3E59D3487695439 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:34:06.0576 0x12cc USBSTOR - ok
16:34:06.0576 0x12cc [ 81FB2216D3A60D1284455D511797DB3D, 121E52B18A1832E775EA0AE2E053BAA53E5A70E9754724B1449AE5992D63B13E ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
16:34:06.0576 0x12cc usbuhci - ok
16:34:06.0591 0x12cc [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
16:34:06.0607 0x12cc UxSms - ok
16:34:06.0607 0x12cc [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] VaultSvc C:\Windows\system32\lsass.exe
16:34:06.0607 0x12cc VaultSvc - ok
16:34:06.0638 0x12cc [ 774E0B5708EC5F8FE3FAE063AD741D1E, 2392DF6EA79634F842B6B1E96988D58ECCE456361C03BB691D4002D5370D57F0 ] VBoxDrv C:\Windows\system32\DRIVERS\VBoxDrv.sys
16:34:06.0654 0x12cc VBoxDrv - ok
16:34:06.0654 0x12cc [ 348A3A2F65CFF137440127A98C307102, 4152AAE06F4A992FBD57F7BB86D5ACFF3FA0A41AB0E68B0A457ECAAF83088D3E ] VBoxNetAdp C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
16:34:06.0669 0x12cc VBoxNetAdp - ok
16:34:06.0669 0x12cc [ C9232E8BC7DE065C88586A6A8089C94E, DC1C7812F4D014B1106ED8E2FDBAC0D12622C75365B22E0D770F412265F52C77 ] VBoxNetFlt C:\Windows\system32\DRIVERS\VBoxNetFlt.sys
16:34:06.0669 0x12cc VBoxNetFlt - ok
16:34:06.0685 0x12cc [ 79B223A37527EF773621F656310CE525, 8E0252CEC55F4D06849C13EBFA931D40C22BC3EB3D5092764F057C4DE77935E1 ] VBoxUSBMon C:\Windows\system32\DRIVERS\VBoxUSBMon.sys
16:34:06.0685 0x12cc VBoxUSBMon - ok
16:34:06.0685 0x12cc [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
16:34:06.0701 0x12cc vdrvroot - ok
16:34:06.0701 0x12cc [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
16:34:06.0732 0x12cc vds - ok
16:34:06.0732 0x12cc [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
16:34:06.0747 0x12cc vga - ok
16:34:06.0747 0x12cc [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
16:34:06.0779 0x12cc VgaSave - ok
16:34:06.0779 0x12cc [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
16:34:06.0779 0x12cc vhdmp - ok
16:34:06.0794 0x12cc [ EC1F539D72D07F42D4E72DD11B28DFDD, F1A52403D76968462D6A2C65D8D361DD75EA512579616B99D2D915F124D0FB36 ] VIAHdAudAddService C:\Windows\system32\drivers\viahduaa.sys
16:34:06.0810 0x12cc VIAHdAudAddService - ok
16:34:06.0825 0x12cc [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
16:34:06.0825 0x12cc viaide - ok
16:34:06.0825 0x12cc [ 097A1A16F9F38715CEAA092DE626F517, 5D51D74C3264ADEA1A50F6620150B284E54C5294A548D1BC940B3B5FF5343998 ] VIAKaraokeService C:\Windows\system32\viakaraokesrv.exe
16:34:06.0841 0x12cc VIAKaraokeService - ok
16:34:06.0841 0x12cc [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus C:\Windows\system32\drivers\vmbus.sys
16:34:06.0857 0x12cc vmbus - ok
16:34:06.0857 0x12cc [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
16:34:06.0857 0x12cc VMBusHID - ok
16:34:06.0857 0x12cc [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
16:34:06.0872 0x12cc volmgr - ok
16:34:06.0872 0x12cc [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
16:34:06.0888 0x12cc volmgrx - ok
16:34:06.0888 0x12cc [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
16:34:06.0903 0x12cc volsnap - ok
16:34:06.0903 0x12cc [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
16:34:06.0919 0x12cc vsmraid - ok
16:34:06.0950 0x12cc [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
16:34:06.0997 0x12cc VSS - ok
16:34:06.0997 0x12cc [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
16:34:06.0997 0x12cc vwifibus - ok
16:34:07.0013 0x12cc [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
16:34:07.0044 0x12cc W32Time - ok
16:34:07.0044 0x12cc [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
16:34:07.0044 0x12cc WacomPen - ok
16:34:07.0059 0x12cc [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
16:34:07.0075 0x12cc WANARP - ok
16:34:07.0075 0x12cc [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
16:34:07.0091 0x12cc Wanarpv6 - ok
16:34:07.0122 0x12cc [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
16:34:07.0153 0x12cc wbengine - ok
16:34:07.0153 0x12cc [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
16:34:07.0169 0x12cc WbioSrvc - ok
16:34:07.0184 0x12cc [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
16:34:07.0200 0x12cc wcncsvc - ok
16:34:07.0200 0x12cc [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
16:34:07.0200 0x12cc WcsPlugInService - ok
16:34:07.0215 0x12cc [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\drivers\wd.sys
16:34:07.0215 0x12cc Wd - ok
16:34:07.0231 0x12cc [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
16:34:07.0247 0x12cc Wdf01000 - ok
16:34:07.0247 0x12cc [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost C:\Windows\system32\wdi.dll
16:34:07.0278 0x12cc WdiServiceHost - ok
16:34:07.0278 0x12cc [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost C:\Windows\system32\wdi.dll
16:34:07.0293 0x12cc WdiSystemHost - ok
16:34:07.0293 0x12cc [ 3DB6D04E1C64272F8B14EB8BC4616280, 9138642B1C19F895D4ECFD930160C80FBF15813CE63BBF4C899842C300FD3026 ] WebClient C:\Windows\System32\webclnt.dll
16:34:07.0309 0x12cc WebClient - ok
16:34:07.0309 0x12cc [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
16:34:07.0340 0x12cc Wecsvc - ok
16:34:07.0340 0x12cc [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
16:34:07.0371 0x12cc wercplsupport - ok
16:34:07.0371 0x12cc [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
16:34:07.0387 0x12cc WerSvc - ok
16:34:07.0403 0x12cc [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
16:34:07.0418 0x12cc WfpLwf - ok
16:34:07.0418 0x12cc [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
16:34:07.0418 0x12cc WIMMount - ok
16:34:07.0434 0x12cc WinDefend - ok
16:34:07.0434 0x12cc WinHttpAutoProxySvc - ok
16:34:07.0434 0x12cc [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
16:34:07.0465 0x12cc Winmgmt - ok
16:34:07.0481 0x12cc WinRing0_1_2_0 - ok
16:34:07.0512 0x12cc [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM C:\Windows\system32\WsmSvc.dll
16:34:07.0559 0x12cc WinRM - ok
16:34:07.0574 0x12cc [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
16:34:07.0574 0x12cc WinUsb - ok
16:34:07.0590 0x12cc [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
16:34:07.0621 0x12cc Wlansvc - ok
16:34:07.0621 0x12cc [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
16:34:07.0637 0x12cc WmiAcpi - ok
16:34:07.0637 0x12cc [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
16:34:07.0652 0x12cc wmiApSrv - ok
16:34:07.0652 0x12cc WMPNetworkSvc - ok
16:34:07.0652 0x12cc [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
16:34:07.0652 0x12cc WPCSvc - ok
16:34:07.0668 0x12cc [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
16:34:07.0668 0x12cc WPDBusEnum - ok
16:34:07.0683 0x12cc [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
16:34:07.0699 0x12cc ws2ifsl - ok
16:34:07.0699 0x12cc [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\System32\wscsvc.dll
16:34:07.0715 0x12cc wscsvc - ok
16:34:07.0715 0x12cc WSearch - ok
16:34:07.0761 0x12cc [ 0814A74C853F50B354F08F83DDA9F7FB, 0A63BAA8DE451B8C2C71FEF961718E769B9BAC305C76D24048C664CB27D0DF28 ] wuauserv C:\Windows\system32\wuaueng.dll
16:34:07.0808 0x12cc wuauserv - ok
16:34:07.0808 0x12cc [ D3381DC54C34D79B22CEE0D65BA91B7C, 70DC4ADCA4C0C28BB133287511E329D1B6B9B97F96CDE5B1D2F1F59FE1A965D9 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
16:34:07.0839 0x12cc WudfPf - ok
16:34:07.0839 0x12cc [ CF8D590BE3373029D57AF80914190682, FB9641777E90A58C063FBE95F081DC6D2F4770827DE19108A9DC3E3D6B17B4BF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
16:34:07.0855 0x12cc WUDFRd - ok
16:34:07.0871 0x12cc [ 7A95C95B6C4CF292D689106BCAE49543, 9029F489E1E817CE12839B8C6656E46190497D445DC3F43C20CF96E5E6BD0691 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
16:34:07.0886 0x12cc wudfsvc - ok
16:34:07.0886 0x12cc [ 9A3452B3C2A46C073166C5CF49FAD1AE, D6F95F51D8E37BA4CF403965EC08CCFEEA9EEFDBFC7752432EAEC19925BDA115 ] WwanSvc C:\Windows\System32\wwansvc.dll
16:34:07.0902 0x12cc WwanSvc - ok
16:34:07.0917 0x12cc ================ Scan global ===============================
16:34:07.0917 0x12cc [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
16:34:07.0917 0x12cc [ EA32F4EA3AE06EDD122FBCD5A489E457, C6E464170121D1714A367CFC80C5EA15D42AD34909039FDB114EAD3B878A47F6 ] C:\Windows\system32\winsrv.dll
16:34:07.0933 0x12cc [ EA32F4EA3AE06EDD122FBCD5A489E457, C6E464170121D1714A367CFC80C5EA15D42AD34909039FDB114EAD3B878A47F6 ] C:\Windows\system32\winsrv.dll
16:34:07.0933 0x12cc [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
16:34:07.0933 0x12cc [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
16:34:07.0949 0x12cc [ Global ] - ok
16:34:07.0949 0x12cc ================ Scan MBR ==================================
16:34:07.0964 0x12cc [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
16:34:08.0198 0x12cc \Device\Harddisk1\DR1 - ok
16:34:08.0198 0x12cc [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:34:08.0214 0x12cc \Device\Harddisk0\DR0 - ok
16:34:08.0214 0x12cc [ 9BD98C40DED6451F98D46C4304804C47 ] \Device\Harddisk2\DR2
16:34:08.0510 0x12cc \Device\Harddisk2\DR2 - ok
16:34:08.0510 0x12cc ================ Scan VBR ==================================
16:34:08.0510 0x12cc [ 963A99C2092D8C88E38C6E054D964AA6 ] \Device\Harddisk1\DR1\Partition1
16:34:08.0541 0x12cc \Device\Harddisk1\DR1\Partition1 - ok
16:34:08.0541 0x12cc [ 1C6A1D5819A870B257901DC3C2D1AB13 ] \Device\Harddisk1\DR1\Partition2
16:34:08.0557 0x12cc \Device\Harddisk1\DR1\Partition2 - ok
16:34:08.0557 0x12cc [ E9061DDE0A5181BBD325F993B5D30DE4 ] \Device\Harddisk0\DR0\Partition1
16:34:08.0557 0x12cc \Device\Harddisk0\DR0\Partition1 - ok
16:34:08.0557 0x12cc ================ Scan generic autorun ======================
16:34:08.0619 0x12cc [ 13FF4088A7D1C31C494BDEAF182D16CB, DF9015353D2C0CFF034AF240F5A1A24A606C10C17E3F024E11056AB238A6A8B8 ] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
16:34:08.0697 0x12cc HDAudDeck - ok
16:34:08.0713 0x12cc [ 8476E1C89C9D9834102EF86B651C6F39, 728D025B925FBACB45E31B4531CB05E5CA1662D99FFC97E237C2033030D8FDD7 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
16:34:08.0744 0x12cc StartCCC - ok
16:34:08.0744 0x12cc [ 6BA8D86746935498D64CB5CF6286F2EB, E47D1DEE39451428344233DB15412BCB486C4F6FE1D0426F20AA4C6245387926 ] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
16:34:08.0760 0x12cc USB3MON - ok
16:34:08.0775 0x12cc [ 66177D4C99FD8B578C7C56DE445E4D5D, 003D0254D7C693A72DE84CB76858F8D67D9FD62206F1B56DF7F5D0FA834C3BA7 ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
16:34:08.0791 0x12cc avgnt - ok
16:34:08.0791 0x12cc [ 887CAA31048EB8ED09A0CBD0E6F46F09, BBCED0BD4EB00C3FECFC9448223D4C441A868787877291F5489B07B43FAB65A4 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
16:34:08.0807 0x12cc SunJavaUpdateSched - ok
16:34:08.0822 0x12cc [ 3E04F1E482357B1FC8B088197C3D9FF8, 85524ADDC27ADC831EBBD24E079B412CFDC69E5F594BD153319087665A28D546 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
16:34:08.0853 0x12cc Adobe ARM - ok
16:34:08.0853 0x12cc [ 1DF3DCE54EDF5E85D15BA381ED98FAC3, 91CDEC8ADD48A40AB4D4E49B5AF0CEB01AA7A063B6C2103E16038D46C417868F ] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe
16:34:08.0853 0x12cc ControlCenter4 - detected UnsignedFile.Multi.Generic ( 1 )
16:34:11.0427 0x12cc Detect skipped due to KSN trusted
16:34:11.0427 0x12cc ControlCenter4 - ok
16:34:11.0474 0x12cc [ 63E9C23A386FFFA84B5E03BFF9B628F0, A370962791EFC4B10548AAD31F89A2B288FBD5BDBF5749323C2D98C14DFB8B49 ] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
16:34:11.0537 0x12cc BrStsMon00 - detected UnsignedFile.Multi.Generic ( 1 )
16:34:14.0111 0x12cc Detect skipped due to KSN trusted
16:34:14.0111 0x12cc BrStsMon00 - ok
16:34:14.0126 0x12cc [ 38CF4E3316E7EF7329213F36D7F1C382, 61755B530DE4B4B51863F14B21E04786BB869690A9A8747D49DBBAC300F2B1B4 ] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
16:34:14.0142 0x12cc Ad-Aware Browsing Protection - ok
16:34:14.0142 0x12cc [ CB08561AB36857CCF74BF11475C9AEB2, 5F15F6868A719A0A84D3E0FE2BC4E76975C50FA99D642279DDA972269ADFDB8B ] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
16:34:14.0142 0x12cc Avira Systray - ok
16:34:14.0157 0x12cc [ 6A188ECFCA5A2A6F41CA145FC93F96A6, 48D70FAA4C4F6F1F6542E2C54085857CE6906A69C0412E8A08BF69010FDF07CF ] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe
16:34:14.0157 0x12cc EasyTuneVI - detected UnsignedFile.Multi.Generic ( 1 )
16:34:16.0731 0x12cc Detect skipped due to KSN trusted
16:34:16.0731 0x12cc EasyTuneVI - ok
16:34:16.0747 0x12cc [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
16:34:16.0778 0x12cc Sidebar - ok
16:34:16.0778 0x12cc [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
16:34:16.0794 0x12cc mctadmin - ok
16:34:16.0809 0x12cc [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
16:34:16.0841 0x12cc Sidebar - ok
16:34:16.0841 0x12cc [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
16:34:16.0856 0x12cc mctadmin - ok
16:34:16.0872 0x12cc [ E3BF29CED96790CDAAFA981FFDDF53A3, 76CB27EF7B27E5636EDA9D95229519B2A2870729A0BB694F1FD11CD602BAC4DC ] C:\Program Files\Windows Sidebar\sidebar.exe
16:34:16.0903 0x12cc Sidebar - ok
16:34:16.0919 0x12cc [ 50E999CDFBCFEBC7B14452E35D1E4C83, 007EBBC78603F4C691FD65B60B93A0E4C0CDB5EB7D9555212E1C36B268C981D2 ] C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe
16:34:16.0934 0x12cc OneDrive - ok
16:34:16.0965 0x12cc [ F8C3E11AF9997093C7687B4940A73705, 5A751661AEBFCDB418D008B6F5F61DA10FCEDD50B2E461EBA2EE7960C05B3F8A ] C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe
16:34:16.0997 0x12cc Spotify Web Helper - ok
16:34:16.0997 0x12cc Waiting for KSN requests completion. In queue: 9
16:34:18.0011 0x12cc Waiting for KSN requests completion. In queue: 9
16:34:19.0025 0x12cc Waiting for KSN requests completion. In queue: 9
16:34:20.0039 0x12cc AV detected via SS2: Avira Antivirus, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 15.0.10.414 ), 0x40000 ( disabled : updated )
16:34:20.0054 0x12cc Win FW state via NFP2: enabled
16:34:22.0550 0x12cc ============================================================
16:34:22.0550 0x12cc Scan finished
16:34:22.0550 0x12cc ============================================================
16:34:22.0550 0x030c Detected object count: 0
16:34:22.0550 0x030c Actual detected object count: 0
|
|
27.05.2015, 06:57
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.05.2015, 10:59
| #5 |
| | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 27.05.2015 Suchlauf-Zeit: 11:21:55 Logdatei: mbam.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.27.02 Rootkit Datenbank: v2015.05.24.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Thomas Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 361266 Verstrichene Zeit: 6 Min, 19 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 1 PUP.Optional.Conduit.A, C:\Users\Thomas\AppData\Local\Temp\sp-downloader.exe, In Quarantäne, [26789afe642634025387420fdf221ce4], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.205 - Bericht erstellt 27/05/2015 um 11:44:54
# Aktualisiert 21/05/2015 von Xplode
# Datenbank : 2015-05-21.2 [Lokal]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Thomas - THOMAS-PC
# Gestarted von : C:\Users\Thomas\Desktop\AdwCleaner_4.205.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\blekko toolbars
Ordner Gelöscht : C:\Program Files (x86)\Toolbar Cleaner
Ordner Gelöscht : C:\Users\Thomas\AppData\Local\Hola
Ordner Gelöscht : C:\Users\Thomas\AppData\LocalLow\adawaretb
Ordner Gelöscht : C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gelöscht : HKLM\SOFTWARE\adawaretb
Schlüssel Gelöscht : HKLM\SOFTWARE\Toolbar Cleaner
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.1 (x86 de)
-\\ Google Chrome v43.0.2357.81
[C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
[C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : flpcjncodpafbgdpnkljologafpionhb
[C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : oejkcgajlodefenbbjdnaiahmbnnoole
*************************
AdwCleaner[R0].txt - [1254 Bytes] - [27/11/2014 01:20:21]
AdwCleaner[R1].txt - [2165 Bytes] - [27/05/2015 11:44:27]
AdwCleaner[S0].txt - [1075 Bytes] - [27/11/2014 01:21:37]
AdwCleaner[S1].txt - [2039 Bytes] - [27/05/2015 11:44:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2098 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.0 (05.25.2015:1)
OS: Windows 7 Professional x64
Ran by Thomas on 27.05.2015 at 11:51:32,91
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ad-aware browsing protection
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] C:\ProgramData\ad-aware browsing protection
Successfully deleted: [Folder] C:\Users\Thomas\appdata\local\adawarebp
~~~ FireFox
Emptied folder: C:\Users\Thomas\AppData\Roaming\mozilla\firefox\profiles\a1q6opop.default-1417043911660\minidumps [22 files]
~~~ Chrome
[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.05.2015 at 11:53:27,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by Thomas (administrator) on THOMAS-PC on 27-05-2015 11:54:35
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] ()
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [OneDrive] => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [Spotify Web Helper] => C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2022968 2015-05-25] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-26]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2014-12-21]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ET6.lnk [2015-02-22]
ShortcutTarget: ET6.lnk -> C:\Program Files (x86)\GIGABYTE\ET6\ET6SC.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-27]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Windows\Installer\{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}\OC_GURU.exe1_5588D686D23B4C9DBDFA2A7875CD3722.exe (Macrovision Corporation)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCMeterV0.4.lnk [2014-11-26]
ShortcutTarget: PCMeterV0.4.lnk -> C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe (AddGadgets)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCremote.lnk [2015-01-04]
ShortcutTarget: PCremote.lnk -> C:\Program Files (x86)\PCremote\PCremote.exe (JakuSoft)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660
FF DefaultSearchEngine: dict.cc DE-EN
FF SelectedSearchEngine: LEO Eng-Deu
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-18] ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-18] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-26] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\searchplugins\dictcc-de-en.xml [2015-01-29]
FF Extension: WOT - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-12]
FF Extension: Pushbullet - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\jid1-BYcQOfYfmBMd9A@jetpack.xpi [2015-04-14]
FF Extension: Dict.cc Translation - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\searchdictcc@roughael.xpi [2015-01-03]
FF Extension: Tile Tabs - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\tiletabs@DW-dev.xpi [2015-04-09]
FF Extension: Adblock Plus - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-27]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-02-07]
Chrome:
=======
CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-26]
CHR Extension: (Google Docs) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-26]
CHR Extension: (Google Drive) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-26]
CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-26]
CHR Extension: (Google Sheets) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-26]
CHR Extension: (Avira Browser Safety) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-26]
CHR Extension: (Google Wallet) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-26]
CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-26]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) []
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) []
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-28] ()
R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-27] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 WinRing0_1_2_0; \??\C:\Users\Thomas\AppData\Local\Temp\tmpBEBC.tmp [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-27 11:53 - 2015-05-27 11:53 - 00001497 _____ () C:\Users\Thomas\Desktop\JRT.txt
2015-05-27 11:51 - 2015-05-27 11:51 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-THOMAS-PC-Windows-7-Professional-(64-bit).dat
2015-05-27 11:51 - 2015-05-27 11:51 - 00000000 ____D () C:\RegBackup
2015-05-27 11:50 - 2015-05-27 11:50 - 02946703 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe
2015-05-27 11:49 - 2015-05-27 11:49 - 00002178 _____ () C:\Users\Thomas\Desktop\AdwCleaner[S1].txt
2015-05-27 11:43 - 2015-05-27 11:43 - 02222592 _____ () C:\Users\Thomas\Desktop\AdwCleaner_4.205.exe
2015-05-27 11:42 - 2015-05-27 11:42 - 00001304 _____ () C:\Users\Thomas\Desktop\mbam.txt
2015-05-27 11:30 - 2015-05-27 11:30 - 00000000 ___HD () C:\OneDriveTemp
2015-05-27 11:20 - 2015-05-27 11:20 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-27 11:20 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-27 11:20 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-27 11:19 - 2015-05-27 11:19 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Thomas\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-26 16:32 - 2015-05-26 16:32 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Thomas\Desktop\tdsskiller.exe
2015-05-26 16:19 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-26 16:18 - 2015-05-27 11:30 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-26 16:18 - 2015-05-27 11:29 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-26 16:18 - 2015-05-26 16:31 - 00000000 ____D () C:\Users\Thomas\Desktop\mbar
2015-05-26 16:18 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-26 16:17 - 2015-05-26 16:17 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Thomas\Desktop\mbar-1.09.1.1004.exe
2015-05-26 15:57 - 2015-05-26 15:57 - 00018932 _____ () C:\Users\Thomas\Desktop\gmer.log
2015-05-26 15:52 - 2015-05-26 15:52 - 00380416 _____ () C:\Users\Thomas\Desktop\Gmer-19357.exe
2015-05-26 15:51 - 2015-05-27 11:54 - 00018910 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-05-26 15:51 - 2015-05-26 15:51 - 00035982 _____ () C:\Users\Thomas\Desktop\Addition.txt
2015-05-26 15:50 - 2015-05-27 11:54 - 00000000 ____D () C:\FRST
2015-05-26 15:50 - 2015-05-26 15:50 - 02108928 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-05-26 15:47 - 2015-05-26 15:47 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-05-25 17:17 - 2015-05-25 17:17 - 00011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2015-05-25 16:58 - 2015-05-25 16:58 - 00000000 ____D () C:\Users\Thomas\Desktop\Neuer Ordner (3)
2015-05-25 14:20 - 2015-05-25 14:20 - 00003172 _____ () C:\Windows\System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90}
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\Program Files\Oracle
2015-05-25 14:20 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-25 14:20 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-25 14:18 - 2015-05-25 14:19 - 111273672 _____ (Oracle Corporation) C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe
2015-05-22 18:49 - 2015-05-25 16:56 - 00000000 ____D () C:\Users\Thomas\Desktop\Bilder mit Séverine
2015-05-19 23:29 - 2015-05-20 15:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-19 16:54 - 2015-05-19 16:54 - 00949621 _____ () C:\Users\Thomas\Desktop\WhatsApp Chat mit Séverine Sandmann.txt
2015-05-19 16:24 - 2015-05-19 16:30 - 659742720 _____ () C:\Users\Thomas\Desktop\rescue-system.iso
2015-05-18 15:15 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-16 02:39 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 02:39 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 12:47 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-15 12:47 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-15 12:47 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-15 12:47 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-15 12:47 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-15 12:47 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-15 12:47 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-15 12:47 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-15 12:47 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-15 12:47 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-15 12:47 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-15 12:47 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-15 12:47 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-15 12:47 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-15 12:47 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-15 12:47 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-15 12:47 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-15 12:47 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-15 12:47 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-15 12:47 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-15 12:47 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-15 12:47 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-15 12:47 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-15 12:47 - 2015-04-04 05:29 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-15 12:47 - 2015-04-04 05:29 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-15 12:47 - 2015-04-04 05:22 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:20 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-15 12:47 - 2015-04-04 05:17 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:17 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-15 12:47 - 2015-04-04 05:15 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-15 12:47 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-15 12:46 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-15 12:46 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-15 12:46 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-15 12:46 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 12:46 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 12:46 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-15 12:46 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-15 12:46 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 17:10 - 2015-05-13 17:10 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-06 23:06 - 2015-05-06 23:12 - 00000000 ____D () C:\Users\Thomas\Desktop\06.05.2015 - Yannick Garten
2015-04-28 00:34 - 2015-04-28 00:34 - 06479272 _____ (Neat Image team, ABSoft ) C:\Users\Thomas\Downloads\NeatSetup3274.exe
2015-04-28 00:34 - 2015-04-28 00:34 - 00001103 _____ () C:\Users\Thomas\Desktop\Neat Image (32-bit).lnk
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\NeatImage SL 32
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neat Image Standalone (32-bit)
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Program Files (x86)\Neat Image Standalone
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-27 11:53 - 2014-11-26 20:31 - 00021081 _____ () C:\Users\Thomas\IP_Log_Data.js
2015-05-27 11:51 - 2014-11-26 20:12 - 00000000 ___RD () C:\Users\Thomas\OneDrive
2015-05-27 11:51 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:51 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:48 - 2014-11-26 16:23 - 02087129 _____ () C:\Windows\WindowsUpdate.log
2015-05-27 11:46 - 2015-03-04 12:00 - 00005144 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC
2015-05-27 11:46 - 2015-02-22 18:41 - 00030528 _____ () C:\Windows\GVTDrv64.sys
2015-05-27 11:46 - 2015-02-22 18:41 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref
2015-05-27 11:46 - 2015-02-22 18:40 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-05-27 11:46 - 2014-11-26 16:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-27 11:45 - 2010-11-21 05:47 - 00361994 _____ () C:\Windows\PFRO.log
2015-05-27 11:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-27 11:45 - 2009-07-14 06:51 - 00069564 _____ () C:\Windows\setupact.log
2015-05-27 11:44 - 2014-11-27 01:20 - 00000000 ____D () C:\AdwCleaner
2015-05-27 11:38 - 2011-04-12 09:43 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2015-05-27 11:38 - 2011-04-12 09:43 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2015-05-27 11:38 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-27 11:29 - 2014-11-27 01:32 - 00000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-27 11:22 - 2014-11-26 16:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-27 11:18 - 2014-11-28 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-27 11:18 - 2014-11-26 21:00 - 00047161 _____ () C:\Users\Thomas\Network_Meter_Data.js
2015-05-26 15:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-26 15:47 - 2014-11-26 16:23 - 00000000 ____D () C:\Users\Thomas
2015-05-25 22:14 - 2014-11-26 17:02 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Spotify
2015-05-25 17:17 - 2014-11-26 16:53 - 00000000 ____D () C:\Users\Thomas\.gimp-2.8
2015-05-25 16:56 - 2014-12-04 13:36 - 00000000 ____D () C:\Users\Thomas\AppData\Local\gtk-2.0
2015-05-25 15:49 - 2014-11-26 17:05 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Spotify
2015-05-25 14:41 - 2014-11-26 19:46 - 00000000 ____D () C:\Users\Thomas\.VirtualBox
2015-05-25 14:20 - 2014-11-26 19:46 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-05-21 22:05 - 2014-11-26 20:12 - 00002141 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-21 14:39 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 14:00 - 2014-11-26 20:01 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-18 14:17 - 2014-11-26 16:59 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:17 - 2014-11-26 16:59 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-18 14:15 - 2014-11-26 20:34 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe
2015-05-18 14:14 - 2014-11-28 18:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-18 14:14 - 2014-11-28 18:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-18 14:14 - 2014-11-28 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-17 22:05 - 2014-11-26 17:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-17 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-17 21:18 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 21:18 - 2009-07-14 06:45 - 00502448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-16 02:42 - 2014-11-26 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-16 02:40 - 2014-11-26 18:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-15 22:51 - 2014-11-26 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 17:10 - 2014-11-24 13:06 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 13:18 - 2014-11-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-27 16:39 - 2015-02-06 16:27 - 00000000 ____D () C:\Users\Thomas\Desktop\Bachelorarbeit
==================== Files in the root of some directories =======
2014-11-26 20:31 - 2014-12-02 00:11 - 0000626 _____ () C:\Users\Thomas\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-11-26 20:34 - 2014-11-26 20:47 - 0000841 _____ () C:\Users\Thomas\AppData\Roaming\Drives Meter_Settings.ini
2014-11-26 20:32 - 2015-01-13 16:02 - 0000292 _____ () C:\Users\Thomas\AppData\Roaming\GPU MeterV2_Settings.ini
2014-11-26 20:32 - 2014-11-26 20:33 - 0001328 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Settings.ini
2014-11-27 01:32 - 2015-05-27 11:29 - 0000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-25 17:17 - 2015-05-25 17:17 - 0011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2014-11-26 21:24 - 2015-04-06 00:04 - 0007604 _____ () C:\Users\Thomas\AppData\Local\Resmon.ResmonCfg
Files to move or delete:
====================
C:\Users\Thomas\IP_Log_Data.js
C:\Users\Thomas\Network_Meter_Data.js
Some files in TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
C:\Users\Thomas\AppData\Local\Temp\DelayInst.exe
C:\Users\Thomas\AppData\Local\Temp\gkey.exe
C:\Users\Thomas\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.5.575.exe
C:\Users\Thomas\AppData\Local\Temp\installservice.exe
C:\Users\Thomas\AppData\Local\Temp\pkeyui.exe
C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Thomas\AppData\Local\Temp\sfextra.dll
C:\Users\Thomas\AppData\Local\Temp\sqlite3.dll
C:\Users\Thomas\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Thomas\AppData\Local\Temp\wabk.exe
C:\Users\Thomas\AppData\Local\Temp\_is8E1B.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-25 17:46
==================== End of log ============================
|
|
27.05.2015, 18:35
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Avira Antivir Live CD erkennt 27 TrojanerESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Windows 7: Avira Antivir Live CD erkennt 27 Trojaner |
|
28.05.2015, 13:54
| #7 |
| | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Also ESET hat ein paar Sachen gefunden: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e39492e9108fc142b97307f89450e586
# engine=24053
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-27 08:52:39
# local_time=2015-05-27 10:52:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 15739626 184389809 0 0
# scanned=204405
# found=16
# cleaned=0
# scan_time=3725
sh=03869BB0869892FC0921F81E28552D272DE5940B ft=1 fh=cf7ab34c69aafc2e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe"
sh=1109266C0C26D15BFA39C2C5E81950E55199F648 ft=1 fh=34da0040060a84ef vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe"
sh=CCAAB70797E9301638EC064311DA8F044F70BD1E ft=1 fh=b2e4f21594fcac64 vn="Variante von Win32/InstallIQ.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe"
sh=DA59FE87209FF1B7CA0CFB5E785D7559DD1F770B ft=1 fh=2b2a087cb6cef33c vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe"
sh=3352E361DD8343CF51747AE7DBF91C4BF8AA97F9 ft=1 fh=6f28b91a55eb2b29 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe"
sh=D5ACB7BEB7448438BBACB9196EE4411C25D795FE ft=1 fh=4071dddff7b68764 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe"
sh=D5ACB7BEB7448438BBACB9196EE4411C25D795FE ft=1 fh=4071dddff7b68764 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe"
sh=29531FF34ED520FDEF40B88D1C27B77D4064C1B7 ft=1 fh=6f280fcdcbb1a73e vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe"
sh=DB886C9E352D1215548BA755F0892D6B5003E237 ft=1 fh=3cd5fe4d706a0e7c vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe"
sh=7028F239FAC673EE7DC7772ACC75D759EA73837D ft=1 fh=e769f095fe49f653 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe"
sh=333BEB35A70772F1757E99F0154D59964B921D3F ft=1 fh=534a19fe0349cbc1 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe"
sh=709D0B68EBAA79E2909ADA8D39B7A0005BA4313D ft=1 fh=e602743e8780b8c5 vn="Win32/DownWare.W evtl. unerwünschte Anwendung" ac=I fn="E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe"
sh=2742F4CAC385DF6CADD6A3B00CA56B19E564B9D1 ft=1 fh=cbfe148697ed1ab3 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe"
sh=AEE1B69276F8425BAC609144396FFBB44C255F42 ft=1 fh=5aa20fb91b358fc3 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\Downloads\Ahnenblatt - CHIP-Installer.exe"
sh=89A5058741E236FF90BB420BE223FABF487DCD82 ft=1 fh=a4db7c0e759c3e10 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe"
sh=A9CBFA723957A2D8FC7F99260BC431911137B94C ft=1 fh=02a112a6279a0639 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe"
Code:
ATTFilter Results of screen317's Security Check version 1.002
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Ad-Aware
Java 8 Update 25
Java version 32-bit out of Date!
Adobe Flash Player 17.0.0.188
Adobe Reader XI
Mozilla Firefox (38.0.1)
Mozilla Thunderbird (31.7.0)
Google Chrome (43.0.2357.65)
Google Chrome (43.0.2357.81)
````````Process Check: objlist.exe by Laurent````````
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by Thomas (administrator) on THOMAS-PC on 27-05-2015 22:58:10
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] ()
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [OneDrive] => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [Spotify Web Helper] => C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2022968 2015-05-25] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-26]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2014-12-21]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ET6.lnk [2015-02-22]
ShortcutTarget: ET6.lnk -> C:\Program Files (x86)\GIGABYTE\ET6\ET6SC.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-27]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Windows\Installer\{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}\OC_GURU.exe1_5588D686D23B4C9DBDFA2A7875CD3722.exe (Macrovision Corporation)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCMeterV0.4.lnk [2014-11-26]
ShortcutTarget: PCMeterV0.4.lnk -> C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe (AddGadgets)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCremote.lnk [2015-01-04]
ShortcutTarget: PCremote.lnk -> C:\Program Files (x86)\PCremote\PCremote.exe (JakuSoft)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660
FF DefaultSearchEngine: dict.cc DE-EN
FF SelectedSearchEngine: LEO Eng-Deu
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-18] ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-18] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-26] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\searchplugins\dictcc-de-en.xml [2015-01-29]
FF Extension: WOT - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-12]
FF Extension: Pushbullet - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\jid1-BYcQOfYfmBMd9A@jetpack.xpi [2015-04-14]
FF Extension: Dict.cc Translation - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\searchdictcc@roughael.xpi [2015-01-03]
FF Extension: Tile Tabs - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\tiletabs@DW-dev.xpi [2015-04-09]
FF Extension: Adblock Plus - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-27]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-02-07]
Chrome:
=======
CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-26]
CHR Extension: (Google Docs) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-26]
CHR Extension: (Google Drive) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-26]
CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-26]
CHR Extension: (Google Sheets) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-26]
CHR Extension: (Avira Browser Safety) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-26]
CHR Extension: (Google Wallet) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-26]
CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-26]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) []
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) []
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-28] ()
R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-27] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 WinRing0_1_2_0; \??\C:\Users\Thomas\AppData\Local\Temp\tmpBEBC.tmp [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-27 22:57 - 2015-05-27 22:57 - 00001022 _____ () C:\Users\Thomas\Desktop\checkup.txt
2015-05-27 22:55 - 2015-05-27 22:55 - 00852639 _____ () C:\Users\Thomas\Desktop\SecurityCheck.exe
2015-05-27 21:43 - 2015-05-27 21:43 - 02347384 _____ (ESET) C:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe
2015-05-27 11:55 - 2015-05-27 11:55 - 00044452 _____ () C:\Users\Thomas\Desktop\FRST2.txt
2015-05-27 11:53 - 2015-05-27 11:53 - 00001497 _____ () C:\Users\Thomas\Desktop\JRT.txt
2015-05-27 11:51 - 2015-05-27 11:51 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-THOMAS-PC-Windows-7-Professional-(64-bit).dat
2015-05-27 11:51 - 2015-05-27 11:51 - 00000000 ____D () C:\RegBackup
2015-05-27 11:50 - 2015-05-27 11:50 - 02946703 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe
2015-05-27 11:49 - 2015-05-27 11:49 - 00002178 _____ () C:\Users\Thomas\Desktop\AdwCleaner[S1].txt
2015-05-27 11:43 - 2015-05-27 11:43 - 02222592 _____ () C:\Users\Thomas\Desktop\AdwCleaner_4.205.exe
2015-05-27 11:42 - 2015-05-27 11:42 - 00001304 _____ () C:\Users\Thomas\Desktop\mbam.txt
2015-05-27 11:30 - 2015-05-27 11:30 - 00000000 ___HD () C:\OneDriveTemp
2015-05-27 11:20 - 2015-05-27 11:20 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-27 11:20 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-27 11:20 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-27 11:19 - 2015-05-27 11:19 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Thomas\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-26 16:32 - 2015-05-26 16:32 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Thomas\Desktop\tdsskiller.exe
2015-05-26 16:19 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-26 16:18 - 2015-05-27 11:30 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-26 16:18 - 2015-05-27 11:29 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-26 16:18 - 2015-05-26 16:31 - 00000000 ____D () C:\Users\Thomas\Desktop\mbar
2015-05-26 16:18 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-26 16:17 - 2015-05-26 16:17 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Thomas\Desktop\mbar-1.09.1.1004.exe
2015-05-26 15:57 - 2015-05-26 15:57 - 00018932 _____ () C:\Users\Thomas\Desktop\gmer.log
2015-05-26 15:52 - 2015-05-26 15:52 - 00380416 _____ () C:\Users\Thomas\Desktop\Gmer-19357.exe
2015-05-26 15:51 - 2015-05-27 22:58 - 00019023 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-05-26 15:51 - 2015-05-26 15:51 - 00035982 _____ () C:\Users\Thomas\Desktop\Addition.txt
2015-05-26 15:50 - 2015-05-27 22:58 - 00000000 ____D () C:\FRST
2015-05-26 15:50 - 2015-05-26 15:50 - 02108928 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-05-26 15:47 - 2015-05-26 15:47 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-05-25 17:17 - 2015-05-25 17:17 - 00011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2015-05-25 16:58 - 2015-05-25 16:58 - 00000000 ____D () C:\Users\Thomas\Desktop\Neuer Ordner (3)
2015-05-25 14:20 - 2015-05-25 14:20 - 00003172 _____ () C:\Windows\System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90}
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\Program Files\Oracle
2015-05-25 14:20 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-25 14:20 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-25 14:18 - 2015-05-25 14:19 - 111273672 _____ (Oracle Corporation) C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe
2015-05-22 18:49 - 2015-05-25 16:56 - 00000000 ____D () C:\Users\Thomas\Desktop\Bilder mit Séverine
2015-05-19 23:29 - 2015-05-20 15:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-19 16:54 - 2015-05-19 16:54 - 00949621 _____ () C:\Users\Thomas\Desktop\WhatsApp Chat mit Séverine Sandmann.txt
2015-05-19 16:24 - 2015-05-19 16:30 - 659742720 _____ () C:\Users\Thomas\Desktop\rescue-system.iso
2015-05-18 15:15 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-16 02:39 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 02:39 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 12:47 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-15 12:47 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-15 12:47 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-15 12:47 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-15 12:47 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-15 12:47 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-15 12:47 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-15 12:47 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-15 12:47 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-15 12:47 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-15 12:47 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-15 12:47 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-15 12:47 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-15 12:47 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-15 12:47 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-15 12:47 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-15 12:47 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-15 12:47 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-15 12:47 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-15 12:47 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-15 12:47 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-15 12:47 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-15 12:47 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-15 12:47 - 2015-04-04 05:29 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-15 12:47 - 2015-04-04 05:29 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-15 12:47 - 2015-04-04 05:22 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:20 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-15 12:47 - 2015-04-04 05:17 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:17 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-15 12:47 - 2015-04-04 05:15 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-15 12:47 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-15 12:46 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-15 12:46 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-15 12:46 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-15 12:46 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 12:46 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 12:46 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-15 12:46 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-15 12:46 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 17:10 - 2015-05-13 17:10 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-06 23:06 - 2015-05-06 23:12 - 00000000 ____D () C:\Users\Thomas\Desktop\06.05.2015 - Yannick Garten
2015-04-28 00:34 - 2015-04-28 00:34 - 06479272 _____ (Neat Image team, ABSoft ) C:\Users\Thomas\Downloads\NeatSetup3274.exe
2015-04-28 00:34 - 2015-04-28 00:34 - 00001103 _____ () C:\Users\Thomas\Desktop\Neat Image (32-bit).lnk
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\NeatImage SL 32
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neat Image Standalone (32-bit)
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Program Files (x86)\Neat Image Standalone
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-27 22:22 - 2014-11-26 16:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-27 22:15 - 2014-11-28 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-27 22:00 - 2014-11-26 21:00 - 00047493 _____ () C:\Users\Thomas\Network_Meter_Data.js
2015-05-27 21:53 - 2011-04-12 09:43 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2015-05-27 21:53 - 2011-04-12 09:43 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2015-05-27 21:53 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-27 16:07 - 2014-11-26 16:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-27 15:53 - 2009-07-14 06:51 - 00069676 _____ () C:\Windows\setupact.log
2015-05-27 12:42 - 2014-11-26 16:23 - 01061771 _____ () C:\Windows\WindowsUpdate.log
2015-05-27 11:58 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:58 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:53 - 2014-11-26 20:31 - 00021081 _____ () C:\Users\Thomas\IP_Log_Data.js
2015-05-27 11:51 - 2014-11-26 20:12 - 00000000 ___RD () C:\Users\Thomas\OneDrive
2015-05-27 11:46 - 2015-03-04 12:00 - 00005144 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC
2015-05-27 11:46 - 2015-02-22 18:41 - 00030528 _____ () C:\Windows\GVTDrv64.sys
2015-05-27 11:46 - 2015-02-22 18:41 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref
2015-05-27 11:46 - 2015-02-22 18:40 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-05-27 11:45 - 2010-11-21 05:47 - 00361994 _____ () C:\Windows\PFRO.log
2015-05-27 11:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-27 11:44 - 2014-11-27 01:20 - 00000000 ____D () C:\AdwCleaner
2015-05-27 11:29 - 2014-11-27 01:32 - 00000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-26 15:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-26 15:47 - 2014-11-26 16:23 - 00000000 ____D () C:\Users\Thomas
2015-05-25 22:14 - 2014-11-26 17:02 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Spotify
2015-05-25 17:17 - 2014-11-26 16:53 - 00000000 ____D () C:\Users\Thomas\.gimp-2.8
2015-05-25 16:56 - 2014-12-04 13:36 - 00000000 ____D () C:\Users\Thomas\AppData\Local\gtk-2.0
2015-05-25 15:49 - 2014-11-26 17:05 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Spotify
2015-05-25 14:41 - 2014-11-26 19:46 - 00000000 ____D () C:\Users\Thomas\.VirtualBox
2015-05-25 14:20 - 2014-11-26 19:46 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-05-21 22:05 - 2014-11-26 20:12 - 00002141 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-21 14:39 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 14:00 - 2014-11-26 20:01 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-18 14:17 - 2014-11-26 16:59 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:17 - 2014-11-26 16:59 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-18 14:15 - 2014-11-26 20:34 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe
2015-05-18 14:14 - 2014-11-28 18:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-18 14:14 - 2014-11-28 18:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-18 14:14 - 2014-11-28 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-17 22:05 - 2014-11-26 17:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-17 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-17 21:18 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 21:18 - 2009-07-14 06:45 - 00502448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-16 02:42 - 2014-11-26 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-16 02:40 - 2014-11-26 18:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-15 22:51 - 2014-11-26 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 17:10 - 2014-11-24 13:06 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 13:18 - 2014-11-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-27 16:39 - 2015-02-06 16:27 - 00000000 ____D () C:\Users\Thomas\Desktop\Bachelorarbeit
==================== Files in the root of some directories =======
2014-11-26 20:31 - 2014-12-02 00:11 - 0000626 _____ () C:\Users\Thomas\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-11-26 20:34 - 2014-11-26 20:47 - 0000841 _____ () C:\Users\Thomas\AppData\Roaming\Drives Meter_Settings.ini
2014-11-26 20:32 - 2015-01-13 16:02 - 0000292 _____ () C:\Users\Thomas\AppData\Roaming\GPU MeterV2_Settings.ini
2014-11-26 20:32 - 2014-11-26 20:33 - 0001328 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Settings.ini
2014-11-27 01:32 - 2015-05-27 11:29 - 0000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-25 17:17 - 2015-05-25 17:17 - 0011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2014-11-26 21:24 - 2015-04-06 00:04 - 0007604 _____ () C:\Users\Thomas\AppData\Local\Resmon.ResmonCfg
Files to move or delete:
====================
C:\Users\Thomas\IP_Log_Data.js
C:\Users\Thomas\Network_Meter_Data.js
Some files in TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
C:\Users\Thomas\AppData\Local\Temp\DelayInst.exe
C:\Users\Thomas\AppData\Local\Temp\gkey.exe
C:\Users\Thomas\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.5.575.exe
C:\Users\Thomas\AppData\Local\Temp\installservice.exe
C:\Users\Thomas\AppData\Local\Temp\pkeyui.exe
C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Thomas\AppData\Local\Temp\sfextra.dll
C:\Users\Thomas\AppData\Local\Temp\sqlite3.dll
C:\Users\Thomas\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Thomas\AppData\Local\Temp\wabk.exe
C:\Users\Thomas\AppData\Local\Temp\_is8E1B.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-25 17:46
==================== End of log ============================
Wie lässt sich das denn in Zukunft am besten vermeiden? Avira Antivir scheint mir jetzt nicht grade so zuverlässig zu sein, denn das war ja installiert  Gibts da eine bessere Lösung für?EDIT: Heute wollte ich zum ersten Mal nach den ganzen Scans Spotify starten, was jedoch nicht ging. Nach einer Neuinstallation gehts jetzt wieder. Wollte ich nur kurz sagen, da es etwas merkwürdig ist. |
|
29.05.2015, 06:39
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Java updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe
C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe
C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe
C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe
E:\Downloads\Ahnenblatt - CHIP-Installer.exe
E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe
E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
 Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.05.2015, 11:02
| #9 |
| | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Vielen Dank für die Ausführliche Antwort und die tolle Hilfe. Die Tipps zur Absicherung werde ich anwenden und hoffen, dass ich mir damit weniger einhandle als bisher. Hier ist noch das Fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version: 25-05-2015
Ran by Thomas at 2015-05-29 11:57:02 Run:1
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe
C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe
C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe
C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe
E:\Downloads\Ahnenblatt - CHIP-Installer.exe
E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe
E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe
Emptytemp:
*****************
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe" => File/Folder not found.
C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe => Moved successfully.
"C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe" => File/Folder not found.
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe => Moved successfully.
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe => Moved successfully.
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe => Moved successfully.
C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe => Moved successfully.
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe => Moved successfully.
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe => Moved successfully.
E:\Downloads\Ahnenblatt - CHIP-Installer.exe => Moved successfully.
E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe => Moved successfully.
E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe => Moved successfully.
EmptyTemp: => Removed 1.1 GB temporary data.
The system needed a reboot.
==== End of Fixlog 11:57:20 ====
|
|
30.05.2015, 08:53
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Avira Antivir Live CD erkennt 27 Trojaner |
| ad-aware, böttcher, fehlercode 0x5;, fehlercode 0xc0000005, fehlercode 22, fehlercode windows, flash player, newtab, office 365, onedrive, pup.optional.conduit.a, svchost.exe, this device is disabled. (code 22), tr/cabhot.vuze, tr/crypt.epack.33213, tr/crypt.epack.33697, tr/crypt.xpack.188403, tr/crypt.xpack.87566, tr/crypt.zpack.145794, tr/crypt.zpack.gen7, tr/dldr.jraf, tr/downloader.gen7, tr/kryptik.gtap, tr/matsnu.a.113, tr/matsnu.a.166, tr/matsnu.a.260, tr/yakes.ceky, tracker, trojaner, whatsapp |
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
