| |
| |||||||
Log-Analyse und Auswertung: CryptXXX 3.0: Alle Files auf .crypz verschlüsseltWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
30.06.2016, 20:55
| #1 |
| |  CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Hallo zusammen, auch ich habe mir offensichtlich den Trojaner CryptXXX 3.0 eingefangen, der mir alle Dateien mit RSA-4096 verschlüsselt hat. Dateiendung <Originalname>.crypt. Habe bereits mehrere Maßnahmen unternommen, wobei Microsoft Security Essentials der Meinung ist, dass der Trojaner erfolgreich entfernt wurde. In der Tat habe ich bis auf die verschlüsselten Dateien keine Hinweise mehr entdecken können. Mein Anliegen ist nun folgendes: 1. Ist mein Rechner wirklich sauber? 2. Wie kann ich die Dateien wieder entschlüsseln? Zu 1. habe ich die Logfiles angehängt, die ihr immer anfordert (siehe unten). Zu 2. konnte ich mit dem Tool Ransomware File Decryptor von Trendmicro zwar die Dateien entschlüsseln, leider sind sie jedoch unlesbar. Die Filegröße nach der Entschlüsselung ist identisch mit der originalen Datei (einer der wenigen Files, die ich gesichert habe), öffnen lassen sie sich aber nicht. Werde die oftmals gewünschten Logs in den folgenden Beiträgen posten. Ich hoffe ihr könnt mir helfen!! Danke schon mal im Voraus, Emroi Verschlüsselungstrojaner: CryptXXX 3.0 Decryptor gibt es aktuell wohl noch nicht. Output FRST.txt: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016
durchgeführt von MEmroi (Administrator) auf Emroi (30-06-2016 21:19:59)
Gestartet von C:\Users\MEmroi\Desktop
Geladene Profile: MEmroi (Verfügbare Profile: MEmroi)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
() C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Suunto Oy) C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\Moveslink.exe
(Ralink Technology, Inc.) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
(PIXELA CORPORATION) C:\Program Files (x86)\Canon Pixela VideoBrowser\CameraMonitor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_18_0_0_209_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Trend Micro Inc.) C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI\RansomwareFileDecryptor 1.0.1595 MUI.exe
(Trend Micro Inc.) C:\Users\MEmroi\AppData\Local\Temp\TMRDTSelfExtract\TMRDT.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] => C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] ()
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3524536 2012-08-31] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1444880 2015-11-26] (Easybits)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23496872 2016-05-17] (Google)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [964024 2012-08-31] (Samsung)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesPDLR] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21432 2012-08-31] ()
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Policies\system: [DisableChangePassword] 0
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Moveslink for Movestick Mini.lnk [2016-02-01]
ShortcutTarget: Moveslink for Movestick Mini.lnk -> C:\Windows\Installer\{4D036ACA-DFDF-41B2-A680-E0D736F3E947}\_22A9010B636AF7A61D8E03.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2014-11-18]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaWiFi.exe (Ralink Technology, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VideoBrowser Camera Monitor.lnk [2015-09-11]
ShortcutTarget: VideoBrowser Camera Monitor.lnk -> C:\Program Files (x86)\Canon Pixela VideoBrowser\CameraMonitor.exe (PIXELA CORPORATION)
Startup: C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2016-05-23]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{700E6166-4808-4F00-BEC5-94704CC93633}: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{9F1850AC-45C5-4E34-A0DF-938B166300BB}: [DhcpNameServer] 192.168.0.1 192.168.0.2
Internet Explorer:
==================
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.claro-search.com/?affID=114506&tt=0413_2&babsrc=HP_clro&mntrId=742bfa5200000000000074e543100086
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> bProtectorDefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.claro-search.com/?q={searchTerms}&affID=114506&tt=0413_2&babsrc=SP_clro&mntrId=742bfa5200000000000074e543100086
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => Keine Datei
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
FireFox:
========
FF ProfilePath: C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default
FF NewTab: hxxp://www.claro-search.com/?affID=114506&tt=0413_2&babsrc=NT_clro&mntrId=742bfa5200000000000074e543100086
FF SelectedSearchEngine: Claro Search
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll [2013-01-03] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll [2013-01-03] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-21] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-21] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\user.js [2013-01-21]
FF SearchPlugin: C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\searchplugins\claro.xml [2013-01-21]
FF Extension: Yahoo! Toolbar - C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-05-25] [ist nicht signiert]
FF Extension: SaveByclick - C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\Extensions\50e5dde6b181e@50e5dde6b1857.com [2016-01-13] [ist nicht signiert]
FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon
FF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon [2016-06-27]
FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon
FF HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Firefox\Extensions: [{58bd07eb-0ee0-4df0-8121-dc9b693373df}] - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension => nicht gefunden
Chrome:
=======
CHR Profile: C:\Users\MEmroi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (SaveByclick) - C:\Users\MEmroi\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakgcbilhdnlpcplelkckgfcfbhmpjoa [2013-01-03]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-27]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-27]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx <nicht gefunden>
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 EpsonScanSvc; C:\windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
R2 ezSharedSvc; C:\windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [Datei ist nicht signiert]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\NIS.exe [289080 2016-06-17] (Symantec Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 RalinkRegistryWriter; C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [372736 2012-01-13] (Ralink Technology, Corp.) [Datei ist nicht signiert]
R2 RalinkRegistryWriter64; C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe [447488 2012-01-13] (Ralink Technology, Corp.) [Datei ist nicht signiert]
S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [625728 2011-08-19] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [311296 2012-03-30] (IDT, Inc.) [Datei ist nicht signiert]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
S3 hpqwmiex; "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\BASHDefs\20160621.003\BHDrvx64.sys [1832176 2016-06-02] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1607000.04C\ccSetx64.sys [174328 2016-06-02] (Symantec Corporation)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [497392 2016-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [156912 2016-06-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\IPSDefs\20160627.005\IDSvia64.sys [876248 2016-06-24] (Symantec Corporation)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [43456 2011-02-02] (hxxp://libusb-win32.sourceforge.net)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1607000.04C\SRTSP64.SYS [773360 2016-06-02] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1607000.04C\SRTSPX64.SYS [48888 2016-06-02] (Symantec Corporation)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [Datei ist nicht signiert]
R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1607000.04C\SYMEFASI64.SYS [1627352 2016-06-02] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [101112 2016-06-27] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1607000.04C\Ironx64.SYS [291056 2016-06-02] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1607000.04C\SYMNETS.SYS [567536 2016-06-02] (Symantec Corporation)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\SDSDefs\20160626.018\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\SDSDefs\20160626.018\EX64.SYS [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-06-30 21:19 - 2016-06-30 21:20 - 00025374 _____ C:\Users\MEmroi\Desktop\FRST.txt
2016-06-30 21:19 - 2016-06-30 21:19 - 02390016 _____ (Farbar) C:\Users\MEmroi\Desktop\FRST64.exe
2016-06-30 21:19 - 2016-06-30 21:19 - 00000000 ____D C:\FRST
2016-06-30 20:34 - 2016-06-30 20:34 - 01496971 _____ C:\Users\MEmroi\Desktop\jpegsnoop-1-7-5-en-win.zip
2016-06-30 20:34 - 2016-06-30 20:34 - 00000000 ____D C:\Users\MEmroi\AppData\Roaming\JPEGsnoop
2016-06-30 20:30 - 2016-06-30 20:30 - 00000000 ____D C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI
2016-06-30 20:28 - 2016-06-30 20:28 - 08820004 _____ C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI.zip
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\ProgramData\ParetoLogic
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\Program Files (x86)\ParetoLogic
2016-06-27 17:24 - 2016-06-27 17:24 - 00002242 _____ C:\ScraperDecryptor.1.0.0.2_27.06.2016_17.24.01_log.txt
2016-06-27 17:22 - 2016-06-27 17:23 - 00002502 _____ C:\RakhniDecryptor.1.15.10.0_27.06.2016_17.22.05_log.txt
2016-06-27 16:40 - 2016-06-27 17:04 - 63037856 _____ C:\RectorDecryptor.2.7.0.0_27.06.2016_16.40.51_log.txt
2016-06-27 16:32 - 2016-06-27 16:40 - 11183508 _____ C:\XoristDecryptor.2.4.0.0_27.06.2016_16.32.28_log.txt
2016-06-27 16:28 - 2016-06-27 16:28 - 00002222 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.28.04_log.txt
2016-06-27 16:25 - 2016-06-27 16:27 - 00002416 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.25.40_log.txt
2016-06-27 16:19 - 2016-06-27 16:22 - 00002310 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.19.29_log.txt
2016-06-27 16:16 - 2016-06-27 16:18 - 00002494 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.16.26_log.txt
2016-06-27 16:05 - 2016-06-06 18:58 - 00041704 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-06-27 16:05 - 2016-06-06 18:50 - 01204224 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-06-27 16:05 - 2016-06-03 15:05 - 01413120 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00569856 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00544256 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00265216 _____ (Microsoft Corporation) C:\windows\system32\centel.dll
2016-06-27 16:05 - 2016-05-22 15:06 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-06-27 16:05 - 2016-05-20 23:59 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2016-06-27 16:05 - 2016-05-20 23:57 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2016-06-27 16:05 - 2016-05-20 23:54 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2016-06-27 16:05 - 2016-05-20 23:48 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2016-06-27 16:05 - 2016-05-20 23:26 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2016-06-27 16:05 - 2016-05-18 18:10 - 00312832 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2016-06-27 16:05 - 2016-05-18 18:09 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2016-06-27 16:05 - 2016-05-14 00:15 - 00382184 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2016-06-27 16:05 - 2016-05-13 23:54 - 00308456 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2016-06-27 16:05 - 2016-05-13 23:50 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2016-06-27 16:05 - 2016-05-13 23:49 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2016-06-27 16:05 - 2016-05-13 23:49 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2016-06-27 16:05 - 2016-05-13 23:27 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2016-06-27 16:05 - 2016-05-12 19:20 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2016-06-27 16:05 - 2016-05-12 19:20 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2016-06-27 16:05 - 2016-05-12 19:15 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\winipsec.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 01464320 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00794624 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00502272 _____ (Microsoft Corporation) C:\windows\system32\IPSECSVC.DLL
2016-06-27 16:05 - 2016-05-12 19:14 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00373760 _____ (Microsoft Corporation) C:\windows\system32\polstore.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00316416 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00096256 _____ (Microsoft Corporation) C:\windows\system32\gpapi.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\FwRemoteSvr.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\polstore.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00260608 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00079360 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpapi.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00070144 _____ (Microsoft Corporation) C:\windows\SysWOW64\winipsec.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\FwRemoteSvr.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2016-06-27 16:05 - 2016-05-12 17:05 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2016-06-27 16:05 - 2016-05-12 17:03 - 03217408 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00464896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2016-06-27 16:05 - 2016-05-12 16:57 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2016-06-27 16:05 - 2016-05-12 16:56 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2016-06-27 16:05 - 2016-05-12 16:51 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2016-06-27 16:05 - 2016-05-12 15:05 - 00459640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2016-06-27 16:05 - 2016-05-12 15:05 - 00297984 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2016-06-27 16:05 - 2016-05-12 15:04 - 00249352 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00483840 _____ (Microsoft Corporation) C:\windows\system32\StructuredQuery.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00444928 _____ (Microsoft Corporation) C:\windows\system32\winhttp.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00327168 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\ws2_32.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00363520 _____ (Microsoft Corporation) C:\windows\SysWOW64\StructuredQuery.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00351744 _____ (Microsoft Corporation) C:\windows\SysWOW64\winhttp.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00231424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mswsock.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ws2_32.dll
2016-06-27 16:05 - 2016-05-11 17:11 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\netbtugc.exe
2016-06-27 16:05 - 2016-05-11 17:01 - 00026624 _____ (Microsoft Corporation) C:\windows\SysWOW64\netbtugc.exe
2016-06-27 16:05 - 2016-05-11 16:58 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netbt.sys
2016-06-27 16:05 - 2016-04-14 18:46 - 00114408 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2016-06-27 16:05 - 2016-04-14 18:42 - 03243520 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\msimsg.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 02365440 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 01806848 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 00025088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msimsg.dll
2016-06-27 16:05 - 2016-04-14 17:19 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe
2016-06-27 16:05 - 2016-04-14 17:11 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe
2016-06-27 16:05 - 2016-04-09 08:58 - 14186496 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2016-06-27 16:05 - 2016-04-09 08:57 - 01867776 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll
2016-06-27 16:05 - 2016-04-09 08:54 - 12881408 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2016-06-27 16:05 - 2016-04-09 08:54 - 01499648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll
2016-06-27 16:05 - 2016-04-09 07:53 - 03231232 _____ (Microsoft Corporation) C:\windows\explorer.exe
2016-06-27 16:05 - 2016-04-09 07:44 - 02973184 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
2016-06-27 16:05 - 2016-03-09 21:00 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\webio.dll
2016-06-27 16:05 - 2016-03-09 20:40 - 00316416 _____ (Microsoft Corporation) C:\windows\SysWOW64\webio.dll
2016-06-27 16:04 - 2016-05-24 01:37 - 00394960 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2016-06-27 16:04 - 2016-05-24 00:54 - 00346312 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2016-06-27 16:04 - 2016-05-21 19:28 - 25802752 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-06-27 16:04 - 2016-05-21 18:57 - 20341248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2016-06-27 16:04 - 2016-05-21 00:27 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2016-06-27 16:04 - 2016-05-21 00:27 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2016-06-27 16:04 - 2016-05-21 00:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2016-06-27 16:04 - 2016-05-21 00:10 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2016-06-27 16:04 - 2016-05-21 00:09 - 00572416 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-06-27 16:04 - 2016-05-21 00:09 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2016-06-27 16:04 - 2016-05-21 00:09 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2016-06-27 16:04 - 2016-05-21 00:08 - 02895360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2016-06-27 16:04 - 2016-05-21 00:08 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2016-06-27 16:04 - 2016-05-21 00:02 - 06051328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-06-27 16:04 - 2016-05-21 00:00 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2016-06-27 16:04 - 2016-05-20 23:57 - 00497664 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2016-06-27 16:04 - 2016-05-20 23:57 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2016-06-27 16:04 - 2016-05-20 23:56 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2016-06-27 16:04 - 2016-05-20 23:56 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2016-06-27 16:04 - 2016-05-20 23:55 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2016-06-27 16:04 - 2016-05-20 23:50 - 02287104 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2016-06-27 16:04 - 2016-05-20 23:49 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2016-06-27 16:04 - 2016-05-20 23:45 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2016-06-27 16:04 - 2016-05-20 23:45 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2016-06-27 16:04 - 2016-05-20 23:44 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2016-06-27 16:04 - 2016-05-20 23:44 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2016-06-27 16:04 - 2016-05-20 23:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2016-06-27 16:04 - 2016-05-20 23:41 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2016-06-27 16:04 - 2016-05-20 23:33 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2016-06-27 16:04 - 2016-05-20 23:33 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2016-06-27 16:04 - 2016-05-20 23:32 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2016-06-27 16:04 - 2016-05-20 23:29 - 13815808 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2016-06-27 16:04 - 2016-05-20 23:28 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2016-06-27 16:04 - 2016-05-20 23:27 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-06-27 16:04 - 2016-05-20 23:27 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-06-27 16:04 - 2016-05-20 23:25 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2016-06-27 16:04 - 2016-05-20 23:23 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2016-06-27 16:04 - 2016-05-20 23:23 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2016-06-27 16:04 - 2016-05-20 23:22 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2016-06-27 16:04 - 2016-05-20 23:21 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2016-06-27 16:04 - 2016-05-20 23:19 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2016-06-27 16:04 - 2016-05-20 23:14 - 04610048 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2016-06-27 16:04 - 2016-05-20 23:12 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2016-06-27 16:04 - 2016-05-20 23:11 - 15420928 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-06-27 16:04 - 2016-05-20 23:11 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2016-06-27 16:04 - 2016-05-20 23:09 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2016-06-27 16:04 - 2016-05-20 23:09 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2016-06-27 16:04 - 2016-05-20 23:08 - 02055680 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2016-06-27 16:04 - 2016-05-20 23:08 - 00806400 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-06-27 16:04 - 2016-05-20 23:07 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2016-06-27 16:04 - 2016-05-20 23:07 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2016-06-27 16:04 - 2016-05-20 23:06 - 02131968 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2016-06-27 16:04 - 2016-05-20 22:46 - 02597888 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-06-27 16:04 - 2016-05-20 22:42 - 02121216 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2016-06-27 16:04 - 2016-05-20 22:38 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2016-06-27 16:04 - 2016-05-20 22:38 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2016-06-27 16:04 - 2016-05-20 22:34 - 01544192 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-06-27 16:04 - 2016-05-20 22:23 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2016-06-27 15:53 - 2016-06-30 20:54 - 00000000 ____D C:\Users\MEmroi\Desktop\Test
2016-06-27 15:13 - 2016-06-27 15:13 - 00000000 ____D C:\windows\System32\Tasks\Norton Internet Security
2016-06-27 15:06 - 2016-06-27 15:06 - 00003234 _____ C:\windows\System32\Tasks\Norton WSC Integration
2016-06-27 15:06 - 2016-06-27 15:06 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2016-06-27 14:31 - 2016-06-27 14:54 - 00000000 ____D C:\windows\pss
2016-06-27 14:30 - 2016-06-27 16:22 - 00000109 _____ C:\Users\MEmroi\Desktop\todo.txt
2016-06-12 17:10 - 2016-06-12 17:11 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-06-12 17:10 - 2016-06-12 17:10 - 00002119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-06-12 17:10 - 2016-06-12 17:10 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2016-06-12 17:05 - 2016-06-12 17:11 - 00001912 _____ C:\windows\epplauncher.mif
2016-06-12 16:51 - 2016-06-12 16:52 - 00081278 _____ C:\windows\ntbtlog.txt
2016-06-12 09:52 - 2016-06-12 09:52 - 01078896 ____R C:\Users\MEmroi\Desktop\BoardingPassWAGNERGERLINDE.pdf.crypz
2016-06-12 09:44 - 2016-06-12 09:44 - 01127162 ____R C:\Users\MEmroi\Desktop\BoardingPassEmroiSILKE.pdf.crypz
2016-06-06 21:04 - 2016-06-06 21:27 - 00524995 ____R C:\Users\MEmroi\Desktop\Bild_FamEmroi_Traktor_sepia.jpg.crypz
2016-06-06 21:03 - 2016-06-06 21:25 - 01358425 ____R C:\Users\MEmroi\Desktop\Bild_Juliane+Daniel_Traktor_sepia.jpg.crypz
2016-06-06 20:51 - 2016-06-06 20:51 - 01426406 ____R C:\Users\MEmroi\Desktop\Bild_Juliane+Daniel_Traktor.jpg.crypz
2016-06-02 17:22 - 2016-06-30 20:48 - 00000000 ____D C:\Users\MEmroi\Desktop\Reini
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-06-30 20:52 - 2013-05-01 11:40 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-30 20:47 - 2012-06-29 13:10 - 00000000 ____D C:\ProgramData\Temp
2016-06-30 20:38 - 2015-05-25 14:38 - 00000911 _____ C:\windows\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9}.job
2016-06-30 20:32 - 2016-05-23 20:22 - 00000000 ____D C:\Users\MEmroi\Desktop\Michaela 40
2016-06-30 20:29 - 2013-05-01 11:40 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-30 20:28 - 2009-07-14 06:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-30 20:28 - 2009-07-14 06:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-30 20:24 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2016-06-28 03:30 - 2013-06-20 13:02 - 00000000 ___RD C:\Users\MEmroi\Google Drive
2016-06-28 03:28 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-06-28 03:28 - 2009-07-14 06:45 - 00409864 _____ C:\windows\system32\FNTCACHE.DAT
2016-06-28 03:27 - 2016-02-25 22:54 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-06-28 03:27 - 2016-02-25 22:54 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-28 03:25 - 2015-04-15 09:04 - 00000000 ____D C:\windows\system32\appraiser
2016-06-28 03:09 - 2013-08-18 03:01 - 00000000 ____D C:\windows\system32\MRT
2016-06-28 03:07 - 2012-11-02 17:20 - 142482544 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2016-06-28 03:06 - 2016-02-25 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-27 15:53 - 2012-06-29 12:49 - 00661764 _____ C:\windows\system32\perfh007.dat
2016-06-27 15:53 - 2012-06-29 12:49 - 00141776 _____ C:\windows\system32\perfc007.dat
2016-06-27 15:53 - 2009-07-14 07:13 - 01529844 _____ C:\windows\system32\PerfStringBackup.INI
2016-06-27 15:53 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf
2016-06-27 15:19 - 2015-08-03 10:29 - 00000000 ____D C:\windows\System32\Tasks\Remediation
2016-06-27 15:06 - 2012-11-02 10:49 - 00002369 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2016-06-27 15:06 - 2012-06-29 13:25 - 00000000 ____D C:\windows\system32\Drivers\NISx64
2016-06-27 14:54 - 2016-04-25 13:10 - 00000000 ____D C:\Users\MEmroi\Desktop\Bilderbestellung
2016-06-27 14:54 - 2016-02-15 13:58 - 00000000 ____D C:\Users\MEmroi\Desktop\Essensplan
2016-06-27 14:54 - 2015-09-02 21:19 - 00000000 ____D C:\Users\MEmroi\Desktop\Silke
2016-06-27 14:54 - 2015-04-10 21:30 - 00000000 ____D C:\Users\MEmroi\Desktop\Annika
2016-06-27 14:54 - 2015-03-05 21:31 - 00000000 ____D C:\Users\MEmroi\Desktop\Haus & Garten
2016-06-27 14:54 - 2014-05-29 13:40 - 00000000 ____D C:\Users\MEmroi\Documents\Silke
2016-06-27 14:54 - 2013-04-20 23:51 - 00000000 ____D C:\Users\MEmroi\Desktop\Sebastian
2016-06-27 14:54 - 2013-04-06 11:24 - 00000000 ____D C:\Users\MEmroi\Downloads\Hotel
2016-06-27 14:54 - 2013-01-21 21:15 - 00000000 ___HD C:\Users\MEmroi\Desktop\[Originaldateien]
2016-06-27 14:54 - 2012-11-09 21:51 - 00000000 ____D C:\Users\MEmroi\Documents\Symantec
2016-06-27 14:54 - 2012-11-04 15:41 - 00000000 ____D C:\Users\MEmroi\Documents\Eigene Scans
2016-06-27 14:31 - 2012-06-29 13:25 - 00000000 ____D C:\ProgramData\Norton
2016-06-27 14:30 - 2012-06-29 13:26 - 00101112 _____ (Symantec Corporation) C:\windows\system32\Drivers\SYMEVENT64x86.SYS
2016-06-27 14:30 - 2012-06-29 13:26 - 00008270 _____ C:\windows\system32\Drivers\SYMEVENT64x86.CAT
2016-06-27 14:28 - 2013-05-11 17:43 - 00000000 ____D C:\Users\Public\Downloads\Norton
2016-06-27 14:23 - 2012-11-02 11:08 - 00000000 ____D C:\e16e42fe9f9fdd8cd9ef
2016-06-27 14:23 - 2011-02-11 18:32 - 00000000 __RHD C:\SYSTEM.SAV
2016-06-27 14:23 - 2011-02-11 18:32 - 00000000 ____D C:\SWSETUP
2016-06-15 22:40 - 2010-11-21 05:27 - 00484008 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2016-06-12 23:27 - 2012-11-04 15:27 - 00000000 ____D C:\Users\MEmroi\AppData\Local\CrashDumps
2016-06-12 22:00 - 2013-04-23 20:57 - 00000000 ____D C:\windows\KJ
2016-06-12 10:16 - 2014-07-04 15:40 - 00000000 ____D C:\Users\MEmroi\Documents\WISO Mein Geld
2016-06-12 10:03 - 2012-12-02 14:14 - 00000000 ____D C:\Users\MEmroi\Documents\Outlook-Dateien
2016-06-07 14:12 - 2016-05-29 20:37 - 00013169 ____R C:\Users\MEmroi\Desktop\PACKLISTE MALLORCA.xlsx.crypz
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2013-01-21 16:01 - 2016-05-23 22:21 - 0014848 _____ () C:\Users\MEmroi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-11-02 11:05 - 2013-09-08 13:12 - 0005439 _____ () C:\ProgramData\hpzinstall.log
2014-05-21 21:24 - 2014-05-25 14:32 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\windows\system32\winlogon.exe => Datei ist digital signiert
C:\windows\system32\wininit.exe => Datei ist digital signiert
C:\windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\windows\explorer.exe => Datei ist digital signiert
C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\windows\system32\svchost.exe => Datei ist digital signiert
C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\windows\system32\services.exe => Datei ist digital signiert
C:\windows\system32\User32.dll => Datei ist digital signiert
C:\windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\windows\system32\userinit.exe => Datei ist digital signiert
C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\windows\system32\rpcss.dll => Datei ist digital signiert
C:\windows\system32\dnsapi.dll => Datei ist digital signiert
C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-06-29 23:19
==================== Ende von FRST.txt ============================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 29-06-2016
durchgeführt von MEmroi (2016-06-30 21:24:31)
Gestartet von C:\Users\MEmroi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2012-10-27 13:00:04)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-1078291597-1949154093-2174115440-500 - Administrator - Disabled)
Gast (S-1-5-21-1078291597-1949154093-2174115440-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1078291597-1949154093-2174115440-1002 - Limited - Enabled)
MEmroi (S-1-5-21-1078291597-1949154093-2174115440-1001 - Administrator - Enabled) => C:\Users\MEmroi
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Norton Internet Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
ACDSee Pro 4 (HKLM-x32\...\{88D4FE78-6EA6-4DFB-9FC2-8BC316F0C2FD}) (Version: 4.0.237 - ACD Systems International Inc.)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.5.502.135 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Reader XI - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{FEAA5D71-B0FB-4EF9-729F-8AE42500AF41}) (Version: 8.0.873.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
BrowserProtect (HKLM-x32\...\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}) (Version: - Bit89 Inc) <==== ACHTUNG
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 2.9.0.0 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.18.42 - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.0.0 - Hewlett-Packard) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 6.1.3 - CEWE Stiftung u Co. KGaA)
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 17.2.19144 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON XP-520 Series Printer Uninstall (HKLM\...\EPSON XP-520 Series) (Version: - SEIKO EPSON Corporation)
EpsonNet Print (HKLM\...\{DF5200AB-5AE6-4598-846B-8ABC3AE121B1}) (Version: 3.0.2.0 - SEIKO EPSON Corporation)
FileZilla Client 3.7.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.7.0.2 - FileZilla Project)
Google Drive (HKLM-x32\...\{709316AD-161C-4D5C-9AE7-0B3A822DA271}) (Version: 1.30.2170.0459 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Imaging Device Functions 14.5 (HKLM\...\HP Imaging Device Functions) (Version: 14.5 - HP)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Scanjet G4050 (HKLM\...\{0A9FC1DA-46F7-4305-A4EF-FDCA8D9B1A5A}) (Version: 14.5 - HP)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
hpg4050 (x32 Version: 140.000.000.000 - Ihr Firmenname) Hidden
HydraVision (x32 Version: 4.2.236.0 - Advanced Micro Devices, Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Moveslink for Movestick Mini (HKLM-x32\...\{4D036ACA-DFDF-41B2-A680-E0D736F3E947}) (Version: 1.2.40 - Suunto)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.7.0.76 - Symantec Corporation)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.6207 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.) Hidden
Ralink 802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.12.0 - Ralink)
Recovery Manager (x32 Version: 5.5.0.5119 - CyberLink Corp.) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.3.12085_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.3.3.12085_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.9.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 14.0.1.0 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Software Updater (HKLM-x32\...\{FA7EE274-7370-43B7-9A45-A39B17CCCDC5}) (Version: 4.3.3 - SEIKO EPSON CORPORATION)
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{355FBD67-5A4F-44DA-86A1-56EEC4C20EC0}) (Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.01 - Ghisler Software GmbH)
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
VideoBrowser (HKLM-x32\...\{D79DC615-EC9F-4EFA-9482-5911168D8F32}) (Version: 2.07.272 - PIXELA)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WISO Mein Geld 2014 Professional (HKLM-x32\...\WISO Mein Geld 2014 Professional) (Version: - Buhl Data Service GmbH)
WISO Mein Geld 2014 Professional (x32 Version: 16.0.1.0 - Buhl Data Service GmbH) Hidden
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {12FC4FF9-7B70-4E8E-9742-842DAF7AD37F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {25173BAD-AE80-429D-80AC-0581EAB29E86} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {29FD5682-D083-447D-B032-DC706A78BE25} - System32\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9} => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {2DD1EF97-2BD9-4192-8C6D-F79C41CD6A67} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {2E00554E-F38D-4F5D-BC96-F49828EA272D} - System32\Tasks\{4A40F400-9FC1-4E56-A9D4-FDC1DD28E72A} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.6.0.110.396/de/abandoninstall?page=tsMain&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {4B843D9F-15C7-473E-8BAB-E273B201086F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {68EAB01E-F3C7-47A5-B624-2A3FFF84E611} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {7BF535D5-1045-40EB-B5A9-B65337A20757} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Task: {946DEF4B-1EDE-473F-8F51-B9B734B51B8A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {99883B5A-C2B3-43A6-9D03-A72EDED1ACF7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {A2883FB2-7EC3-4E31-935A-D23C4AF25EB0} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {CEB31460-73CF-4356-BB91-B1A3415CA158} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\WSCStub.exe [2016-06-17] (Symantec Corporation)
Task: {DD93F5F7-9E53-4001-B178-A4685C8E7315} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2016-06-17] (Symantec Corporation)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\windows\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE:/EXE:{D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9} /F:UpdateSYSTEMĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2015-09-23 16:47 - 2015-09-23 16:47 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 06:45 - 2015-10-13 06:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-03-19 19:36 - 2012-03-19 19:36 - 00452472 ____N () C:\Program Files (x86)\Hewlett-Packard\Recovery\Protect.dll
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-08-31 10:52 - 2012-08-31 10:52 - 00021432 _____ () C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
2016-06-27 15:07 - 2016-06-27 15:07 - 00115137 _____ () C:\Users\MEmroi\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll
2013-05-26 17:53 - 2013-05-26 17:53 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2009-12-08 16:54 - 2009-12-08 16:54 - 02011648 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtCore4.dll
2009-09-29 14:43 - 2009-09-29 14:43 - 07462912 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtGui4.dll
2009-09-29 14:31 - 2009-09-29 14:31 - 00337408 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtXml4.dll
2009-09-29 14:32 - 2009-09-29 14:32 - 00877056 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtNetwork4.dll
2012-06-29 13:10 - 2012-02-10 05:42 - 01087336 _____ () C:\Program Files (x86)\Ralink\Common\RaWLAPI.dll
2012-12-09 18:33 - 2010-07-01 21:27 - 00364544 ____N () C:\Program Files (x86)\Canon Pixela VideoBrowser\pxl_m17n_tool.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00098816 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32api.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00110080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pywintypes27.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00364544 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pythoncom27.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00320512 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32com.shell.shell.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00776704 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_hashlib.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 01176576 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._core_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00806400 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._gdi_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00816128 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._windows_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 01067008 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._controls_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00733184 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._misc_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00682496 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pysqlite2._sqlite.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00088064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_ctypes.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00119808 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32file.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00108544 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32security.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00007168 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\hashobjs_ext.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00017920 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\thumbnails_ext.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00088064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\usb_ext.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00012288 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\common.time34.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00018432 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32event.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00167936 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32gui.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00046080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_socket.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 01208320 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_ssl.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00128512 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_elementtree.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00127488 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pyexpat.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00038912 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32inet.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00036864 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_psutil_windows.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00525208 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\windows._lib_cacheinvalidation.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00011264 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32crypt.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00077312 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._html2.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00027136 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_multiprocessing.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00020480 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_yappi.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00035840 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32process.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00686080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\unicodedata.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00078848 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._animate.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00123392 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._wizard.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00024064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32pipe.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00010240 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\select.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00025600 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32pdh.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00017408 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32profile.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00022528 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32ts.pyd
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData\Temp:21071F2D [140]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1 - 192.168.0.2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [{711178F2-CB02-4399-8AE6-E515DF5491DC}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{BA299467-B3FB-4D47-9F02-E22DAD8C5106}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{2886F0B2-6822-4A0C-A47B-60B46116023D}] => (Allow) C:\windows\system32\ezSharedSvcHost.exe
FirewallRules: [{D8D0A7A4-8042-422D-9DE1-4B0306765DAF}] => (Allow) C:\Program Files (x86)\EasyBits For Kids\ezDesktop.exe
FirewallRules: [{5A679B34-8ED8-4DD9-860E-B77131F013B9}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6F82E790-AC0E-401C-A9BA-FCC6E36D2E1A}] => (Allow) LPort=2869
FirewallRules: [{AD1F6958-00B5-4018-8B50-421E9371CF5F}] => (Allow) LPort=1900
FirewallRules: [{3C78D814-3EF4-4468-BB33-442DF3836289}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{6059852C-72E0-46B9-8D40-F307DB9B2738}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{A383014E-086F-4A34-8BD5-C83ABD516AB2}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
FirewallRules: [{6DD9BBB1-554D-4174-839E-DDB97B1D2EBE}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
FirewallRules: [{45CA9F59-F8F6-40BB-92DD-27079B7A186A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{77E5BE83-4657-45C8-B680-94D36C87EB54}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{C9E64346-40C2-4C4C-9A23-6DDE5F9DF1F5}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{76F311C1-DBE3-4D14-9947-E70D67B45B19}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{416F2F70-C941-4448-AC46-7820FAAAF5B7}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{9F5449E9-13DF-43EB-9BCD-5DB9A4035580}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{0109FDA5-9A78-41C3-A6A1-C323D98AE6E3}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{522A3FFA-5FDA-409F-BE72-1C7FC37EB6CE}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{68044D01-5D4C-4FAE-AC05-DEBB599EC6E3}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{249F4ACA-B295-4345-912E-5063A4EFBCEB}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{EEADD94E-F4AA-476D-A529-2FF1034F1F30}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F184F795-85DB-4DDB-B73B-70B4AD92DC30}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{814D2F67-0195-4661-921F-AC9365CF5CDD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0E65461E-9799-47A9-AD7D-627BD40CB666}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CCFFC58E-7C19-4FB1-BD00-0B9DE2F8695B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{038F1115-72A9-4266-B250-0F83406E6B35}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{759BF5F2-99E5-4629-AA90-CF199D8FC1AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Wiederherstellungspunkte =========================
12-06-2016 17:12:27 Windows Update
27-06-2016 14:07:57 Windows Update
28-06-2016 03:00:51 Windows Update
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31184
Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 31184
Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15584
Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15584
Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 46785
Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 46785
Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/29/2016 10:03:16 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31185
Systemfehler:
=============
Error: (06/30/2016 08:36:43 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.
Error: (06/30/2016 08:26:52 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/30/2016 08:26:52 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/28/2016 03:31:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2 = Das System kann die angegebene Datei nicht finden.
Error: (06/28/2016 03:29:23 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error: (06/28/2016 03:29:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Ralink UPnP Media Server erreicht.
Error: (06/28/2016 03:27:43 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/27/2016 06:29:21 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/27/2016 06:29:21 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)
Error: (06/27/2016 04:27:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2 = Das System kann die angegebene Datei nicht finden.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 8148.01 MB
Verfügbarer physikalischer RAM: 5198.3 MB
Summe virtueller Speicher: 16294.21 MB
Verfügbarer virtueller Speicher: 12200.49 MB
==================== Laufwerke ================================
Drive c: (OS) (Fixed) (Total:935.96 GB) (Free:779.71 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.74 GB) (Free:2.09 GB) NTFS
Drive l: (Bilder und Videos) (Fixed) (Total:910.09 GB) (Free:692.84 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: C55D8423)
Partition: GPT.
==================== Ende von Addition.txt ============================
|
|
30.06.2016, 20:56
| #2 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Output TDSSKiller: keine Rootkits:
__________________Code:
ATTFilter 21:43:26.0659 0x0394 TDSS rootkit removing tool 3.1.0.9 Dec 11 2015 22:49:12
21:43:26.0659 0x0394 UEFI system
21:43:46.0691 0x0394 ============================================================
21:43:46.0691 0x0394 Current date / time: 2016/06/30 21:43:46.0691
21:43:46.0691 0x0394 SystemInfo:
21:43:46.0691 0x0394
21:43:46.0691 0x0394 OS Version: 6.1.7601 ServicePack: 1.0
21:43:46.0691 0x0394 Product type: Workstation
21:43:46.0691 0x0394 ComputerName: Emroi
21:43:46.0691 0x0394 UserName: MEmroi
21:43:46.0691 0x0394 Windows directory: C:\windows
21:43:46.0691 0x0394 System windows directory: C:\windows
21:43:46.0691 0x0394 Running under WOW64
21:43:46.0691 0x0394 Processor architecture: Intel x64
21:43:46.0691 0x0394 Number of processors: 8
21:43:46.0691 0x0394 Page size: 0x1000
21:43:46.0691 0x0394 Boot type: Normal boot
21:43:46.0691 0x0394 ============================================================
21:43:48.0121 0x0394 KLMD registered as C:\windows\system32\drivers\88143396.sys
21:43:48.0751 0x0394 System UUID: {1E9863B0-9611-6E4F-DC16-9763D5925415}
21:43:49.0412 0x0394 Drive \Device\Harddisk0\DR0 - Size: 0x1D1C1116000 ( 1863.02 Gb ), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:43:49.0442 0x0394 ============================================================
21:43:49.0442 0x0394 \Device\Harddisk0\DR0:
21:43:49.0442 0x0394 GPT partitions:
21:43:49.0442 0x0394 \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {FBC59852-7725-4D48-A545-0BFC5951B189}, Name: EFI system partition, StartLBA 0x800, BlocksNum 0x32000
21:43:49.0442 0x0394 \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {C7BB0541-90B9-42BC-B5C9-D14F31FDAF86}, Name: Microsoft reserved partition, StartLBA 0x32800, BlocksNum 0x40000
21:43:49.0442 0x0394 \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {03CC4A9B-6E24-4FE6-91D1-5DDBA24B2191}, Name: Basic data partition, StartLBA 0x72800, BlocksNum 0x74FE9800
21:43:49.0442 0x0394 \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {DC5FD122-A930-46D3-B08E-186A2B15F958}, Name: Basic data partition, StartLBA 0x7505C000, BlocksNum 0x71C2F000
21:43:49.0442 0x0394 \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {E6E2A852-094E-4922-8F0A-0970F30DB8D3}, Name: Basic data partition, StartLBA 0xE6C8B800, BlocksNum 0x217D000
21:43:49.0442 0x0394 MBR partitions:
21:43:49.0442 0x0394 ============================================================
21:43:49.0472 0x0394 C: <-> \Device\Harddisk0\DR0\Partition3
21:43:49.0522 0x0394 D: <-> \Device\Harddisk0\DR0\Partition5
21:43:49.0542 0x0394 L: <-> \Device\Harddisk0\DR0\Partition4
21:43:49.0542 0x0394 ============================================================
21:43:49.0542 0x0394 Initialize success
21:43:49.0542 0x0394 ============================================================
21:44:31.0997 0x0c60 ============================================================
21:44:31.0997 0x0c60 Scan started
21:44:31.0997 0x0c60 Mode: Manual; SigCheck; TDLFS;
21:44:31.0997 0x0c60 ============================================================
21:44:31.0997 0x0c60 KSN ping started
21:44:32.0107 0x0c60 KSN ping finished: true
21:44:33.0107 0x0c60 ================ Scan system memory ========================
21:44:33.0107 0x0c60 System memory - ok
21:44:33.0107 0x0c60 ================ Scan services =============================
21:44:33.0277 0x0c60 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\windows\system32\drivers\1394ohci.sys
21:44:33.0367 0x0c60 1394ohci - ok
21:44:33.0387 0x0c60 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\windows\system32\drivers\ACPI.sys
21:44:33.0397 0x0c60 ACPI - ok
21:44:33.0407 0x0c60 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\windows\system32\drivers\acpipmi.sys
21:44:33.0427 0x0c60 AcpiPmi - ok
21:44:33.0497 0x0c60 [ B1EA9681502EE57F87DB71D726288A5B, D17BD2CFAE72E92C77D183331D5CBA0FEA893BF54875920870E271940F40A8BB ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:44:33.0507 0x0c60 AdobeARMservice - ok
21:44:33.0537 0x0c60 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\windows\system32\drivers\adp94xx.sys
21:44:33.0557 0x0c60 adp94xx - ok
21:44:33.0587 0x0c60 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\windows\system32\drivers\adpahci.sys
21:44:33.0607 0x0c60 adpahci - ok
21:44:33.0627 0x0c60 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\windows\system32\drivers\adpu320.sys
21:44:33.0637 0x0c60 adpu320 - ok
21:44:33.0657 0x0c60 [ 262D7C87D0AC20B96EF9877D3CA478A0, 54F7E5A5F8991C5525500C1ECCF3D3135D13F48866C366E52DF1D052DB2EE15B ] AeLookupSvc C:\windows\System32\aelupsvc.dll
21:44:33.0677 0x0c60 AeLookupSvc - ok
21:44:33.0697 0x0c60 [ 9A4A1EEE802BF2F878EE8EAB407B21B7, 177EB7DF4B35FE4C0E45E775A0FD5D48D39B410052E3EE18BDEEC809E152D9D8 ] AFD C:\windows\system32\drivers\afd.sys
21:44:33.0717 0x0c60 AFD - ok
21:44:33.0737 0x0c60 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\windows\system32\drivers\agp440.sys
21:44:33.0747 0x0c60 agp440 - ok
21:44:33.0767 0x0c60 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\windows\System32\alg.exe
21:44:33.0787 0x0c60 ALG - ok
21:44:33.0807 0x0c60 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\windows\system32\drivers\aliide.sys
21:44:33.0817 0x0c60 aliide - ok
21:44:33.0857 0x0c60 [ D4E34B0ED7292E6E424FABCB485937B9, 6384BDFD74D2F40B388221ABFF031E98A7B80A2FF80024951F878B24E8AF0D50 ] AMD External Events Utility C:\windows\system32\atiesrxx.exe
21:44:33.0887 0x0c60 AMD External Events Utility - ok
21:44:33.0897 0x0c60 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\windows\system32\drivers\amdide.sys
21:44:33.0907 0x0c60 amdide - ok
21:44:33.0927 0x0c60 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\windows\system32\drivers\amdk8.sys
21:44:33.0947 0x0c60 AmdK8 - ok
21:44:34.0177 0x0c60 [ A34D82F86C2D95E613343BD272B83A85, 494F83E895B13E285B5009CA5702AF169B9EA5D469B0AA7595AA309C6D53E3AF ] amdkmdag C:\windows\system32\DRIVERS\atikmdag.sys
21:44:34.0337 0x0c60 amdkmdag - ok
21:44:34.0367 0x0c60 [ 301D1B0CBA2A5E2AE2C05E7CFA0ADF8E, 32567C244DFFA2CA2A50D5441A81153D091236187B36E7EE626589C29F36182D ] amdkmdap C:\windows\system32\DRIVERS\atikmpag.sys
21:44:34.0387 0x0c60 amdkmdap - ok
21:44:34.0407 0x0c60 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\windows\system32\drivers\amdppm.sys
21:44:34.0417 0x0c60 AmdPPM - ok
21:44:34.0437 0x0c60 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\windows\system32\drivers\amdsata.sys
21:44:34.0457 0x0c60 amdsata - ok
21:44:34.0477 0x0c60 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\windows\system32\drivers\amdsbs.sys
21:44:34.0487 0x0c60 amdsbs - ok
21:44:34.0507 0x0c60 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\windows\system32\drivers\amdxata.sys
21:44:34.0517 0x0c60 amdxata - ok
21:44:34.0557 0x0c60 [ 6474F8823C7188D2DA579F01FB6CED6B, 81D4E9D026CA60FB8840D520D151B8C2F4745A75DF90A4D6C80641F1A23AB605 ] AppID C:\windows\system32\drivers\appid.sys
21:44:34.0597 0x0c60 AppID - ok
21:44:34.0607 0x0c60 [ 8F58BA1F7772D6D7CE45F03309608001, CDB109E0DD241042C058F7D81A1BDEBC34435CB2DC4A7A7A3692193DD5806097 ] AppIDSvc C:\windows\System32\appidsvc.dll
21:44:34.0617 0x0c60 AppIDSvc - ok
21:44:34.0647 0x0c60 [ B62867835B41BCD839D9896AB4D7DF09, 98036D0202DB6171E90485898175833AC44873A85E6453EBE928E433B364CE07 ] Appinfo C:\windows\System32\appinfo.dll
21:44:34.0677 0x0c60 Appinfo - ok
21:44:34.0777 0x0c60 [ 2D564BB1C4559A517B390A031955714D, 3048C187FD107C958D43DD8B954AB55FDD1BC538D3E0066CBFCB428C7A8A87E1 ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:44:34.0797 0x0c60 Apple Mobile Device Service - ok
21:44:34.0817 0x0c60 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\windows\system32\drivers\arc.sys
21:44:34.0827 0x0c60 arc - ok
21:44:34.0847 0x0c60 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\windows\system32\drivers\arcsas.sys
21:44:34.0867 0x0c60 arcsas - ok
21:44:34.0927 0x0c60 [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:44:34.0957 0x0c60 aspnet_state - ok
21:44:34.0987 0x0c60 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\windows\system32\DRIVERS\asyncmac.sys
21:44:35.0017 0x0c60 AsyncMac - ok
21:44:35.0027 0x0c60 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\windows\system32\drivers\atapi.sys
21:44:35.0047 0x0c60 atapi - ok
21:44:35.0077 0x0c60 [ 24464B908E143D2561E9E452FEE97309, F5A24FEBAD1B1795A075130F7FFDD4EB76C8F1855FA1628A29CAFAF03C1C9183 ] AtiHDAudioService C:\windows\system32\drivers\AtihdW76.sys
21:44:35.0097 0x0c60 AtiHDAudioService - ok
21:44:35.0137 0x0c60 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
21:44:35.0177 0x0c60 AudioEndpointBuilder - ok
21:44:35.0187 0x0c60 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv C:\windows\System32\Audiosrv.dll
21:44:35.0207 0x0c60 AudioSrv - ok
21:44:35.0247 0x0c60 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\windows\System32\AxInstSV.dll
21:44:35.0287 0x0c60 AxInstSV - ok
21:44:35.0307 0x0c60 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\windows\system32\drivers\bxvbda.sys
21:44:35.0337 0x0c60 b06bdrv - ok
21:44:35.0377 0x0c60 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\windows\system32\DRIVERS\b57nd60a.sys
21:44:35.0407 0x0c60 b57nd60a - ok
21:44:35.0417 0x0c60 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\windows\System32\bdesvc.dll
21:44:35.0447 0x0c60 BDESVC - ok
21:44:35.0457 0x0c60 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\windows\system32\drivers\Beep.sys
21:44:35.0487 0x0c60 Beep - ok
21:44:35.0507 0x0c60 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\windows\System32\bfe.dll
21:44:35.0537 0x0c60 BFE - ok
21:44:35.0687 0x0c60 [ 4E8EF55692BDCB8BA97888877CD034AC, 050C73032D77D57E3B79D1BFB3F2D7F2E9CED1188F53576223FE10149D86AB6C ] BHDrvx64 C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\BASHDefs\20160621.003\BHDrvx64.sys
21:44:35.0737 0x0c60 BHDrvx64 - ok
21:44:35.0767 0x0c60 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\windows\System32\qmgr.dll
21:44:35.0807 0x0c60 BITS - ok
21:44:35.0827 0x0c60 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\windows\system32\drivers\blbdrive.sys
21:44:35.0847 0x0c60 blbdrive - ok
21:44:35.0887 0x0c60 [ B5C2F92EE1106DFE7BB1CCE4D35B6037, E399C390687589194D8AAD385055F0CFA7D52AD9E837D8FF95008B8EB2B34E50 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
21:44:35.0907 0x0c60 Bonjour Service - ok
21:44:35.0927 0x0c60 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\windows\system32\DRIVERS\bowser.sys
21:44:35.0967 0x0c60 bowser - ok
21:44:35.0987 0x0c60 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\windows\system32\drivers\BrFiltLo.sys
21:44:36.0007 0x0c60 BrFiltLo - ok
21:44:36.0017 0x0c60 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\windows\system32\drivers\BrFiltUp.sys
21:44:36.0037 0x0c60 BrFiltUp - ok
21:44:36.0057 0x0c60 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\windows\System32\browser.dll
21:44:36.0087 0x0c60 Browser - ok
21:44:36.0097 0x0c60 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\windows\System32\Drivers\Brserid.sys
21:44:36.0117 0x0c60 Brserid - ok
21:44:36.0127 0x0c60 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\windows\System32\Drivers\BrSerWdm.sys
21:44:36.0147 0x0c60 BrSerWdm - ok
21:44:36.0157 0x0c60 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\windows\System32\Drivers\BrUsbMdm.sys
21:44:36.0177 0x0c60 BrUsbMdm - ok
21:44:36.0187 0x0c60 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\windows\System32\Drivers\BrUsbSer.sys
21:44:36.0197 0x0c60 BrUsbSer - ok
21:44:36.0207 0x0c60 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\windows\system32\drivers\bthmodem.sys
21:44:36.0227 0x0c60 BTHMODEM - ok
21:44:36.0267 0x0c60 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\windows\system32\bthserv.dll
21:44:36.0307 0x0c60 bthserv - ok
21:44:36.0387 0x0c60 [ 03427B8FF618BE50EB5027B4E549C0D8, 3C3815FE3C847B992E794B1BB0FDB87B8D18AEC95BA9E916591CF43EB8169D15 ] ccSet_NIS C:\windows\system32\drivers\NISx64\1607000.04C\ccSetx64.sys
21:44:36.0417 0x0c60 ccSet_NIS - ok
21:44:36.0437 0x0c60 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\windows\system32\DRIVERS\cdfs.sys
21:44:36.0477 0x0c60 cdfs - ok
21:44:36.0517 0x0c60 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\windows\system32\DRIVERS\cdrom.sys
21:44:36.0547 0x0c60 cdrom - ok
21:44:36.0567 0x0c60 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\windows\System32\certprop.dll
21:44:36.0597 0x0c60 CertPropSvc - ok
21:44:36.0627 0x0c60 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\windows\system32\drivers\circlass.sys
21:44:36.0647 0x0c60 circlass - ok
21:44:36.0677 0x0c60 [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS C:\windows\system32\CLFS.sys
21:44:36.0697 0x0c60 CLFS - ok
21:44:36.0747 0x0c60 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:44:36.0777 0x0c60 clr_optimization_v2.0.50727_32 - ok
21:44:36.0797 0x0c60 [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:44:36.0817 0x0c60 clr_optimization_v2.0.50727_64 - ok
21:44:36.0877 0x0c60 [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:44:36.0907 0x0c60 clr_optimization_v4.0.30319_32 - ok
21:44:36.0917 0x0c60 [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:44:36.0937 0x0c60 clr_optimization_v4.0.30319_64 - ok
21:44:36.0947 0x0c60 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\windows\system32\drivers\CmBatt.sys
21:44:36.0957 0x0c60 CmBatt - ok
21:44:36.0977 0x0c60 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\windows\system32\drivers\cmdide.sys
21:44:36.0987 0x0c60 cmdide - ok
21:44:37.0017 0x0c60 [ 3323F76352B0AF14B2CDC4DFBF3E980A, F8E3C3508C37E647497B6889F26819B1DB30275F48A994D1BBFBAA9454E5FD70 ] CNG C:\windows\system32\Drivers\cng.sys
21:44:37.0047 0x0c60 CNG - ok
21:44:37.0067 0x0c60 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\windows\system32\drivers\compbatt.sys
21:44:37.0077 0x0c60 Compbatt - ok
21:44:37.0107 0x0c60 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\windows\system32\drivers\CompositeBus.sys
21:44:37.0127 0x0c60 CompositeBus - ok
21:44:37.0127 0x0c60 COMSysApp - ok
21:44:37.0137 0x0c60 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\windows\system32\drivers\crcdisk.sys
21:44:37.0157 0x0c60 crcdisk - ok
21:44:37.0197 0x0c60 [ 7BC3E861F7E8EB543A630090FAE779E0, 52A538F25C853AAC9706CD0D4EBF80B1963391AA175895CFD9D44C8ABBFCFB74 ] CryptSvc C:\windows\system32\cryptsvc.dll
21:44:37.0217 0x0c60 CryptSvc - ok
21:44:37.0247 0x0c60 [ 622C96AFB07BB82C8650B47172137AC4, B74CEA5A3F4945E5A3EAE7AF1B1FA75F611C65C6FACE393052A512FA81B0C17C ] DcomLaunch C:\windows\system32\rpcss.dll
21:44:37.0277 0x0c60 DcomLaunch - ok
21:44:37.0297 0x0c60 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\windows\System32\defragsvc.dll
21:44:37.0327 0x0c60 defragsvc - ok
21:44:37.0337 0x0c60 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\windows\system32\Drivers\dfsc.sys
21:44:37.0367 0x0c60 DfsC - ok
21:44:37.0417 0x0c60 [ 105373D52E71D2D1355AD3ACD18259C3, F11BDBF370DA30933003CA795A4F67F71681ED924D1A307A2976B4A476EDC6A2 ] dg_ssudbus C:\windows\system32\DRIVERS\ssudbus.sys
21:44:37.0437 0x0c60 dg_ssudbus - ok
21:44:37.0467 0x0c60 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\windows\system32\dhcpcore.dll
21:44:37.0487 0x0c60 Dhcp - ok
21:44:37.0587 0x0c60 [ EC3F433D00365F1A9BC3411BCA7C7140, 0852D747359DE573504EBBDB99DA26D3BFA8B3C7A4836F8E3A5AD94B5571AD5C ] DiagTrack C:\windows\system32\diagtrack.dll
21:44:37.0617 0x0c60 DiagTrack - ok
21:44:37.0637 0x0c60 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\windows\system32\drivers\discache.sys
21:44:37.0667 0x0c60 discache - ok
21:44:37.0697 0x0c60 [ 616387BBD83372220B09DE95F4E67BBC, 5E2D5280BB775576E7CDE3FA6BDE494E183123635E5908CF7EBF1FF52966D07D ] Disk C:\windows\system32\drivers\disk.sys
21:44:37.0717 0x0c60 Disk - ok
21:44:37.0737 0x0c60 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\windows\System32\dnsrslvr.dll
21:44:37.0757 0x0c60 Dnscache - ok
21:44:37.0797 0x0c60 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\windows\System32\dot3svc.dll
21:44:37.0827 0x0c60 dot3svc - ok
21:44:37.0837 0x0c60 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\windows\system32\dps.dll
21:44:37.0867 0x0c60 DPS - ok
21:44:37.0897 0x0c60 [ 26FE888505E5A945B0536AF9A2A27A6F, A6B16ED498BAFE300E1F0E0A241E3D62F7A1C5973EE775904ED14F33A2BC08A6 ] drmkaud C:\windows\system32\drivers\drmkaud.sys
21:44:37.0907 0x0c60 drmkaud - ok
21:44:37.0967 0x0c60 [ 3A9D7D464BDB3B70D7ECF689ADABBD4D, B4F5B23705EA1BA453FE30791CA245E1A5F7FBEABAD026E4A8A15A9FC44E8C9C ] DXGKrnl C:\windows\System32\drivers\dxgkrnl.sys
21:44:37.0997 0x0c60 DXGKrnl - ok
21:44:38.0007 0x0c60 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\windows\System32\eapsvc.dll
21:44:38.0037 0x0c60 EapHost - ok
21:44:38.0107 0x0c60 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\windows\system32\drivers\evbda.sys
21:44:38.0167 0x0c60 ebdrv - ok
21:44:38.0228 0x0c60 [ E5C10FCFA331D2BA13B211D0454FEA38, 9363545317C655EED282BA1FE7C71B26E2C3599F35E42E7496F413961303A24D ] eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
21:44:38.0258 0x0c60 eeCtrl - ok
21:44:38.0278 0x0c60 [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] EFS C:\windows\System32\lsass.exe
21:44:38.0298 0x0c60 EFS - ok
21:44:38.0338 0x0c60 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\windows\ehome\ehRecvr.exe
21:44:38.0368 0x0c60 ehRecvr - ok
21:44:38.0378 0x0c60 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\windows\ehome\ehsched.exe
21:44:38.0398 0x0c60 ehSched - ok
21:44:38.0438 0x0c60 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\windows\system32\drivers\elxstor.sys
21:44:38.0468 0x0c60 elxstor - ok
21:44:38.0498 0x0c60 [ D315FF43E23DF424ECEC2F6C930203E4, 68940EDA34DC4945CDD0D8018D96A0DA8F99F16A930946D14E4FECEE033FCB80 ] EpsonScanSvc C:\windows\system32\EscSvc64.exe
21:44:38.0518 0x0c60 EpsonScanSvc - ok
21:44:38.0558 0x0c60 [ 2BD3F1059975CE90F8D968DADD790DFF, 9FD4FA7DB54B0E1E4A48863435F728220978A271D2A28BB3E9E112C1A59B1D4C ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
21:44:38.0588 0x0c60 EraserUtilRebootDrv - ok
21:44:38.0598 0x0c60 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\windows\system32\drivers\errdev.sys
21:44:38.0618 0x0c60 ErrDev - ok
21:44:38.0648 0x0c60 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\windows\system32\es.dll
21:44:38.0678 0x0c60 EventSystem - ok
21:44:38.0698 0x0c60 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\windows\system32\drivers\exfat.sys
21:44:38.0728 0x0c60 exfat - ok
21:44:38.0728 0x0c60 ezSharedSvc - ok
21:44:38.0738 0x0c60 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\windows\system32\drivers\fastfat.sys
21:44:38.0768 0x0c60 fastfat - ok
21:44:38.0808 0x0c60 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\windows\system32\fxssvc.exe
21:44:38.0848 0x0c60 Fax - ok
21:44:38.0868 0x0c60 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\windows\system32\drivers\fdc.sys
21:44:38.0888 0x0c60 fdc - ok
21:44:38.0898 0x0c60 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\windows\system32\fdPHost.dll
21:44:38.0928 0x0c60 fdPHost - ok
21:44:38.0938 0x0c60 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\windows\system32\fdrespub.dll
21:44:38.0968 0x0c60 FDResPub - ok
21:44:38.0978 0x0c60 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\windows\system32\drivers\fileinfo.sys
21:44:38.0988 0x0c60 FileInfo - ok
21:44:39.0008 0x0c60 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\windows\system32\drivers\filetrace.sys
21:44:39.0038 0x0c60 Filetrace - ok
21:44:39.0048 0x0c60 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\windows\system32\drivers\flpydisk.sys
21:44:39.0068 0x0c60 flpydisk - ok
21:44:39.0078 0x0c60 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\windows\system32\drivers\fltmgr.sys
21:44:39.0098 0x0c60 FltMgr - ok
21:44:39.0138 0x0c60 [ BCB16AE33AA58E0042F3EF34CFB6396A, E8ADA10DE60A94E4BABE9FCA6D0AA83B11520C092D49057E17F6C6059D35A323 ] FontCache C:\windows\system32\FntCache.dll
21:44:39.0188 0x0c60 FontCache - ok
21:44:39.0198 0x0c60 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\windows\system32\drivers\FsDepends.sys
21:44:39.0208 0x0c60 FsDepends - ok
21:44:39.0228 0x0c60 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\windows\system32\drivers\Fs_Rec.sys
21:44:39.0238 0x0c60 Fs_Rec - ok
21:44:39.0278 0x0c60 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\windows\system32\DRIVERS\fvevol.sys
21:44:39.0288 0x0c60 fvevol - ok
21:44:39.0318 0x0c60 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\windows\system32\drivers\gagp30kx.sys
21:44:39.0358 0x0c60 gagp30kx - ok
21:44:39.0418 0x0c60 [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM C:\windows\system32\DRIVERS\GEARAspiWDM.sys
21:44:39.0448 0x0c60 GEARAspiWDM - ok
21:44:39.0488 0x0c60 [ E4AE497857409127ED57562AF913A903, 262ADD713B1FBF6200550967D1F8635B55D01BBD8FA2E753536E71A4EC87867B ] gpsvc C:\windows\System32\gpsvc.dll
21:44:39.0538 0x0c60 gpsvc - ok
21:44:39.0608 0x0c60 [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:44:39.0638 0x0c60 gupdate - ok
21:44:39.0638 0x0c60 [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:44:39.0658 0x0c60 gupdatem - ok
21:44:39.0678 0x0c60 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\windows\system32\drivers\hcw85cir.sys
21:44:39.0688 0x0c60 hcw85cir - ok
21:44:39.0708 0x0c60 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
21:44:39.0728 0x0c60 HdAudAddService - ok
21:44:39.0748 0x0c60 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\windows\system32\DRIVERS\HDAudBus.sys
21:44:39.0768 0x0c60 HDAudBus - ok
21:44:39.0788 0x0c60 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\windows\system32\drivers\HidBatt.sys
21:44:39.0798 0x0c60 HidBatt - ok
21:44:39.0828 0x0c60 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\windows\system32\drivers\hidbth.sys
21:44:39.0868 0x0c60 HidBth - ok
21:44:39.0878 0x0c60 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\windows\system32\drivers\hidir.sys
21:44:39.0898 0x0c60 HidIr - ok
21:44:39.0908 0x0c60 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\windows\system32\hidserv.dll
21:44:39.0938 0x0c60 hidserv - ok
21:44:39.0948 0x0c60 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\windows\system32\DRIVERS\hidusb.sys
21:44:39.0988 0x0c60 HidUsb - ok
21:44:40.0008 0x0c60 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\windows\system32\kmsvc.dll
21:44:40.0058 0x0c60 hkmsvc - ok
21:44:40.0078 0x0c60 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\windows\system32\ListSvc.dll
21:44:40.0118 0x0c60 HomeGroupListener - ok
21:44:40.0128 0x0c60 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\windows\system32\provsvc.dll
21:44:40.0148 0x0c60 HomeGroupProvider - ok
21:44:40.0188 0x0c60 HP Support Assistant Service - ok
21:44:40.0208 0x0c60 hpqwmiex - ok
21:44:40.0228 0x0c60 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\windows\system32\drivers\HpSAMD.sys
21:44:40.0258 0x0c60 HpSAMD - ok
21:44:40.0308 0x0c60 [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP C:\windows\system32\drivers\HTTP.sys
21:44:40.0348 0x0c60 HTTP - ok
21:44:40.0358 0x0c60 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\windows\system32\drivers\hwpolicy.sys
21:44:40.0378 0x0c60 hwpolicy - ok
21:44:40.0398 0x0c60 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\windows\system32\drivers\i8042prt.sys
21:44:40.0438 0x0c60 i8042prt - ok
21:44:40.0458 0x0c60 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\windows\system32\drivers\iaStorV.sys
21:44:40.0478 0x0c60 iaStorV - ok
21:44:40.0578 0x0c60 [ BD14C02A9F388CB29620FF68AB6979AD, 1610C888002E1118DFEF86E27462FDBB1F625BD298FC4FCD033FBC76D54EC35E ] IDSVia64 C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\IPSDefs\20160627.005\IDSvia64.sys
21:44:40.0628 0x0c60 IDSVia64 - ok
21:44:40.0658 0x0c60 IEEtwCollectorService - ok
21:44:40.0798 0x0c60 [ A87261EF1546325B559374F5689CF5BC, 8DE48A8A13A32AAAC54CDDF58F3F61BE3E2802C1D9CA1CA98E57EB0D65FB6002 ] igfx C:\windows\system32\DRIVERS\igdkmd64.sys
21:44:40.0938 0x0c60 igfx - ok
21:44:40.0968 0x0c60 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\windows\system32\drivers\iirsp.sys
21:44:40.0978 0x0c60 iirsp - ok
21:44:41.0018 0x0c60 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\windows\System32\ikeext.dll
21:44:41.0048 0x0c60 IKEEXT - ok
21:44:41.0058 0x0c60 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\windows\system32\drivers\intelide.sys
21:44:41.0078 0x0c60 intelide - ok
21:44:41.0088 0x0c60 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\windows\system32\DRIVERS\intelppm.sys
21:44:41.0108 0x0c60 intelppm - ok
21:44:41.0148 0x0c60 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\windows\system32\ipbusenum.dll
21:44:41.0178 0x0c60 IPBusEnum - ok
21:44:41.0178 0x0c60 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\windows\system32\DRIVERS\ipfltdrv.sys
21:44:41.0208 0x0c60 IpFilterDriver - ok
21:44:41.0248 0x0c60 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\windows\System32\iphlpsvc.dll
21:44:41.0268 0x0c60 iphlpsvc - ok
21:44:41.0288 0x0c60 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\windows\system32\drivers\IPMIDrv.sys
21:44:41.0298 0x0c60 IPMIDRV - ok
21:44:41.0308 0x0c60 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\windows\system32\drivers\ipnat.sys
21:44:41.0338 0x0c60 IPNAT - ok
21:44:41.0378 0x0c60 [ 043A93A498B3C4A88CACA3BCBC9B54C7, C08C5A03940806C6CB75ADDCBE6183145AD2AFE84D77BC85E620E7C1542F0893 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
21:44:41.0408 0x0c60 iPod Service - ok
21:44:41.0418 0x0c60 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\windows\system32\drivers\irenum.sys
21:44:41.0438 0x0c60 IRENUM - ok
21:44:41.0468 0x0c60 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\windows\system32\drivers\isapnp.sys
21:44:41.0478 0x0c60 isapnp - ok
21:44:41.0518 0x0c60 [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\windows\system32\drivers\msiscsi.sys
21:44:41.0548 0x0c60 iScsiPrt - ok
21:44:41.0558 0x0c60 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\windows\system32\DRIVERS\kbdclass.sys
21:44:41.0578 0x0c60 kbdclass - ok
21:44:41.0588 0x0c60 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\windows\system32\DRIVERS\kbdhid.sys
21:44:41.0608 0x0c60 kbdhid - ok
21:44:41.0628 0x0c60 [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] KeyIso C:\windows\system32\lsass.exe
21:44:41.0638 0x0c60 KeyIso - ok
21:44:41.0668 0x0c60 [ 3974E5264A0481600370C5BEED061DDF, 6365DC2B3ECAF462F98481103F47B7550688D1A3AE96C88FDBCB3ED3BBB76EB6 ] KSecDD C:\windows\system32\Drivers\ksecdd.sys
21:44:41.0688 0x0c60 KSecDD - ok
21:44:41.0698 0x0c60 [ 6E85615A86FE86E76DAE49BF9F227483, 825F9906910C33A36D04D805402A8C0C8E09232407E077B85282E3208A9BFC25 ] KSecPkg C:\windows\system32\Drivers\ksecpkg.sys
21:44:41.0718 0x0c60 KSecPkg - ok
21:44:41.0728 0x0c60 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\windows\system32\drivers\ksthunk.sys
21:44:41.0758 0x0c60 ksthunk - ok
21:44:41.0778 0x0c60 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\windows\system32\msdtckrm.dll
21:44:41.0818 0x0c60 KtmRm - ok
21:44:41.0848 0x0c60 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\windows\system32\srvsvc.dll
21:44:41.0898 0x0c60 LanmanServer - ok
21:44:41.0898 0x0c60 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\windows\System32\wkssvc.dll
21:44:41.0928 0x0c60 LanmanWorkstation - ok
21:44:41.0958 0x0c60 [ 285954C6C6EF43B78AB84034750FAC6A, 1ED9090015B2A896EF44C072E9662DCF78F044FF05A6B0174F2933AF11B252D1 ] libusb0 C:\windows\system32\DRIVERS\libusb0.sys
21:44:41.0968 0x0c60 libusb0 - ok
21:44:41.0988 0x0c60 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\windows\system32\DRIVERS\lltdio.sys
21:44:42.0018 0x0c60 lltdio - ok
21:44:42.0038 0x0c60 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\windows\System32\lltdsvc.dll
21:44:42.0068 0x0c60 lltdsvc - ok
21:44:42.0088 0x0c60 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\windows\System32\lmhsvc.dll
21:44:42.0118 0x0c60 lmhosts - ok
21:44:42.0148 0x0c60 [ BF22ACF4CF3734D61357E67F0521BC03, EDDFBDC4BE29BF26904B2DF7074F471711238469CDDBED1CA253A49B993F53DF ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:44:42.0168 0x0c60 LMS - ok
21:44:42.0198 0x0c60 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\windows\system32\drivers\lsi_fc.sys
21:44:42.0208 0x0c60 LSI_FC - ok
21:44:42.0248 0x0c60 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\windows\system32\drivers\lsi_sas.sys
21:44:42.0258 0x0c60 LSI_SAS - ok
21:44:42.0268 0x0c60 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\windows\system32\drivers\lsi_sas2.sys
21:44:42.0288 0x0c60 LSI_SAS2 - ok
21:44:42.0298 0x0c60 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\windows\system32\drivers\lsi_scsi.sys
21:44:42.0318 0x0c60 LSI_SCSI - ok
21:44:42.0318 0x0c60 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\windows\system32\drivers\luafv.sys
21:44:42.0348 0x0c60 luafv - ok
21:44:42.0368 0x0c60 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\windows\system32\Mcx2Svc.dll
21:44:42.0378 0x0c60 Mcx2Svc - ok
21:44:42.0388 0x0c60 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\windows\system32\drivers\megasas.sys
21:44:42.0408 0x0c60 megasas - ok
21:44:42.0418 0x0c60 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\windows\system32\drivers\MegaSR.sys
21:44:42.0438 0x0c60 MegaSR - ok
21:44:42.0458 0x0c60 [ 6B01B7414A105B9E51652089A03027CF, 9B113DC22F7D0D0B376E577C6D7083F9EDC09BBFE47726393E16D4FDAAAE21FE ] MEIx64 C:\windows\system32\drivers\HECIx64.sys
21:44:42.0468 0x0c60 MEIx64 - ok
21:44:42.0488 0x0c60 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\windows\system32\mmcss.dll
21:44:42.0518 0x0c60 MMCSS - ok
21:44:42.0528 0x0c60 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\windows\system32\drivers\modem.sys
21:44:42.0558 0x0c60 Modem - ok
21:44:42.0578 0x0c60 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\windows\system32\DRIVERS\monitor.sys
21:44:42.0588 0x0c60 monitor - ok
21:44:42.0628 0x0c60 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\windows\system32\DRIVERS\mouclass.sys
21:44:42.0658 0x0c60 mouclass - ok
21:44:42.0678 0x0c60 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\windows\system32\DRIVERS\mouhid.sys
21:44:42.0688 0x0c60 mouhid - ok
21:44:42.0728 0x0c60 [ 67050452C0118BAF2883928E6FCCFE47, 335FC0AEB7B47DCC7CE0CF3F424EB60ACB1327D2FF6515F04D9AC03A10FF1E31 ] mountmgr C:\windows\system32\drivers\mountmgr.sys
21:44:42.0738 0x0c60 mountmgr - ok
21:44:42.0768 0x0c60 [ DD370A8148862150BA81A3F5C56A1E40, F56B84297BDC32266CB69D10FB2D66B8B332D60CAB7E64E4E3AC2BB749BBD31B ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
21:44:42.0808 0x0c60 MozillaMaintenance - ok
21:44:42.0848 0x0c60 [ DA0FAEE45D6F03D7647851A20977A7D0, AFB1EA053CD4BCA903868896D020205D4C207C85314E6C56C4663922A3F9BD6A ] MpFilter C:\windows\system32\DRIVERS\MpFilter.sys
21:44:42.0898 0x0c60 MpFilter - ok
21:44:42.0908 0x0c60 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\windows\system32\drivers\mpio.sys
21:44:42.0928 0x0c60 mpio - ok
21:44:42.0958 0x0c60 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\windows\system32\drivers\mpsdrv.sys
21:44:42.0988 0x0c60 mpsdrv - ok
21:44:43.0018 0x0c60 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\windows\system32\mpssvc.dll
21:44:43.0058 0x0c60 MpsSvc - ok
21:44:43.0088 0x0c60 [ D7ADC2B83CA0B0381F75A98351F72CEE, 05476B7CA0486DF770AE492B5A90C85E3D3E7485152EB2FA30A19EC9BE44ED81 ] MRxDAV C:\windows\system32\drivers\mrxdav.sys
21:44:43.0118 0x0c60 MRxDAV - ok
21:44:43.0138 0x0c60 [ 10112D850C844606419C79EE24EE6016, 1668F47ED9C31D805542646A0AD6E572C3547FF822F5BCDF1BB3F521714F8B85 ] mrxsmb C:\windows\system32\DRIVERS\mrxsmb.sys
21:44:43.0158 0x0c60 mrxsmb - ok
21:44:43.0188 0x0c60 [ DCC4343B422A13B42C7678998449CE8A, 9C143543DC9B21A15C5E86640464A3A78C5E820857D0A6BE05D4FBC20D0BF866 ] mrxsmb10 C:\windows\system32\DRIVERS\mrxsmb10.sys
21:44:43.0238 0x0c60 mrxsmb10 - ok
21:44:43.0288 0x0c60 [ 46C4F5BEE8D98BB1688752EAD0ABB7C0, C744F39E462798DC98D1C4603758AC43DB4A7961F3BAF9E5ABA22AD905E012F8 ] mrxsmb20 C:\windows\system32\DRIVERS\mrxsmb20.sys
21:44:43.0318 0x0c60 mrxsmb20 - ok
21:44:43.0338 0x0c60 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\windows\system32\drivers\msahci.sys
21:44:43.0358 0x0c60 msahci - ok
21:44:43.0368 0x0c60 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\windows\system32\drivers\msdsm.sys
21:44:43.0388 0x0c60 msdsm - ok
21:44:43.0388 0x0c60 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\windows\System32\msdtc.exe
21:44:43.0408 0x0c60 MSDTC - ok
21:44:43.0418 0x0c60 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\windows\system32\drivers\Msfs.sys
21:44:43.0458 0x0c60 Msfs - ok
21:44:43.0488 0x0c60 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\windows\System32\drivers\mshidkmdf.sys
21:44:43.0538 0x0c60 mshidkmdf - ok
21:44:43.0548 0x0c60 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\windows\system32\drivers\msisadrv.sys
21:44:43.0568 0x0c60 msisadrv - ok
21:44:43.0588 0x0c60 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\windows\system32\iscsiexe.dll
21:44:43.0618 0x0c60 MSiSCSI - ok
21:44:43.0618 0x0c60 msiserver - ok
21:44:43.0628 0x0c60 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\windows\system32\drivers\MSKSSRV.sys
21:44:43.0658 0x0c60 MSKSSRV - ok
21:44:43.0698 0x0c60 [ C66FE30BBA4604A06EE9E4180ABE4BD9, 43E60C15C05FF19082142BB9D1F29D1B3269AD4A7FB32AF109AE63FE5A6AA0A9 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
21:44:43.0718 0x0c60 MsMpSvc - ok
21:44:43.0728 0x0c60 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\windows\system32\drivers\MSPCLOCK.sys
21:44:43.0748 0x0c60 MSPCLOCK - ok
21:44:43.0748 0x0c60 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\windows\system32\drivers\MSPQM.sys
21:44:43.0778 0x0c60 MSPQM - ok
21:44:43.0798 0x0c60 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\windows\system32\drivers\MsRPC.sys
21:44:43.0818 0x0c60 MsRPC - ok
21:44:43.0838 0x0c60 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\windows\system32\drivers\mssmbios.sys
21:44:43.0848 0x0c60 mssmbios - ok
21:44:43.0868 0x0c60 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\windows\system32\drivers\MSTEE.sys
21:44:43.0888 0x0c60 MSTEE - ok
21:44:43.0898 0x0c60 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\windows\system32\drivers\MTConfig.sys
21:44:43.0918 0x0c60 MTConfig - ok
21:44:43.0928 0x0c60 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\windows\system32\Drivers\mup.sys
21:44:43.0948 0x0c60 Mup - ok
21:44:43.0968 0x0c60 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\windows\system32\qagentRT.dll
21:44:44.0008 0x0c60 napagent - ok
21:44:44.0028 0x0c60 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\windows\system32\DRIVERS\nwifi.sys
21:44:44.0048 0x0c60 NativeWifiP - ok
21:44:44.0118 0x0c60 NAVENG - ok
21:44:44.0118 0x0c60 NAVEX15 - ok
21:44:44.0188 0x0c60 [ F7309F42555F8AAB7144A51A1F2585B0, 065277A8AFAEE3888C997A76D2F751070F92DF4C3354D16B194860B4BDAFF937 ] NDIS C:\windows\system32\drivers\ndis.sys
21:44:44.0228 0x0c60 NDIS - ok
21:44:44.0238 0x0c60 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\windows\system32\DRIVERS\ndiscap.sys
21:44:44.0268 0x0c60 NdisCap - ok
21:44:44.0288 0x0c60 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\windows\system32\DRIVERS\ndistapi.sys
21:44:44.0318 0x0c60 NdisTapi - ok
21:44:44.0328 0x0c60 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\windows\system32\DRIVERS\ndisuio.sys
21:44:44.0358 0x0c60 Ndisuio - ok
21:44:44.0368 0x0c60 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\windows\system32\DRIVERS\ndiswan.sys
21:44:44.0398 0x0c60 NdisWan - ok
21:44:44.0408 0x0c60 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\windows\system32\drivers\NDProxy.sys
21:44:44.0448 0x0c60 NDProxy - ok
21:44:44.0488 0x0c60 [ EE00C544C025958AF50C7B199F3C8595, D774DB020D9C46D1AA0B2DB9FA2C36C4A9C38D904CC6929695321D32ACA0D4D1 ] Netaapl C:\windows\system32\DRIVERS\netaapl64.sys
21:44:44.0538 0x0c60 Netaapl - ok
21:44:44.0548 0x0c60 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\windows\system32\DRIVERS\netbios.sys
21:44:44.0598 0x0c60 NetBIOS - ok
21:44:44.0618 0x0c60 [ E47D571FEC2C76E867935109AB2A770C, F349D25890B6F476B106FD75BFB081DB737CA9B224D95E44927942FFF2DF82CD ] NetBT C:\windows\system32\DRIVERS\netbt.sys
21:44:44.0638 0x0c60 NetBT - ok
21:44:44.0668 0x0c60 [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] Netlogon C:\windows\system32\lsass.exe
21:44:44.0678 0x0c60 Netlogon - ok
21:44:44.0698 0x0c60 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\windows\System32\netman.dll
21:44:44.0728 0x0c60 Netman - ok
21:44:44.0768 0x0c60 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:44.0788 0x0c60 NetMsmqActivator - ok
21:44:44.0788 0x0c60 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:44.0808 0x0c60 NetPipeActivator - ok
21:44:44.0838 0x0c60 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\windows\System32\netprofm.dll
21:44:44.0868 0x0c60 netprofm - ok
21:44:44.0938 0x0c60 [ 9C745041E72576251BC93709633E89FF, 00CCA321546522E699884CC1C7B9466A7B73787CF9AE155C9032169D7B590701 ] netr28x C:\windows\system32\DRIVERS\netr28x.sys
21:44:44.0988 0x0c60 netr28x - ok
21:44:44.0988 0x0c60 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:45.0008 0x0c60 NetTcpActivator - ok
21:44:45.0038 0x0c60 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:45.0048 0x0c60 NetTcpPortSharing - ok
21:44:45.0078 0x0c60 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\windows\system32\drivers\nfrd960.sys
21:44:45.0088 0x0c60 nfrd960 - ok
21:44:45.0258 0x0c60 [ 35DE4A8F863C173FA7EDDF3860FC7A77, 4EB472605B0FDA401A56F86BE3B2B118AE4BF512823235C0D6589E88538F288A ] NIS C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\NIS.exe
21:44:45.0298 0x0c60 NIS - ok
21:44:45.0338 0x0c60 [ 6D79C8CB73187FBEAAD1F680FADF98D3, 0075B2CCC4FFF929023F95686D7BBE32C0FCE05DEB2159C0784AF85D64E1B66E ] NisDrv C:\windows\system32\DRIVERS\NisDrvWFP.sys
21:44:45.0358 0x0c60 NisDrv - ok
21:44:45.0388 0x0c60 [ B8F4F580638373FBF72F2B572446D294, A5CD9ABCA5CDC335D2C6FDCB81327B600150E45BB867B88859A00AF974B42F85 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe
21:44:45.0408 0x0c60 NisSrv - ok
21:44:45.0438 0x0c60 [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc C:\windows\System32\nlasvc.dll
21:44:45.0468 0x0c60 NlaSvc - ok
21:44:45.0538 0x0c60 [ 5839A8027D6D324A7CD494051A96628C, 474F2D0BB463ABE68D7C4D2C630860AED4B722EC62C616C91EE00AA965378382 ] NOBU C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
21:44:45.0598 0x0c60 NOBU - ok
21:44:45.0618 0x0c60 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\windows\system32\drivers\Npfs.sys
21:44:45.0648 0x0c60 Npfs - ok
21:44:45.0668 0x0c60 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\windows\system32\nsisvc.dll
21:44:45.0688 0x0c60 nsi - ok
21:44:45.0698 0x0c60 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\windows\system32\drivers\nsiproxy.sys
21:44:45.0728 0x0c60 nsiproxy - ok
21:44:45.0778 0x0c60 [ 47B2D0B31BDC3EBE6090228E2BA3764D, 984A4B38300954164BCBF57EC1A09C18B53779E60A26E9618B50E26016735787 ] Ntfs C:\windows\system32\drivers\Ntfs.sys
21:44:45.0818 0x0c60 Ntfs - ok
21:44:45.0828 0x0c60 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\windows\system32\drivers\Null.sys
21:44:45.0858 0x0c60 Null - ok
21:44:45.0868 0x0c60 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\windows\system32\drivers\nvraid.sys
21:44:45.0888 0x0c60 nvraid - ok
21:44:45.0918 0x0c60 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\windows\system32\drivers\nvstor.sys
21:44:45.0928 0x0c60 nvstor - ok
21:44:45.0948 0x0c60 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\windows\system32\drivers\nv_agp.sys
21:44:45.0968 0x0c60 nv_agp - ok
21:44:45.0988 0x0c60 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\windows\system32\drivers\ohci1394.sys
21:44:45.0998 0x0c60 ohci1394 - ok
21:44:46.0038 0x0c60 [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:44:46.0058 0x0c60 ose - ok
21:44:46.0198 0x0c60 [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:44:46.0308 0x0c60 osppsvc - ok
21:44:46.0338 0x0c60 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\windows\system32\pnrpsvc.dll
21:44:46.0378 0x0c60 p2pimsvc - ok
21:44:46.0388 0x0c60 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\windows\system32\p2psvc.dll
21:44:46.0418 0x0c60 p2psvc - ok
21:44:46.0428 0x0c60 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\windows\system32\drivers\parport.sys
21:44:46.0448 0x0c60 Parport - ok
21:44:46.0468 0x0c60 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\windows\system32\drivers\partmgr.sys
21:44:46.0488 0x0c60 partmgr - ok
21:44:46.0518 0x0c60 [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc C:\windows\System32\pcasvc.dll
21:44:46.0568 0x0c60 PcaSvc - ok
21:44:46.0578 0x0c60 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\windows\system32\drivers\pci.sys
21:44:46.0598 0x0c60 pci - ok
21:44:46.0618 0x0c60 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\windows\system32\drivers\pciide.sys
21:44:46.0628 0x0c60 pciide - ok
21:44:46.0648 0x0c60 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\windows\system32\drivers\pcmcia.sys
21:44:46.0668 0x0c60 pcmcia - ok
21:44:46.0678 0x0c60 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\windows\system32\drivers\pcw.sys
21:44:46.0688 0x0c60 pcw - ok
21:44:46.0708 0x0c60 [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH C:\windows\system32\drivers\peauth.sys
21:44:46.0738 0x0c60 PEAUTH - ok
21:44:46.0818 0x0c60 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\windows\SysWow64\perfhost.exe
21:44:46.0838 0x0c60 PerfHost - ok
21:44:46.0878 0x0c60 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\windows\system32\pla.dll
21:44:46.0928 0x0c60 pla - ok
21:44:46.0988 0x0c60 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\windows\system32\umpnpmgr.dll
21:44:47.0028 0x0c60 PlugPlay - ok
21:44:47.0028 0x0c60 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\windows\system32\pnrpauto.dll
21:44:47.0048 0x0c60 PNRPAutoReg - ok
21:44:47.0068 0x0c60 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\windows\system32\pnrpsvc.dll
21:44:47.0088 0x0c60 PNRPsvc - ok
21:44:47.0118 0x0c60 [ 80D6B0563ED2BF10656B1D4748331082, B7E6B5E1148B7EE537E8D5C3A65450876B61CD45A395267D08699746E98AD574 ] PolicyAgent C:\windows\System32\ipsecsvc.dll
21:44:47.0148 0x0c60 PolicyAgent - ok
21:44:47.0168 0x0c60 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\windows\system32\umpo.dll
21:44:47.0198 0x0c60 Power - ok
21:44:47.0218 0x0c60 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\windows\system32\DRIVERS\raspptp.sys
21:44:47.0248 0x0c60 PptpMiniport - ok
21:44:47.0258 0x0c60 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\windows\system32\drivers\processr.sys
21:44:47.0278 0x0c60 Processor - ok
21:44:47.0298 0x0c60 [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc C:\windows\system32\profsvc.dll
21:44:47.0358 0x0c60 ProfSvc - ok
21:44:47.0368 0x0c60 [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] ProtectedStorage C:\windows\system32\lsass.exe
21:44:47.0378 0x0c60 ProtectedStorage - ok
21:44:47.0398 0x0c60 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\windows\system32\DRIVERS\pacer.sys
21:44:47.0428 0x0c60 Psched - ok
21:44:47.0468 0x0c60 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\windows\system32\drivers\ql2300.sys
21:44:47.0518 0x0c60 ql2300 - ok
21:44:47.0528 0x0c60 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\windows\system32\drivers\ql40xx.sys
21:44:47.0538 0x0c60 ql40xx - ok
21:44:47.0558 0x0c60 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\windows\system32\qwave.dll
21:44:47.0578 0x0c60 QWAVE - ok
21:44:47.0588 0x0c60 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\windows\system32\drivers\qwavedrv.sys
21:44:47.0608 0x0c60 QWAVEdrv - ok
21:44:47.0638 0x0c60 [ F4C083E290BCBC8DA05C6E2C7F8053B9, 968103B2F49A05B1DE99FA38CEB7B2F5E90B60901B9AF802A908F819DA64822E ] RalinkRegistryWriter C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
21:44:47.0658 0x0c60 RalinkRegistryWriter - detected UnsignedFile.Multi.Generic ( 1 )
21:44:50.0128 0x0c60 Detect skipped due to KSN trusted
21:44:50.0128 0x0c60 RalinkRegistryWriter - ok
21:44:50.0148 0x0c60 [ C3B515559046A89BB0E0F2CEEF73CABC, EC967620BADCA66BEE5DE0A44EC858AE2FB08BED6774673CDB3C1F53B7C7E22B ] RalinkRegistryWriter64 C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
21:44:50.0168 0x0c60 RalinkRegistryWriter64 - detected UnsignedFile.Multi.Generic ( 1 )
21:44:50.0269 0x0c60 Detect skipped due to KSN trusted
21:44:50.0269 0x0c60 RalinkRegistryWriter64 - ok
21:44:50.0289 0x0c60 [ ACCFA0846D9C7BD6A9F506982B812A5C, FE48D5016C2EBDB95A594D359E9F7873A1EF5C927E109F59755C892B6C3C5506 ] RaMediaServer C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
21:44:50.0309 0x0c60 RaMediaServer - ok
21:44:50.0329 0x0c60 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\windows\system32\DRIVERS\rasacd.sys
21:44:50.0349 0x0c60 RasAcd - ok
21:44:50.0379 0x0c60 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\windows\system32\DRIVERS\AgileVpn.sys
21:44:50.0399 0x0c60 RasAgileVpn - ok
21:44:50.0419 0x0c60 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\windows\System32\rasauto.dll
21:44:50.0449 0x0c60 RasAuto - ok
21:44:50.0459 0x0c60 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\windows\system32\DRIVERS\rasl2tp.sys
21:44:50.0489 0x0c60 Rasl2tp - ok
21:44:50.0509 0x0c60 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\windows\System32\rasmans.dll
21:44:50.0559 0x0c60 RasMan - ok
21:44:50.0579 0x0c60 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\windows\system32\DRIVERS\raspppoe.sys
21:44:50.0629 0x0c60 RasPppoe - ok
21:44:50.0709 0x0c60 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\windows\system32\DRIVERS\rassstp.sys
21:44:50.0749 0x0c60 RasSstp - ok
21:44:50.0769 0x0c60 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\windows\system32\DRIVERS\rdbss.sys
21:44:50.0799 0x0c60 rdbss - ok
21:44:50.0809 0x0c60 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\windows\system32\drivers\rdpbus.sys
21:44:50.0829 0x0c60 rdpbus - ok
21:44:50.0839 0x0c60 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\windows\system32\DRIVERS\RDPCDD.sys
21:44:50.0869 0x0c60 RDPCDD - ok
21:44:50.0879 0x0c60 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\windows\system32\drivers\rdpencdd.sys
21:44:50.0909 0x0c60 RDPENCDD - ok
21:44:50.0919 0x0c60 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\windows\system32\drivers\rdprefmp.sys
21:44:50.0949 0x0c60 RDPREFMP - ok
21:44:51.0019 0x0c60 [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\windows\system32\drivers\rdpvideominiport.sys
21:44:51.0059 0x0c60 RdpVideoMiniport - ok
21:44:51.0109 0x0c60 [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\windows\system32\drivers\RDPWD.sys
21:44:51.0119 0x0c60 RDPWD - ok
21:44:51.0149 0x0c60 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\windows\system32\drivers\rdyboost.sys
21:44:51.0169 0x0c60 rdyboost - ok
21:44:51.0179 0x0c60 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\windows\System32\mprdim.dll
21:44:51.0209 0x0c60 RemoteAccess - ok
21:44:51.0219 0x0c60 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\windows\system32\regsvc.dll
21:44:51.0249 0x0c60 RemoteRegistry - ok
21:44:51.0259 0x0c60 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\windows\System32\RpcEpMap.dll
21:44:51.0289 0x0c60 RpcEptMapper - ok
21:44:51.0299 0x0c60 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\windows\system32\locator.exe
21:44:51.0319 0x0c60 RpcLocator - ok
21:44:51.0349 0x0c60 [ 622C96AFB07BB82C8650B47172137AC4, B74CEA5A3F4945E5A3EAE7AF1B1FA75F611C65C6FACE393052A512FA81B0C17C ] RpcSs C:\windows\system32\rpcss.dll
21:44:51.0369 0x0c60 RpcSs - ok
21:44:51.0399 0x0c60 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\windows\system32\DRIVERS\rspndr.sys
21:44:51.0419 0x0c60 rspndr - ok
21:44:51.0449 0x0c60 [ 39A719875F572241C585A629EE62EB14, EE42DB11710374A2A97ED5B58A9DA0AECC8AB0DF4DEEAC5970F33046255CE2F9 ] RTL8167 C:\windows\system32\DRIVERS\Rt64win7.sys
21:44:51.0479 0x0c60 RTL8167 - ok
21:44:51.0489 0x0c60 [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] SamSs C:\windows\system32\lsass.exe
21:44:51.0509 0x0c60 SamSs - ok
21:44:51.0509 0x0c60 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\windows\system32\drivers\sbp2port.sys
21:44:51.0529 0x0c60 sbp2port - ok
21:44:51.0549 0x0c60 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\windows\System32\SCardSvr.dll
21:44:51.0579 0x0c60 SCardSvr - ok
21:44:51.0599 0x0c60 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\windows\system32\DRIVERS\scfilter.sys
21:44:51.0629 0x0c60 scfilter - ok
21:44:51.0659 0x0c60 [ 40686B59C127F0C93B4234E4A1E3472A, B2DD61CB796C6AA8AFD285D43472B94646CA6D331D282818E0FDC9DE28DDE9CF ] Schedule C:\windows\system32\schedsvc.dll
21:44:51.0709 0x0c60 Schedule - ok
21:44:51.0729 0x0c60 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\windows\System32\certprop.dll
21:44:51.0759 0x0c60 SCPolicySvc - ok
21:44:51.0769 0x0c60 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\windows\System32\SDRSVC.dll
21:44:51.0799 0x0c60 SDRSVC - ok
21:44:51.0819 0x0c60 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\windows\system32\drivers\secdrv.sys
21:44:51.0879 0x0c60 secdrv - ok
21:44:51.0909 0x0c60 [ A19623BDD61E66A12AB53992002B4F3A, E351CEEC086084A417BA3BD0EEF46114D3147EC38E3EF8BE49B724F9D028CC56 ] seclogon C:\windows\system32\seclogon.dll
21:44:51.0939 0x0c60 seclogon - ok
21:44:51.0949 0x0c60 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\windows\System32\sens.dll
21:44:51.0979 0x0c60 SENS - ok
21:44:51.0989 0x0c60 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\windows\system32\sensrsvc.dll
21:44:52.0009 0x0c60 SensrSvc - ok
21:44:52.0029 0x0c60 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\windows\system32\drivers\serenum.sys
21:44:52.0049 0x0c60 Serenum - ok
21:44:52.0079 0x0c60 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\windows\system32\drivers\serial.sys
21:44:52.0099 0x0c60 Serial - ok
21:44:52.0109 0x0c60 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\windows\system32\drivers\sermouse.sys
21:44:52.0129 0x0c60 sermouse - ok
21:44:52.0139 0x0c60 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\windows\system32\sessenv.dll
21:44:52.0169 0x0c60 SessionEnv - ok
21:44:52.0179 0x0c60 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\windows\system32\drivers\sffdisk.sys
21:44:52.0199 0x0c60 sffdisk - ok
21:44:52.0199 0x0c60 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\windows\system32\drivers\sffp_mmc.sys
21:44:52.0219 0x0c60 sffp_mmc - ok
21:44:52.0229 0x0c60 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\windows\system32\drivers\sffp_sd.sys
21:44:52.0249 0x0c60 sffp_sd - ok
21:44:52.0259 0x0c60 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\windows\system32\drivers\sfloppy.sys
21:44:52.0279 0x0c60 sfloppy - ok
21:44:52.0309 0x0c60 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\windows\System32\ipnathlp.dll
21:44:52.0339 0x0c60 SharedAccess - ok
21:44:52.0359 0x0c60 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\windows\System32\shsvcs.dll
21:44:52.0389 0x0c60 ShellHWDetection - ok
21:44:52.0409 0x0c60 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\windows\system32\drivers\SiSRaid2.sys
21:44:52.0419 0x0c60 SiSRaid2 - ok
21:44:52.0429 0x0c60 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\windows\system32\drivers\sisraid4.sys
21:44:52.0449 0x0c60 SiSRaid4 - ok
21:44:52.0459 0x0c60 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\windows\system32\DRIVERS\smb.sys
21:44:52.0479 0x0c60 Smb - ok
21:44:52.0499 0x0c60 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\windows\System32\snmptrap.exe
21:44:52.0519 0x0c60 SNMPTRAP - ok
21:44:52.0529 0x0c60 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\windows\system32\drivers\spldr.sys
21:44:52.0539 0x0c60 spldr - ok
21:44:52.0569 0x0c60 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\windows\System32\spoolsv.exe
21:44:52.0609 0x0c60 Spooler - ok
21:44:52.0679 0x0c60 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\windows\system32\sppsvc.exe
21:44:52.0769 0x0c60 sppsvc - ok
21:44:52.0779 0x0c60 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\windows\system32\sppuinotify.dll
21:44:52.0809 0x0c60 sppuinotify - ok
21:44:52.0939 0x0c60 [ 60C7A67F1C1689C54B24940D2B6B8E24, EF9F0BC030ED933650A0CE556D0B3B4DDD759496B973E9AB73CD7796BDBDB367 ] SRTSP C:\windows\System32\Drivers\NISx64\1607000.04C\SRTSP64.SYS
21:44:52.0979 0x0c60 SRTSP - ok
21:44:52.0989 0x0c60 [ 27382B6CF36D08783212FCF8B3691649, 83ECFBE280BBA8A4073A34F1B36D57952543F1A9B31E13EF8A40D8A2F12C2F73 ] SRTSPX C:\windows\system32\drivers\NISx64\1607000.04C\SRTSPX64.SYS
21:44:53.0009 0x0c60 SRTSPX - ok
21:44:53.0039 0x0c60 [ F2F4B895296EE3ECCE781CC2A296A5D1, 126321EDDA8141A42DBE7C90675948433063E6D5B6DEFD805AA0797C95A461EE ] srv C:\windows\system32\DRIVERS\srv.sys
21:44:53.0069 0x0c60 srv - ok
21:44:53.0109 0x0c60 [ FD0008BEDD2723170CCA7D61837DFD52, F9F576FA7B84CAB5180B9080D62B8A00B3E5D5BC73199B11C63193742529227D ] srv2 C:\windows\system32\DRIVERS\srv2.sys
21:44:53.0139 0x0c60 srv2 - ok
21:44:53.0149 0x0c60 [ 63B5845D9379262083655D5C6AB8DFC5, 1813D2FC41ADCDAC6E3A522373B9DB934CC27B89E7185E0E4FC26E30CDAF1523 ] srvnet C:\windows\system32\DRIVERS\srvnet.sys
21:44:53.0169 0x0c60 srvnet - ok
21:44:53.0199 0x0c60 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\windows\System32\ssdpsrv.dll
21:44:53.0229 0x0c60 SSDPSRV - ok
21:44:53.0239 0x0c60 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\windows\system32\sstpsvc.dll
21:44:53.0259 0x0c60 SstpSvc - ok
21:44:53.0299 0x0c60 [ 74425FFA11C133D045E1C3BE2EAD481D, 183D16FD6D7724CB6283A6794F159EA4122B4C6EDA11DA2F80DB8B69D672BF19 ] ssudmdm C:\windows\system32\DRIVERS\ssudmdm.sys
21:44:53.0339 0x0c60 ssudmdm - ok
21:44:53.0389 0x0c60 [ 4B1D0B5B6D043AAF45AE89EABAB7B865, 1340A8FD2A6DB77A1EB7502F3C40B3125613CE63BCEA969F5593404229926E7C ] STacSV C:\Program Files\IDT\WDM\STacSV64.exe
21:44:53.0419 0x0c60 STacSV - detected UnsignedFile.Multi.Generic ( 1 )
21:44:53.0529 0x0c60 Detect skipped due to KSN trusted
21:44:53.0529 0x0c60 STacSV - ok
21:44:53.0559 0x0c60 StarOpen - ok
21:44:53.0569 0x0c60 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\windows\system32\drivers\stexstor.sys
21:44:53.0599 0x0c60 stexstor - ok
21:44:53.0619 0x0c60 [ 542BDF7E9256189ABBC68935FA8116A4, 657617A37E41D0F8870C98CA38826DE7AC2C399B290D307D2DB4AAF6C103BF14 ] STHDA C:\windows\system32\DRIVERS\stwrt64.sys
21:44:53.0649 0x0c60 STHDA - ok
21:44:53.0679 0x0c60 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\windows\System32\wiaservc.dll
21:44:53.0709 0x0c60 stisvc - ok
21:44:53.0719 0x0c60 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\windows\system32\drivers\swenum.sys
21:44:53.0739 0x0c60 swenum - ok
21:44:53.0769 0x0c60 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\windows\System32\swprv.dll
21:44:53.0809 0x0c60 swprv - ok
21:44:53.0929 0x0c60 [ 6ADFA39058484ADECCCF159627DC987E, FF8376D3441ABA6742773F83BF4DE46A0DB05FD9BA29902454E0E4C05ABC7E58 ] SymEFASI C:\windows\system32\drivers\NISx64\1607000.04C\SYMEFASI64.SYS
21:44:53.0979 0x0c60 SymEFASI - ok
21:44:54.0019 0x0c60 [ F612740A892E8F9E789A85DD92B51150, 67F43FC6CE7A2238DA875657F2223787829316B410EB9A1481C4DF92258C7804 ] SymEvent C:\windows\system32\Drivers\SYMEVENT64x86.SYS
21:44:54.0029 0x0c60 SymEvent - ok
21:44:54.0079 0x0c60 [ 9458A37D3A38597FBF62F97E05B3170A, 22724BBCC4426978B656F614B68FB1A80E0E14B56128122A29DAB33266C0E88C ] SymIRON C:\windows\system32\drivers\NISx64\1607000.04C\Ironx64.SYS
21:44:54.0099 0x0c60 SymIRON - ok
21:44:54.0149 0x0c60 [ 5A185256AE1689912B5EC53F69D53820, D692B735AF2764CE29C6182A5C496994AD3A9EF9D5FB600EE9CE8B664F39D0FA ] SymNetS C:\windows\System32\Drivers\NISx64\1607000.04C\SYMNETS.SYS
21:44:54.0169 0x0c60 SymNetS - ok
21:44:54.0249 0x0c60 [ 2E730941CC5BF6200A4F56D1E9C24AAD, 758836D55DC84F3EBE9917DC6FAB8E6170A5B238FEDBCFDB6D7C5C6EA98E08B2 ] SysMain C:\windows\system32\sysmain.dll
21:44:54.0309 0x0c60 SysMain - ok
21:44:54.0329 0x0c60 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\windows\System32\TabSvc.dll
21:44:54.0349 0x0c60 TabletInputService - ok
21:44:54.0369 0x0c60 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\windows\System32\tapisrv.dll
21:44:54.0399 0x0c60 TapiSrv - ok
21:44:54.0489 0x0c60 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\windows\system32\drivers\tcpip.sys
21:44:54.0549 0x0c60 Tcpip - ok
21:44:54.0599 0x0c60 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\windows\system32\DRIVERS\tcpip.sys
21:44:54.0639 0x0c60 TCPIP6 - ok
21:44:54.0649 0x0c60 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\windows\system32\drivers\tcpipreg.sys
21:44:54.0669 0x0c60 tcpipreg - ok
21:44:54.0679 0x0c60 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\windows\system32\drivers\tdpipe.sys
21:44:54.0709 0x0c60 TDPIPE - ok
21:44:54.0719 0x0c60 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\windows\system32\drivers\tdtcp.sys
21:44:54.0739 0x0c60 TDTCP - ok
21:44:54.0759 0x0c60 [ AA77EB517D2F07A947294F260E3ACA83, B7A5DF3066830C0C2302B059778A67419792058A0D300C471DE40AB245EA7E58 ] tdx C:\windows\system32\DRIVERS\tdx.sys
21:44:54.0779 0x0c60 tdx - ok
21:44:54.0799 0x0c60 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\windows\system32\drivers\termdd.sys
21:44:54.0809 0x0c60 TermDD - ok
21:44:54.0879 0x0c60 [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService C:\windows\System32\termsrv.dll
21:44:54.0919 0x0c60 TermService - ok
21:44:54.0939 0x0c60 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\windows\system32\themeservice.dll
21:44:54.0959 0x0c60 Themes - ok
21:44:54.0979 0x0c60 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\windows\system32\mmcss.dll
21:44:55.0009 0x0c60 THREADORDER - ok
21:44:55.0029 0x0c60 [ BDFC55C2389D23C7E36A627BD580EE98, E25CF1C01CF90B348333A0CBAF26F8F5751AE725E6059C35C492E00479105B70 ] tihub3 C:\windows\system32\DRIVERS\tihub3.sys
21:44:55.0049 0x0c60 tihub3 - ok
21:44:55.0089 0x0c60 [ EBEDBC08C2E5EB4EC8E3DA4BF3D827B1, FC465EAF5C2E44F279B54B13C88ACCE565B1C9C6DDEB8D87FD0CD6CD3AA1AABC ] tixhci C:\windows\system32\drivers\tixhci.sys
21:44:55.0109 0x0c60 tixhci - ok
21:44:55.0129 0x0c60 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\windows\System32\trkwks.dll
21:44:55.0159 0x0c60 TrkWks - ok
21:44:55.0189 0x0c60 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
21:44:55.0239 0x0c60 TrustedInstaller - ok
21:44:55.0279 0x0c60 [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\windows\system32\DRIVERS\tssecsrv.sys
21:44:55.0299 0x0c60 tssecsrv - ok
21:44:55.0329 0x0c60 [ 17C6B51CBCCDED95B3CC14E22791F85E, EE417C19E9B2C258D62A74F1F2421AFFBAC67ACD62481CAA08F5B6A3439C1D7C ] TsUsbFlt C:\windows\system32\drivers\tsusbflt.sys
21:44:55.0349 0x0c60 TsUsbFlt - ok
21:44:55.0359 0x0c60 [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD C:\windows\system32\drivers\TsUsbGD.sys
21:44:55.0379 0x0c60 TsUsbGD - ok
21:44:55.0409 0x0c60 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\windows\system32\DRIVERS\tunnel.sys
21:44:55.0439 0x0c60 tunnel - ok
21:44:55.0449 0x0c60 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\windows\system32\drivers\uagp35.sys
21:44:55.0469 0x0c60 uagp35 - ok
21:44:55.0489 0x0c60 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\windows\system32\DRIVERS\udfs.sys
21:44:55.0519 0x0c60 udfs - ok
21:44:55.0539 0x0c60 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\windows\system32\UI0Detect.exe
21:44:55.0559 0x0c60 UI0Detect - ok
21:44:55.0579 0x0c60 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\windows\system32\drivers\uliagpkx.sys
21:44:55.0589 0x0c60 uliagpkx - ok
21:44:55.0619 0x0c60 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\windows\system32\DRIVERS\umbus.sys
21:44:55.0639 0x0c60 umbus - ok
21:44:55.0659 0x0c60 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\windows\system32\DRIVERS\umpass.sys
21:44:55.0679 0x0c60 UmPass - ok
21:44:55.0699 0x0c60 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\windows\System32\upnphost.dll
21:44:55.0739 0x0c60 upnphost - ok
21:44:55.0769 0x0c60 [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64 C:\windows\system32\Drivers\usbaapl64.sys
21:44:55.0839 0x0c60 USBAAPL64 - ok
21:44:55.0879 0x0c60 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\windows\system32\DRIVERS\usbccgp.sys
21:44:55.0909 0x0c60 usbccgp - ok
21:44:55.0929 0x0c60 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\windows\system32\drivers\usbcir.sys
21:44:55.0949 0x0c60 usbcir - ok
21:44:55.0979 0x0c60 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\windows\system32\drivers\usbehci.sys
21:44:55.0999 0x0c60 usbehci - ok
21:44:56.0029 0x0c60 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\windows\system32\DRIVERS\usbhub.sys
21:44:56.0069 0x0c60 usbhub - ok
21:44:56.0089 0x0c60 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\windows\system32\drivers\usbohci.sys
21:44:56.0109 0x0c60 usbohci - ok
21:44:56.0139 0x0c60 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\windows\system32\DRIVERS\usbprint.sys
21:44:56.0159 0x0c60 usbprint - ok
21:44:56.0179 0x0c60 [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan C:\windows\system32\DRIVERS\usbscan.sys
21:44:56.0199 0x0c60 usbscan - ok
21:44:56.0229 0x0c60 [ D029DD09E22EB24318A8FC3D8138BA43, C95805E8BF75ECB939520AE86420B16467B0771C161C51C9F1A37649ADFADCD0 ] USBSTOR C:\windows\system32\drivers\USBSTOR.SYS
21:44:56.0250 0x0c60 USBSTOR - ok
21:44:56.0270 0x0c60 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\windows\system32\drivers\usbuhci.sys
21:44:56.0280 0x0c60 usbuhci - ok
21:44:56.0300 0x0c60 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\windows\System32\uxsms.dll
21:44:56.0330 0x0c60 UxSms - ok
21:44:56.0340 0x0c60 [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] VaultSvc C:\windows\system32\lsass.exe
21:44:56.0360 0x0c60 VaultSvc - ok
21:44:56.0380 0x0c60 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\windows\system32\drivers\vdrvroot.sys
21:44:56.0390 0x0c60 vdrvroot - ok
21:44:56.0410 0x0c60 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\windows\System32\vds.exe
21:44:56.0450 0x0c60 vds - ok
21:44:56.0470 0x0c60 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\windows\system32\DRIVERS\vgapnp.sys
21:44:56.0480 0x0c60 vga - ok
21:44:56.0500 0x0c60 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\windows\System32\drivers\vga.sys
21:44:56.0530 0x0c60 VgaSave - ok
21:44:56.0550 0x0c60 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\windows\system32\drivers\vhdmp.sys
21:44:56.0570 0x0c60 vhdmp - ok
21:44:56.0590 0x0c60 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\windows\system32\drivers\viaide.sys
21:44:56.0600 0x0c60 viaide - ok
21:44:56.0620 0x0c60 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\windows\system32\drivers\volmgr.sys
21:44:56.0630 0x0c60 volmgr - ok
21:44:56.0650 0x0c60 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\windows\system32\drivers\volmgrx.sys
21:44:56.0670 0x0c60 volmgrx - ok
21:44:56.0680 0x0c60 [ DF8126BD41180351A093A3AD2FC8903B, AEFF4AA89CDDAAAD43CDE17C6B6EB2A397A0AC1651CBD51B889161EC2BC6527A ] volsnap C:\windows\system32\drivers\volsnap.sys
21:44:56.0700 0x0c60 volsnap - ok
21:44:56.0730 0x0c60 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\windows\system32\drivers\vsmraid.sys
21:44:56.0740 0x0c60 vsmraid - ok
21:44:56.0790 0x0c60 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\windows\system32\vssvc.exe
21:44:56.0840 0x0c60 VSS - ok
21:44:56.0860 0x0c60 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\windows\system32\DRIVERS\vwifibus.sys
21:44:56.0870 0x0c60 vwifibus - ok
21:44:56.0880 0x0c60 [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt C:\windows\system32\DRIVERS\vwififlt.sys
21:44:56.0900 0x0c60 vwififlt - ok
21:44:56.0910 0x0c60 [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp C:\windows\system32\DRIVERS\vwifimp.sys
21:44:56.0930 0x0c60 vwifimp - ok
21:44:56.0950 0x0c60 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\windows\system32\w32time.dll
21:44:56.0980 0x0c60 W32Time - ok
21:44:57.0000 0x0c60 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\windows\system32\drivers\wacompen.sys
21:44:57.0020 0x0c60 WacomPen - ok
21:44:57.0040 0x0c60 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\windows\system32\DRIVERS\wanarp.sys
21:44:57.0060 0x0c60 WANARP - ok
21:44:57.0070 0x0c60 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\windows\system32\DRIVERS\wanarp.sys
21:44:57.0100 0x0c60 Wanarpv6 - ok
21:44:57.0130 0x0c60 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\windows\system32\wbengine.exe
21:44:57.0180 0x0c60 wbengine - ok
21:44:57.0200 0x0c60 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\windows\System32\wbiosrvc.dll
21:44:57.0230 0x0c60 WbioSrvc - ok
21:44:57.0250 0x0c60 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\windows\System32\wcncsvc.dll
21:44:57.0270 0x0c60 wcncsvc - ok
21:44:57.0290 0x0c60 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
21:44:57.0310 0x0c60 WcsPlugInService - ok
21:44:57.0320 0x0c60 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\windows\system32\drivers\wd.sys
21:44:57.0340 0x0c60 Wd - ok
21:44:57.0370 0x0c60 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\windows\system32\drivers\Wdf01000.sys
21:44:57.0400 0x0c60 Wdf01000 - ok
21:44:57.0430 0x0c60 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost C:\windows\system32\wdi.dll
21:44:57.0460 0x0c60 WdiServiceHost - ok
21:44:57.0460 0x0c60 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost C:\windows\system32\wdi.dll
21:44:57.0480 0x0c60 WdiSystemHost - ok
21:44:57.0510 0x0c60 [ 4E89FC53493704BF835F0300DC201C34, FB3080725E144D93512DED81047D21C0582BC3412250EFF37E039108D7351F53 ] WebClient C:\windows\System32\webclnt.dll
21:44:57.0540 0x0c60 WebClient - ok
21:44:57.0550 0x0c60 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\windows\system32\wecsvc.dll
21:44:57.0580 0x0c60 Wecsvc - ok
21:44:57.0590 0x0c60 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\windows\System32\wercplsupport.dll
21:44:57.0620 0x0c60 wercplsupport - ok
21:44:57.0630 0x0c60 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\windows\System32\WerSvc.dll
21:44:57.0660 0x0c60 WerSvc - ok
21:44:57.0680 0x0c60 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\windows\system32\DRIVERS\wfplwf.sys
21:44:57.0710 0x0c60 WfpLwf - ok
21:44:57.0720 0x0c60 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\windows\system32\drivers\wimmount.sys
21:44:57.0730 0x0c60 WIMMount - ok
21:44:57.0750 0x0c60 WinDefend - ok
21:44:57.0750 0x0c60 WinHttpAutoProxySvc - ok
21:44:57.0810 0x0c60 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\windows\system32\wbem\WMIsvc.dll
21:44:57.0840 0x0c60 Winmgmt - ok
21:44:57.0900 0x0c60 [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM C:\windows\system32\WsmSvc.dll
21:44:57.0970 0x0c60 WinRM - ok
21:44:58.0010 0x0c60 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\windows\system32\drivers\WinUsb.sys
21:44:58.0050 0x0c60 WinUsb - ok
21:44:58.0090 0x0c60 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\windows\System32\wlansvc.dll
21:44:58.0120 0x0c60 Wlansvc - ok
21:44:58.0150 0x0c60 [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
21:44:58.0170 0x0c60 wlcrasvc - ok
21:44:58.0270 0x0c60 [ 2BACD71123F42CEA603F4E205E1AE337, 1FEF20554110371D738F462ECFFA999158EFEED02062414C58C1B61C422BF0B9 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:44:58.0320 0x0c60 wlidsvc - ok
21:44:58.0330 0x0c60 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\windows\system32\drivers\wmiacpi.sys
21:44:58.0340 0x0c60 WmiAcpi - ok
21:44:58.0360 0x0c60 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\windows\system32\wbem\WmiApSrv.exe
21:44:58.0380 0x0c60 wmiApSrv - ok
21:44:58.0410 0x0c60 WMPNetworkSvc - ok
21:44:58.0430 0x0c60 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\windows\System32\wpcsvc.dll
21:44:58.0450 0x0c60 WPCSvc - ok
21:44:58.0460 0x0c60 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\windows\system32\wpdbusenum.dll
21:44:58.0480 0x0c60 WPDBusEnum - ok
21:44:58.0500 0x0c60 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\windows\system32\drivers\ws2ifsl.sys
21:44:58.0530 0x0c60 ws2ifsl - ok
21:44:58.0540 0x0c60 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\windows\System32\wscsvc.dll
21:44:58.0560 0x0c60 wscsvc - ok
21:44:58.0590 0x0c60 [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice C:\windows\system32\DRIVERS\WSDPrint.sys
21:44:58.0610 0x0c60 WSDPrintDevice - ok
21:44:58.0640 0x0c60 [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan C:\windows\system32\DRIVERS\WSDScan.sys
21:44:58.0660 0x0c60 WSDScan - ok
21:44:58.0660 0x0c60 WSearch - ok
21:44:58.0750 0x0c60 [ 86F11B85102AFA6A1A6101DCE2F09386, 68A0F0E628C8F33FDAC114876DA8ED14776DD74E80AC5A6A52257E19DE011091 ] wuauserv C:\windows\system32\wuaueng.dll
21:44:58.0820 0x0c60 wuauserv - ok
21:44:58.0840 0x0c60 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\windows\system32\drivers\WudfPf.sys
21:44:58.0880 0x0c60 WudfPf - ok
21:44:58.0900 0x0c60 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\windows\system32\DRIVERS\WUDFRd.sys
21:44:58.0920 0x0c60 WUDFRd - ok
21:44:58.0940 0x0c60 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\windows\System32\WUDFSvc.dll
21:44:58.0960 0x0c60 wudfsvc - ok
21:44:58.0980 0x0c60 [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\windows\System32\wwansvc.dll
21:44:59.0010 0x0c60 WwanSvc - ok
21:44:59.0030 0x0c60 ================ Scan global ===============================
21:44:59.0060 0x0c60 [ 168EA9CD9BD6056BB6F60B57D5304BBE, 5A2F98754F042A7D80E7483842967EB362F01D57CE9720B24C7EDAA047F24C6F ] C:\windows\system32\basesrv.dll
21:44:59.0090 0x0c60 [ E0E4D286839FC27F56A85B4710E16B6B, 6BBBADB8904D6159E6171A339E0BF30A41D14E885D560BFB8BB73B1FF7239E1A ] C:\windows\system32\winsrv.dll
21:44:59.0100 0x0c60 [ E0E4D286839FC27F56A85B4710E16B6B, 6BBBADB8904D6159E6171A339E0BF30A41D14E885D560BFB8BB73B1FF7239E1A ] C:\windows\system32\winsrv.dll
21:44:59.0120 0x0c60 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\windows\system32\sxssrv.dll
21:44:59.0140 0x0c60 [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\windows\system32\services.exe
21:44:59.0150 0x0c60 [ Global ] - ok
21:44:59.0150 0x0c60 ================ Scan MBR ==================================
21:44:59.0150 0x0c60 [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
21:44:59.0230 0x0c60 \Device\Harddisk0\DR0 - ok
21:44:59.0230 0x0c60 ================ Scan VBR ==================================
21:44:59.0230 0x0c60 [ 5A272DD397B57E5C22DDC4202909A4E8 ] \Device\Harddisk0\DR0\Partition1
21:44:59.0300 0x0c60 \Device\Harddisk0\DR0\Partition1 - ok
21:44:59.0320 0x0c60 [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk0\DR0\Partition2
21:44:59.0320 0x0c60 \Device\Harddisk0\DR0\Partition2 - ok
21:44:59.0330 0x0c60 [ 887CEC3786FA57ED98F3A2DA19A727FA ] \Device\Harddisk0\DR0\Partition3
21:44:59.0380 0x0c60 \Device\Harddisk0\DR0\Partition3 - ok
21:44:59.0400 0x0c60 [ 3F76AA1810779CB094C95DB4BDFCC95A ] \Device\Harddisk0\DR0\Partition4
21:44:59.0440 0x0c60 \Device\Harddisk0\DR0\Partition4 - ok
21:44:59.0460 0x0c60 [ 862B798EA82B0F1B43F96DC8E6E79CD5 ] \Device\Harddisk0\DR0\Partition5
21:44:59.0460 0x0c60 \Device\Harddisk0\DR0\Partition5 - ok
21:44:59.0460 0x0c60 ================ Scan generic autorun ======================
21:44:59.0540 0x0c60 [ 47F36E94A5A6A1592E27CB44901B4DA4, BF8F79147C6DAA64D2400FE0606B3CF041F2F97C4B4A6356AF7AE9FD053687EA ] C:\Program Files\IDT\WDM\sttray64.exe
21:44:59.0580 0x0c60 SysTrayApp - detected UnsignedFile.Multi.Generic ( 1 )
21:44:59.0680 0x0c60 Detect skipped due to KSN trusted
21:44:59.0680 0x0c60 SysTrayApp - ok
21:44:59.0690 0x0c60 [ 0D997D69A624B2A04EED0B64F2092642, 67B34F6EDF0BA7C2C2BD11D6F8423FAB7AE6D7672220AACE31B632081EA25E35 ] C:\Program Files\IDT\WDM\beats64.exe
21:44:59.0700 0x0c60 BeatsOSDApp - detected UnsignedFile.Multi.Generic ( 1 )
21:44:59.0800 0x0c60 Detect skipped due to KSN trusted
21:44:59.0800 0x0c60 BeatsOSDApp - ok
21:44:59.0830 0x0c60 [ 554A50B5310E702029D3A675459108FF, 4757D5FFFAC7E73D4A3D931DB1399DDFDBD5811639BDA4517F886C21CC7F2574 ] C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE
21:44:59.0860 0x0c60 HPSYSDRV - ok
21:44:59.0900 0x0c60 [ 1BF113E377E570DB915EE7D228E594D6, FF4D198D412CA21C49E0A3E6FE52EAD69786B305429095B5BD25CB4FAFD33B51 ] C:\Program Files\iTunes\iTunesHelper.exe
21:44:59.0930 0x0c60 iTunesHelper - ok
21:45:00.0000 0x0c60 [ DD7B4F9E6B71A599FEF4BD9DA0AE57C2, 6B22356F74F7ED069A3FC39C62326AA98A70D0E860A2EB29A6C46F4077FB567A ] c:\Program Files\Microsoft Security Client\msseces.exe
21:45:00.0050 0x0c60 MSC - ok
21:45:00.0110 0x0c60 [ 680ABE0FF3AF74DE9856174DB6A2C497, ACD949B63FFCCB7E06ADB835209B684EE89F9D28A02CAD2B1768BCA2D2AC21E0 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
21:45:00.0150 0x0c60 StartCCC - ok
21:45:00.0160 0x0c60 AMD AVT - ok
21:45:00.0200 0x0c60 [ D3E69D500466C17498AAF7F83D12FFF0, F5723FC28396489EADDDCAD67A0E46B56D859590823E3CFA7254BA6709DC5AE6 ] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
21:45:00.0250 0x0c60 Norton Online Backup - ok
21:45:00.0250 0x0c60 Easybits Recovery - ok
21:45:00.0290 0x0c60 [ FE821F6FA60E9DF9FDEE69A23488BBAB, 98D9926152FDA45705F5E208D7236E467CAEEF83D756A14B4104EBF804644B29 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
21:45:00.0320 0x0c60 Adobe ARM - ok
21:45:00.0350 0x0c60 [ 9F3B239443E7AF5840454D8D3A0772CF, 82E135AA844B3170D030CE27259BF7BACBA1FA18670C10B74BD3F402CA9AD29E ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
21:45:00.0360 0x0c60 APSDaemon - ok
21:45:00.0480 0x0c60 [ 6B115CE521D96900373775ECAC975D59, 9E915F95AFBAABA418B30AAEEEEDA8A127AFD0C2EBD899AACF7AC9A8013F8413 ] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
21:45:00.0550 0x0c60 KiesTrayAgent - ok
21:45:00.0650 0x0c60 [ 1F628583C0F01E214AE45C8791B55010, 9544F1241F802D5F75D19D07886E8A93E6280F6E87415E6E0A0C1F420A433763 ] C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
21:45:00.0690 0x0c60 Magic Desktop for HP notification - ok
21:45:00.0740 0x0c60 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
21:45:00.0800 0x0c60 Sidebar - ok
21:45:00.0820 0x0c60 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
21:45:00.0870 0x0c60 mctadmin - ok
21:45:00.0890 0x0c60 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
21:45:00.0920 0x0c60 Sidebar - ok
21:45:00.0920 0x0c60 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
21:45:00.0940 0x0c60 mctadmin - ok
21:45:00.0980 0x0c60 GoogleDriveSync - ok
21:45:01.0040 0x0c60 [ 70C305067B3D543870597C57F74D9EC3, CF25EB4D61A387E61B6C301AEEBD5B8EBF8AFC372A7001F53979521AA4758098 ] C:\Program Files (x86)\Samsung\Kies\Kies.exe
21:45:01.0070 0x0c60 KiesPreload - ok
21:45:01.0070 0x0c60 KiesAirMessage - ok
21:45:01.0110 0x0c60 [ 8E689D83B243C229A683559FF98CF047, DC3D08CDD5EFF7EF81CB75AF4F354878CDC78CAE8FC8A2CFD143EE4F26DA1D3E ] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
21:45:01.0140 0x0c60 KiesPDLR - ok
21:45:01.0140 0x0c60 Waiting for KSN requests completion. In queue: 95
21:45:02.0150 0x0c60 AV detected via SS2: Norton Internet Security, C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\WSCStub.exe ( 22.7.0.0 ), 0x51000 ( enabled : updated )
21:45:02.0150 0x0c60 AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.9.218.0 ), 0x61000 ( enabled : updated )
21:45:02.0160 0x0c60 FW detected via SS2: Norton Internet Security, C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\WSCStub.exe ( 22.7.0.0 ), 0x51010 ( enabled )
21:45:02.0341 0x0c60 ============================================================
21:45:02.0341 0x0c60 Scan finished
21:45:02.0341 0x0c60 ============================================================
21:45:02.0341 0x22b8 Detected object count: 0
21:45:02.0341 0x22b8 Actual detected object count: 0
|
|
02.07.2016, 11:41
| #3 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Hallo zusammen,
__________________ich bin's nochmal. Kann mir denn niemand helfen? Interesse am Thema scheinen einige zu haben, mit Hilfe wird's dann schon schwieriger... Bitte meldet euch wenn ihr Tipps oder die Lösung habt ;-) Viele Grüße, Emroi |
|
02.07.2016, 14:36
| #4 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™   | CryptXXX 3.0: Alle Files auf .crypz verschlüsseltZitat:
Wenn es keine decryptor gibt hast du Pech gehabt....mit etwas Glück gibt es dann vllt irgendwann einen decryptor. Dann musst du die verschlüsselten Dateien aufbewahren, also die "original" von diesem ransom verschlüsselten Dateien, nicht die Dateien, die durch deine ersten Versuche der Entschlüsselung entstanden sind. Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
03.07.2016, 08:20
| #5 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Hallo Cosinus, danke dir für deine Rückmeldung. Genau so ist es. Ich habe es (soeben ein weiteres mal) auf der id-ramsomware Seite gecheckt und daher auch den Namen des Trojaners erfahren. Leider ist nach wie vor kein Decryptor bekannt. Werde nun die Dateien sichern. Allerdings wäre ich natürlich sehr daran interessiert zu wissen, ob das System mittlerweile vollständig sauber ist. Deshalb habe ich die Logs angehängt. Danke dir & viele Grüße, Emroi |
|
04.07.2016, 09:01
| #6 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Zuerst mal würde ich mich von diesem Schrott trennen: Zitat:
__________________ --> CryptXXX 3.0: Alle Files auf .crypz verschlüsselt |
|
04.07.2016, 09:05
| #7 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Hi Cosinus, OK, verstanden... Uninstall Norton Internet Security. Mache ich heute Abend. Hast du gleich eine andere Empfehlung für mich, oder soll ich bis zur letztlichen Bereinigung des Systems im "Blindflug" unterwegs bleiben? Danke dir für deine Unterstützung, Emroi |
|
04.07.2016, 09:10
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Das Teil wird deinstalliert, dann analysieren wir und zum Schluss kommt erst ein AV wieder drauf.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.07.2016, 18:07
| #9 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Super, danke dir. Ich melde mich heute Abend. Bis dahin Hallo Cosinus, Uninstall läuft... ... und ist erfolgreich durch. Warte nun auf deine Instruktionen. Viele Grüße, Emroi |
|
04.07.2016, 18:23
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt dann weiter mit MBAR, Log bitte richtig in CODE-Tags posten Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.07.2016, 19:03
| #11 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt OK, der Scan läuft... Ich nehme an der dauert eine Weile... Hi Cosinus, ist durch... keine Findings. Hier die Logdatei: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2016.07.04.06
rootkit: v2016.05.27.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18349
MReuter :: REUTER [administrator]
04.07.2016 19:25:10
mbar-log-2016-07-04 (19-25-10).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 337714
Time elapsed: 29 minute(s), 14 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
04.07.2016, 21:37
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Wir können scannen wie wir wollen...da wird nix mehr vom ransom sein. Das ist auch nicht die Intention von ransoms. Die haben ihr Werk bei dir schon verrichtet.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
05.07.2016, 10:10
| #13 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Hallo Cosinus, das ist ja zumindest ein Teilerfolg (sauberes System). Bleiben "nur" noch zwei Fragen: 1. Empfehlung Alternative zu "Norton Internet Security". 2. Entschlüsselung der Dateien. Ich habe gelernt, dass ich zu 2. zunächst alle verschlüsselten Files "archivieren" und auf eine Decrypt-Software warten soll... So werd ich es machen. Wenn du mir zu 1. noch ein Statement liefern könntest wäre das klasse. Danke dir & viele Grüße, Emroi |
|
05.07.2016, 10:43
| #14 | ||||||||||
| /// Winkelfunktion /// TB-Süch-Tiger™ | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Lesestoff:Virenscanner Verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:
Microsoft Security Essentials (MSE) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE entschieden hast, brauchst du nicht extra MSE zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür. Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und/oder mit dem ESET Online Scanner scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. NoScript kann gerade bei technisch nicht allzu versierten Nutzern beim Surfen zum Nervfaktor werden; ob das Tool geeignet ist, muss jeder selbst mal ausprobieren und dann für sich entscheiden. Alternativen zu NoScript (wenn um das das Verhindern von Usertracking und Werbung auf Webseiten) geht wären da Ghostery oder uBlock. Ghostery ist eine sehr bekannte Erweiterung, die aber auch in Kritik geraten ist, vgl. dazu bitte diesen Thread => Ghostery schleift Werbung durch Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
19.07.2016, 13:52
| #15 |
| | CryptXXX 3.0: Alle Files auf .crypz verschlüsselt Hallo zusammen, bin seit längerer Zeit mal wieder hier und habe zumindest für mich super Nachrichten... Ich schreibe das hier, weil ich all denen, die ebenfalls von einer Verschlüsselung betroffen sind Mut machen und für Geduld werben möchte. Meine Files sind mittlerweile wieder entschlüsselt, da ich das unglaubliche Glück hatte zu denen zu gehören, deren Keys fälschlicherweise ohne Bezahlung veröffentlicht wurde (siehe hier: Erpressungs-Trojaner CryptXXX rutscht Schlüssel kostenlos raus | heise Security) Manchmal hat man eben auch mal Glück! Deshalb: Sichert eure verschlüsselten Daten, schaut auf die "Erpresserseite" und mit etwas Glück gehört ihr auch dazu. Falls nicht bleibt nur Geduld zu haben und immer wieder die News zu verfolgen. Viele Grüße, Emroi |
|
| Themen zu CryptXXX 3.0: Alle Files auf .crypz verschlüsselt |
| beiträge, canon, dateien, dnsapi.dll, eingefangen, entfernt, entschlüsseln, erfolgreich, essen, files, folge, folgendes, fordert, gen, hallo zusammen, logfiles, meinung, microsoft, rechner, sauber, schlüsseln, security, tool, trojaner, wirklich, zusammen, öffnen |
Linear-Darstellung
