trojan dropper:win32/bunt

16:43:10.0547 0x272c  TDSS rootkit removing tool 3.1.0.11 Aug  5 2016 12:13:31
16:43:17.0357 0x272c  ============================================================
16:43:17.0357 0x272c  Current date / time: 2016/10/05 16:43:17.0357
16:43:17.0357 0x272c  SystemInfo:
16:43:17.0357 0x272c  
16:43:17.0357 0x272c  OS Version: 10.0.14393 ServicePack: 0.0
16:43:17.0357 0x272c  Product type: Workstation
16:43:17.0357 0x272c  ComputerName: JULIUS-PC
16:43:17.0358 0x272c  UserName: Julius
16:43:17.0358 0x272c  Windows directory: C:\WINDOWS
16:43:17.0358 0x272c  System windows directory: C:\WINDOWS
16:43:17.0358 0x272c  Running under WOW64
16:43:17.0358 0x272c  Processor architecture: Intel x64
16:43:17.0358 0x272c  Number of processors: 4
16:43:17.0358 0x272c  Page size: 0x1000
16:43:17.0358 0x272c  Boot type: Normal boot
16:43:17.0358 0x272c  CodeIntegrityOptions = 0x00000001
16:43:17.0358 0x272c  ============================================================
16:43:17.0417 0x272c  KLMD registered as C:\WINDOWS\system32\drivers\75971823.sys
16:43:17.0417 0x272c  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 14393.187, osProperties = 0x19
16:43:17.0488 0x272c  System UUID: {39186A2B-A2CF-AD98-9E7B-8E54B2EC98A2}
16:43:17.0840 0x272c  Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 ( 111.79 Gb ), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:43:17.0858 0x272c  Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:43:17.0927 0x272c  ============================================================
16:43:17.0927 0x272c  \Device\Harddisk0\DR0:
16:43:17.0928 0x272c  MBR partitions:
16:43:17.0928 0x272c  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:43:17.0928 0x272c  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0xDD9F800
16:43:17.0928 0x272c  \Device\Harddisk1\DR1:
16:43:17.0928 0x272c  MBR partitions:
16:43:17.0928 0x272c  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A384800
16:43:17.0928 0x272c  ============================================================
16:43:17.0929 0x272c  C: <-> \Device\Harddisk0\DR0\Partition2
16:43:17.0950 0x272c  D: <-> \Device\Harddisk1\DR1\Partition1
16:43:17.0950 0x272c  ============================================================
16:43:17.0950 0x272c  Initialize success
16:43:17.0950 0x272c  ============================================================
16:44:05.0056 0x1668  ============================================================
16:44:05.0056 0x1668  Scan started
16:44:05.0056 0x1668  Mode: Manual; 
16:44:05.0056 0x1668  ============================================================
16:44:05.0056 0x1668  KSN ping started
16:44:05.0773 0x1668  KSN ping finished: true
16:44:06.0532 0x1668  ================ Scan system memory ========================
16:44:06.0532 0x1668  System memory - ok
16:44:06.0533 0x1668  ================ Scan services =============================
16:44:06.0612 0x1668  1394ohci - ok
16:44:06.0619 0x1668  3ware - ok
16:44:06.0627 0x1668  ACPI - ok
16:44:06.0635 0x1668  AcpiDev - ok
16:44:06.0642 0x1668  acpiex - ok
16:44:06.0651 0x1668  acpipagr - ok
16:44:06.0661 0x1668  AcpiPmi - ok
16:44:06.0669 0x1668  acpitime - ok
16:44:06.0685 0x1668  ADP80XX - ok
16:44:06.0698 0x1668  AFD - ok
16:44:06.0713 0x1668  ahcache - ok
16:44:06.0721 0x1668  AJRouter - ok
16:44:06.0730 0x1668  ALG - ok
16:44:06.0747 0x1668  [ BBADD85854BFB5D43C60B7AC8EEA3DBA, 968C043ABEA46F5C79525863B3FE2681AC0FA4202036C9EFD20B408DECF407E2 ] AMD External Events Utility C:\WINDOWS\system32\atiesrxx.exe
16:44:06.0755 0x1668  AMD External Events Utility - ok
16:44:06.0772 0x1668  AmdK8 - ok
16:44:06.0781 0x1668  amdkmdag - ok
16:44:06.0809 0x1668  [ 17BA5C907E14947574CBB788F4CEB85F, EAA3DBF436637C58666A91905E388287FC54334EBB2589A00727EB09AC4870E3 ] amdkmdap        C:\WINDOWS\system32\DRIVERS\atikmpag.sys
16:44:06.0823 0x1668  amdkmdap - ok
16:44:06.0832 0x1668  AmdPPM - ok
16:44:06.0840 0x1668  amdsata - ok
16:44:06.0850 0x1668  amdsbs - ok
16:44:06.0858 0x1668  amdxata - ok
16:44:06.0868 0x1668  AppHostSvc - ok
16:44:06.0875 0x1668  AppID - ok
16:44:06.0883 0x1668  AppIDSvc - ok
16:44:06.0891 0x1668  Appinfo - ok
16:44:06.0901 0x1668  applockerfltr - ok
16:44:06.0909 0x1668  AppReadiness - ok
16:44:06.0919 0x1668  AppXSvc - ok
16:44:06.0928 0x1668  arcsas - ok
16:44:06.0973 0x1668  aspnet_state - ok
16:44:06.0981 0x1668  AsyncMac - ok
16:44:06.0990 0x1668  atapi - ok
16:44:07.0007 0x1668  [ 0966FD5BAB1F9BE200875E9EED0A0A13, F4BE70C0581B51ED6DAE6412A5FF74AE310BF88DE89C5A5E5880BEED543B01D7 ] AtiHDAudioService C:\WINDOWS\system32\drivers\AtihdWT6.sys
16:44:07.0010 0x1668  AtiHDAudioService - ok
16:44:07.0017 0x1668  AudioEndpointBuilder - ok
16:44:07.0027 0x1668  Audiosrv - ok
16:44:07.0036 0x1668  [ 1DC2F715792CF33428AD7993ACBD224D, 129FBD517E016914CD61C35894C0B9B2074E680F1EB21201597E5C13CAF4529F ] avmeject        C:\WINDOWS\system32\drivers\avmeject.sys
16:44:07.0038 0x1668  avmeject - ok
16:44:07.0046 0x1668  AxInstSV - ok
16:44:07.0055 0x1668  b06bdrv - ok
16:44:07.0065 0x1668  BasicDisplay - ok
16:44:07.0075 0x1668  BasicRender - ok
16:44:07.0091 0x1668  bcmfn - ok
16:44:07.0102 0x1668  bcmfn2 - ok
16:44:07.0110 0x1668  BDESVC - ok
16:44:07.0119 0x1668  Beep - ok
16:44:07.0129 0x1668  BFE - ok
16:44:07.0138 0x1668  BITS - ok
16:44:07.0146 0x1668  bowser - ok
16:44:07.0155 0x1668  BrokerInfrastructure - ok
16:44:07.0163 0x1668  Browser - ok
16:44:07.0172 0x1668  BthAvrcpTg - ok
16:44:07.0181 0x1668  BthEnum - ok
16:44:07.0190 0x1668  BthHFEnum - ok
16:44:07.0199 0x1668  bthhfhid - ok
16:44:07.0208 0x1668  BthHFSrv - ok
16:44:07.0217 0x1668  BTHMODEM - ok
16:44:07.0226 0x1668  BthPan - ok
16:44:07.0235 0x1668  BTHPORT - ok
16:44:07.0242 0x1668  bthserv - ok
16:44:07.0253 0x1668  BTHUSB - ok
16:44:07.0261 0x1668  buttonconverter - ok
16:44:07.0270 0x1668  CapImg - ok
16:44:07.0280 0x1668  cdfs - ok
16:44:07.0288 0x1668  CDPSvc - ok
16:44:07.0298 0x1668  CDPUserSvc - ok
16:44:07.0312 0x1668  cdrom - ok
16:44:07.0322 0x1668  CertPropSvc - ok
16:44:07.0332 0x1668  cht4iscsi - ok
16:44:07.0340 0x1668  cht4vbd - ok
16:44:07.0348 0x1668  circlass - ok
16:44:07.0357 0x1668  CLFS - ok
16:44:07.0368 0x1668  ClipSVC - ok
16:44:07.0381 0x1668  clreg - ok
16:44:07.0405 0x1668  CmBatt - ok
16:44:07.0415 0x1668  CNG - ok
16:44:07.0424 0x1668  cnghwassist - ok
16:44:07.0441 0x1668  [ 6F4385A829DCFC21180E12F6D0155F1C, 698B53106E25632D0259E0620787510B0881C7494CCAE2CDF4FAC1115E2D0C0C ] Coerlasy        C:\Program Files (x86)\Kzerlybervush\procaentvlotCollector.dll
16:44:07.0447 0x1668  Coerlasy - ok
16:44:07.0481 0x1668  CompositeBus - ok
16:44:07.0488 0x1668  COMSysApp - ok
16:44:07.0498 0x1668  condrv - ok
16:44:07.0507 0x1668  CoreMessagingRegistrar - ok
16:44:07.0525 0x1668  CryptSvc - ok
16:44:07.0533 0x1668  dam - ok
16:44:07.0546 0x1668  DcomLaunch - ok
16:44:07.0555 0x1668  DcpSvc - ok
16:44:07.0563 0x1668  defragsvc - ok
16:44:07.0572 0x1668  DeviceAssociationService - ok
16:44:07.0580 0x1668  DeviceInstall - ok
16:44:07.0590 0x1668  DevQueryBroker - ok
16:44:07.0598 0x1668  Dfsc - ok
16:44:07.0609 0x1668  Dhcp - ok
16:44:07.0620 0x1668  diagnosticshub.standardcollector.service - ok
16:44:07.0630 0x1668  DiagTrack - ok
16:44:07.0638 0x1668  disk - ok
16:44:07.0646 0x1668  DmEnrollmentSvc - ok
16:44:07.0655 0x1668  dmvsc - ok
16:44:07.0664 0x1668  dmwappushservice - ok
16:44:07.0673 0x1668  Dnscache - ok
16:44:07.0685 0x1668  dot3svc - ok
16:44:07.0694 0x1668  DPS - ok
16:44:07.0704 0x1668  drmkaud - ok
16:44:07.0713 0x1668  DsmSvc - ok
16:44:07.0722 0x1668  DsSvc - ok
16:44:07.0729 0x1668  DXGKrnl - ok
16:44:07.0739 0x1668  e1express - ok
16:44:07.0747 0x1668  EapHost - ok
16:44:07.0755 0x1668  ebdrv - ok
16:44:07.0766 0x1668  EFS - ok
16:44:07.0777 0x1668  EhStorClass - ok
16:44:07.0787 0x1668  EhStorTcgDrv - ok
16:44:07.0794 0x1668  embeddedmode - ok
16:44:07.0804 0x1668  EntAppSvc - ok
16:44:07.0819 0x1668  ErrDev - ok
16:44:07.0836 0x1668  EventSystem - ok
16:44:07.0843 0x1668  exfat - ok
16:44:07.0854 0x1668  fastfat - ok
16:44:07.0863 0x1668  Fax - ok
16:44:07.0873 0x1668  fdc - ok
16:44:07.0885 0x1668  fdPHost - ok
16:44:07.0893 0x1668  FDResPub - ok
16:44:07.0901 0x1668  fhsvc - ok
16:44:07.0912 0x1668  FileCrypt - ok
16:44:07.0922 0x1668  FileInfo - ok
16:44:07.0931 0x1668  Filetrace - ok
16:44:07.0940 0x1668  flpydisk - ok
16:44:07.0951 0x1668  FltMgr - ok
16:44:07.0959 0x1668  FontCache - ok
16:44:07.0971 0x1668  FontCache3.0.0.0 - ok
16:44:07.0979 0x1668  FrameServer - ok
16:44:07.0989 0x1668  FsDepends - ok
16:44:07.0998 0x1668  Fs_Rec - ok
16:44:08.0006 0x1668  fvevol - ok
16:44:08.0055 0x1668  [ 0D2843C3C676B852D0B01CEA1E1DAE6C, 2F2751E09725D52008865F08A08F9989BCC4BA07FBC11B3BEF4332DC463CFC63 ] fwlanusb5_nv2   C:\WINDOWS\system32\DRIVERS\fwlanusb5_nv2.sys
16:44:08.0082 0x1668  fwlanusb5_nv2 - ok
16:44:08.0096 0x1668  gencounter - ok
16:44:08.0105 0x1668  genericusbfn - ok
16:44:08.0114 0x1668  GPIOClx0101 - ok
16:44:08.0122 0x1668  gpsvc - ok
16:44:08.0131 0x1668  GpuEnergyDrv - ok
16:44:08.0143 0x1668  [ 750446ED76A5D13E902174DDDDA1A62B, F67355A6659E21D8D97E6982B28F22453F8C298E822E27FADDB440DA4A6DE7C0 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:44:08.0147 0x1668  gupdate - ok
16:44:08.0157 0x1668  [ 750446ED76A5D13E902174DDDDA1A62B, F67355A6659E21D8D97E6982B28F22453F8C298E822E27FADDB440DA4A6DE7C0 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:44:08.0160 0x1668  gupdatem - ok
16:44:08.0169 0x1668  HdAudAddService - ok
16:44:08.0179 0x1668  HDAudBus - ok
16:44:08.0188 0x1668  HidBatt - ok
16:44:08.0198 0x1668  HidBth - ok
16:44:08.0207 0x1668  hidi2c - ok
16:44:08.0216 0x1668  hidinterrupt - ok
16:44:08.0226 0x1668  HidIr - ok
16:44:08.0236 0x1668  hidserv - ok
16:44:08.0245 0x1668  HidUsb - ok
16:44:08.0257 0x1668  HomeGroupListener - ok
16:44:08.0266 0x1668  HomeGroupProvider - ok
16:44:08.0275 0x1668  HpSAMD - ok
16:44:08.0287 0x1668  HTTP - ok
16:44:08.0295 0x1668  HvHost - ok
16:44:08.0303 0x1668  hvservice - ok
16:44:08.0312 0x1668  hwpolicy - ok
16:44:08.0325 0x1668  hyperkbd - ok
16:44:08.0334 0x1668  i8042prt - ok
16:44:08.0342 0x1668  iagpio - ok
16:44:08.0350 0x1668  iai2c - ok
16:44:08.0360 0x1668  iaLPSS2i_GPIO2 - ok
16:44:08.0371 0x1668  iaLPSS2i_I2C - ok
16:44:08.0381 0x1668  iaLPSSi_GPIO - ok
16:44:08.0391 0x1668  iaLPSSi_I2C - ok
16:44:08.0399 0x1668  iaStorAV - ok
16:44:08.0410 0x1668  iaStorV - ok
16:44:08.0419 0x1668  ibbus - ok
16:44:08.0428 0x1668  icssvc - ok
16:44:08.0441 0x1668  IKEEXT - ok
16:44:08.0448 0x1668  IndirectKmd - ok
16:44:08.0468 0x1668  intelide - ok
16:44:08.0477 0x1668  intelpep - ok
16:44:08.0487 0x1668  intelppm - ok
16:44:08.0496 0x1668  iorate - ok
16:44:08.0504 0x1668  IpFilterDriver - ok
16:44:08.0515 0x1668  iphlpsvc - ok
16:44:08.0524 0x1668  IPMIDRV - ok
16:44:08.0533 0x1668  IPNAT - ok
16:44:08.0541 0x1668  irda - ok
16:44:08.0549 0x1668  IRENUM - ok
16:44:08.0558 0x1668  irmon - ok
16:44:08.0567 0x1668  isapnp - ok
16:44:08.0577 0x1668  iScsiPrt - ok
16:44:08.0587 0x1668  kbdclass - ok
16:44:08.0595 0x1668  kbdhid - ok
16:44:08.0604 0x1668  kdnic - ok
16:44:08.0611 0x1668  KeyIso - ok
16:44:08.0621 0x1668  KSecDD - ok
16:44:08.0633 0x1668  KSecPkg - ok
16:44:08.0643 0x1668  ksthunk - ok
16:44:08.0653 0x1668  KtmRm - ok
16:44:08.0662 0x1668  LanmanServer - ok
16:44:08.0671 0x1668  LanmanWorkstation - ok
16:44:08.0684 0x1668  lfsvc - ok
16:44:08.0692 0x1668  LicenseManager - ok
16:44:08.0703 0x1668  lltdio - ok
16:44:08.0712 0x1668  lltdsvc - ok
16:44:08.0721 0x1668  lmhosts - ok
16:44:08.0733 0x1668  LSI_SAS - ok
16:44:08.0742 0x1668  LSI_SAS2i - ok
16:44:08.0750 0x1668  LSI_SAS3i - ok
16:44:08.0759 0x1668  LSI_SSS - ok
16:44:08.0768 0x1668  LSM - ok
16:44:08.0776 0x1668  luafv - ok
16:44:08.0787 0x1668  MapsBroker - ok
16:44:08.0797 0x1668  megasas - ok
16:44:08.0806 0x1668  megasr - ok
16:44:08.0815 0x1668  MessagingService - ok
16:44:08.0829 0x1668  mlx4_bus - ok
16:44:08.0840 0x1668  MMCSS - ok
16:44:08.0849 0x1668  Modem - ok
16:44:08.0858 0x1668  monitor - ok
16:44:08.0867 0x1668  mouclass - ok
16:44:08.0879 0x1668  mouhid - ok
16:44:08.0887 0x1668  mountmgr - ok
16:44:08.0895 0x1668  mpsdrv - ok
16:44:08.0907 0x1668  MpsSvc - ok
16:44:08.0917 0x1668  MQAC - ok
16:44:08.0927 0x1668  MRxDAV - ok
16:44:08.0936 0x1668  mrxsmb - ok
16:44:08.0945 0x1668  mrxsmb10 - ok
16:44:08.0954 0x1668  mrxsmb20 - ok
16:44:08.0962 0x1668  MsBridge - ok
16:44:08.0972 0x1668  MSDTC - ok
16:44:08.0989 0x1668  Msfs - ok
16:44:09.0000 0x1668  msgpiowin32 - ok
16:44:09.0008 0x1668  mshidkmdf - ok
16:44:09.0018 0x1668  mshidumdf - ok
16:44:09.0027 0x1668  msisadrv - ok
16:44:09.0038 0x1668  MSiSCSI - ok
16:44:09.0045 0x1668  msiserver - ok
16:44:09.0053 0x1668  MSKSSRV - ok
16:44:09.0062 0x1668  MsLldp - ok
16:44:09.0071 0x1668  MSMQ - ok
16:44:09.0080 0x1668  MSPCLOCK - ok
16:44:09.0088 0x1668  MSPQM - ok
16:44:09.0099 0x1668  MsRPC - ok
16:44:09.0111 0x1668  mssmbios - ok
16:44:09.0119 0x1668  MSTEE - ok
16:44:09.0128 0x1668  MTConfig - ok
16:44:09.0138 0x1668  Mup - ok
16:44:09.0146 0x1668  mvumis - ok
16:44:09.0159 0x1668  NativeWifiP - ok
16:44:09.0167 0x1668  NcaSvc - ok
16:44:09.0175 0x1668  NcbService - ok
16:44:09.0184 0x1668  NcdAutoSetup - ok
16:44:09.0192 0x1668  ndfltr - ok
16:44:09.0202 0x1668  NDIS - ok
16:44:09.0210 0x1668  NdisCap - ok
16:44:09.0219 0x1668  NdisImPlatform - ok
16:44:09.0227 0x1668  NdisTapi - ok
16:44:09.0236 0x1668  Ndisuio - ok
16:44:09.0248 0x1668  NdisVirtualBus - ok
16:44:09.0258 0x1668  NdisWan - ok
16:44:09.0265 0x1668  ndiswanlegacy - ok
16:44:09.0273 0x1668  ndproxy - ok
16:44:09.0281 0x1668  Ndu - ok
16:44:09.0290 0x1668  NetAdapterCx - ok
16:44:09.0298 0x1668  NetBIOS - ok
16:44:09.0310 0x1668  NetBT - ok
16:44:09.0318 0x1668  Netlogon - ok
16:44:09.0329 0x1668  Netman - ok
16:44:09.0346 0x1668  NetMsmqActivator - ok
16:44:09.0352 0x1668  NetPipeActivator - ok
16:44:09.0364 0x1668  netprofm - ok
16:44:09.0373 0x1668  netr28ux - ok
16:44:09.0383 0x1668  NetSetupSvc - ok
16:44:09.0388 0x1668  NetTcpActivator - ok
16:44:09.0396 0x1668  NetTcpPortSharing - ok
16:44:09.0415 0x1668  NgcCtnrSvc - ok
16:44:09.0423 0x1668  NgcSvc - ok
16:44:09.0434 0x1668  NlaSvc - ok
16:44:09.0442 0x1668  Npfs - ok
16:44:09.0451 0x1668  npsvctrig - ok
16:44:09.0461 0x1668  nsi - ok
16:44:09.0471 0x1668  nsiproxy - ok
16:44:09.0483 0x1668  NTFS - ok
16:44:09.0491 0x1668  Null - ok
16:44:09.0500 0x1668  nvraid - ok
16:44:09.0510 0x1668  nvstor - ok
16:44:09.0518 0x1668  OneSyncSvc - ok
16:44:09.0531 0x1668  p2pimsvc - ok
16:44:09.0542 0x1668  p2psvc - ok
16:44:09.0549 0x1668  Parport - ok
16:44:09.0558 0x1668  partmgr - ok
16:44:09.0567 0x1668  PcaSvc - ok
16:44:09.0575 0x1668  pci - ok
16:44:09.0585 0x1668  pciide - ok
16:44:09.0595 0x1668  pcmcia - ok
16:44:09.0606 0x1668  pcw - ok
16:44:09.0620 0x1668  pdc - ok
16:44:09.0628 0x1668  PEAUTH - ok
16:44:09.0641 0x1668  percsas2i - ok
16:44:09.0649 0x1668  percsas3i - ok
16:44:09.0702 0x1668  PerfHost - ok
16:44:09.0725 0x1668  PhoneSvc - ok
16:44:09.0735 0x1668  PimIndexMaintenanceSvc - ok
16:44:09.0746 0x1668  pla - ok
16:44:09.0755 0x1668  PlugPlay - ok
16:44:09.0763 0x1668  PNRPAutoReg - ok
16:44:09.0771 0x1668  PNRPsvc - ok
16:44:09.0779 0x1668  PolicyAgent - ok
16:44:09.0792 0x1668  Power - ok
16:44:09.0801 0x1668  PptpMiniport - ok
16:44:09.0925 0x1668  [ 7196D3C2E2E3129814C8DAB91F9A7D1E, 6763E4BF8E846B597E78778E520F5BADC95608BAA4EA0AC84971384B5D976DD7 ] PrintNotify     C:\WINDOWS\system32\spool\drivers\x64\3\PrintConfig.dll
16:44:09.0996 0x1668  PrintNotify - ok
16:44:10.0013 0x1668  Processor - ok
16:44:10.0021 0x1668  ProfSvc - ok
16:44:10.0027 0x1668  Psched - ok
16:44:10.0036 0x1668  QWAVE - ok
16:44:10.0045 0x1668  QWAVEdrv - ok
16:44:10.0054 0x1668  RasAcd - ok
16:44:10.0061 0x1668  RasAgileVpn - ok
16:44:10.0070 0x1668  RasAuto - ok
16:44:10.0078 0x1668  Rasl2tp - ok
16:44:10.0087 0x1668  RasMan - ok
16:44:10.0095 0x1668  RasPppoe - ok
16:44:10.0103 0x1668  RasSstp - ok
16:44:10.0112 0x1668  rdbss - ok
16:44:10.0124 0x1668  rdpbus - ok
16:44:10.0132 0x1668  RDPDR - ok
16:44:10.0147 0x1668  RdpVideoMiniport - ok
16:44:10.0157 0x1668  rdyboost - ok
16:44:10.0167 0x1668  ReFSv1 - ok
16:44:10.0174 0x1668  RemoteAccess - ok
16:44:10.0183 0x1668  RemoteRegistry - ok
16:44:10.0191 0x1668  RetailDemo - ok
16:44:10.0202 0x1668  RFCOMM - ok
16:44:10.0213 0x1668  RmSvc - ok
16:44:10.0220 0x1668  RpcEptMapper - ok
16:44:10.0234 0x1668  RpcLocator - ok
16:44:10.0244 0x1668  RpcSs - ok
16:44:10.0258 0x1668  rspndr - ok
16:44:10.0273 0x1668  s3cap - ok
16:44:10.0280 0x1668  SamSs - ok
16:44:10.0289 0x1668  sbp2port - ok
16:44:10.0296 0x1668  SCardSvr - ok
16:44:10.0306 0x1668  ScDeviceEnum - ok
16:44:10.0315 0x1668  scfilter - ok
16:44:10.0323 0x1668  Schedule - ok
16:44:10.0332 0x1668  scmbus - ok
16:44:10.0339 0x1668  scmdisk0101 - ok
16:44:10.0349 0x1668  SCPolicySvc - ok
16:44:10.0356 0x1668  sdbus - ok
16:44:10.0365 0x1668  SDRSVC - ok
16:44:10.0373 0x1668  sdstor - ok
16:44:10.0380 0x1668  seclogon - ok
16:44:10.0388 0x1668  SENS - ok
16:44:10.0394 0x1668  SensorDataService - ok
16:44:10.0404 0x1668  SensorService - ok
16:44:10.0411 0x1668  SensrSvc - ok
16:44:10.0419 0x1668  SerCx - ok
16:44:10.0439 0x1668  SerCx2 - ok
16:44:10.0445 0x1668  Serenum - ok
16:44:10.0455 0x1668  Serial - ok
16:44:10.0463 0x1668  sermouse - ok
16:44:10.0483 0x1668  SessionEnv - ok
16:44:10.0500 0x1668  sfloppy - ok
16:44:10.0509 0x1668  SharedAccess - ok
16:44:10.0517 0x1668  ShellHWDetection - ok
16:44:10.0526 0x1668  shpamsvc - ok
16:44:10.0533 0x1668  SiSRaid2 - ok
16:44:10.0541 0x1668  SiSRaid4 - ok
16:44:10.0550 0x1668  smphost - ok
16:44:10.0559 0x1668  SmsRouter - ok
16:44:10.0581 0x1668  SNMPTRAP - ok
16:44:10.0591 0x1668  spaceport - ok
16:44:10.0600 0x1668  SpbCx - ok
16:44:10.0609 0x1668  Spooler - ok
16:44:10.0618 0x1668  sppsvc - ok
16:44:10.0626 0x1668  srv - ok
16:44:10.0635 0x1668  srv2 - ok
16:44:10.0643 0x1668  srvnet - ok
16:44:10.0653 0x1668  SSDPSRV - ok
16:44:10.0663 0x1668  SstpSvc - ok
16:44:10.0682 0x1668  StateRepository - ok
16:44:10.0727 0x1668  [ E06AA279D85877268E34E9A9BC41F560, 6EFE7E3850CD19B919053293B6D8CB61CC638D3B1626BB62594C681625132689 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
16:44:10.0756 0x1668  Steam Client Service - ok
16:44:10.0767 0x1668  stexstor - ok
16:44:10.0774 0x1668  stisvc - ok
16:44:10.0781 0x1668  storahci - ok
16:44:10.0798 0x1668  storflt - ok
16:44:10.0805 0x1668  stornvme - ok
16:44:10.0814 0x1668  storqosflt - ok
16:44:10.0822 0x1668  StorSvc - ok
16:44:10.0830 0x1668  storufs - ok
16:44:10.0839 0x1668  storvsc - ok
16:44:10.0848 0x1668  svsvc - ok
16:44:10.0857 0x1668  swenum - ok
16:44:10.0867 0x1668  swprv - ok
16:44:10.0875 0x1668  Synth3dVsc - ok
16:44:10.0883 0x1668  SysMain - ok
16:44:10.0891 0x1668  SystemEventsBroker - ok
16:44:10.0899 0x1668  TabletInputService - ok
16:44:10.0908 0x1668  TapiSrv - ok
16:44:10.0917 0x1668  Tcpip - ok
16:44:10.0925 0x1668  Tcpip6 - ok
16:44:10.0937 0x1668  tcpipreg - ok
16:44:10.0948 0x1668  tdx - ok
16:44:10.0956 0x1668  terminpt - ok
16:44:10.0964 0x1668  TermService - ok
16:44:10.0973 0x1668  Themes - ok
16:44:10.0981 0x1668  TieringEngineService - ok
16:44:10.0990 0x1668  tiledatamodelsvc - ok
16:44:10.0997 0x1668  TimeBrokerSvc - ok
16:44:11.0006 0x1668  TPM - ok
16:44:11.0014 0x1668  TrkWks - ok
16:44:11.0021 0x1668  TrustedInstaller - ok
16:44:11.0034 0x1668  tsusbflt - ok
16:44:11.0042 0x1668  TsUsbGD - ok
16:44:11.0051 0x1668  tunnel - ok
16:44:11.0060 0x1668  tzautoupdate - ok
16:44:11.0067 0x1668  UASPStor - ok
16:44:11.0076 0x1668  UcmCx0101 - ok
16:44:11.0087 0x1668  UcmTcpciCx0101 - ok
16:44:11.0095 0x1668  UcmUcsi - ok
16:44:11.0103 0x1668  Ucx01000 - ok
16:44:11.0110 0x1668  UdeCx - ok
16:44:11.0117 0x1668  udfs - ok
16:44:11.0126 0x1668  UEFI - ok
16:44:11.0135 0x1668  Ufx01000 - ok
16:44:11.0143 0x1668  UfxChipidea - ok
16:44:11.0151 0x1668  ufxsynopsys - ok
16:44:11.0168 0x1668  UI0Detect - ok
16:44:11.0177 0x1668  umbus - ok
16:44:11.0185 0x1668  UmPass - ok
16:44:11.0193 0x1668  UmRdpService - ok
16:44:11.0201 0x1668  UnistoreSvc - ok
16:44:11.0212 0x1668  upnphost - ok
16:44:11.0221 0x1668  UrsChipidea - ok
16:44:11.0229 0x1668  UrsCx01000 - ok
16:44:11.0237 0x1668  UrsSynopsys - ok
16:44:11.0245 0x1668  usbccgp - ok
16:44:11.0254 0x1668  usbcir - ok
16:44:11.0263 0x1668  usbehci - ok
16:44:11.0273 0x1668  usbhub - ok
16:44:11.0283 0x1668  USBHUB3 - ok
16:44:11.0292 0x1668  usbohci - ok
16:44:11.0298 0x1668  usbprint - ok
16:44:11.0306 0x1668  usbser - ok
16:44:11.0315 0x1668  USBSTOR - ok
16:44:11.0323 0x1668  usbuhci - ok
16:44:11.0330 0x1668  USBXHCI - ok
16:44:11.0345 0x1668  UserDataSvc - ok
16:44:11.0357 0x1668  UserManager - ok
16:44:11.0367 0x1668  UsoSvc - ok
16:44:11.0374 0x1668  VaultSvc - ok
16:44:11.0384 0x1668  vdrvroot - ok
16:44:11.0392 0x1668  vds - ok
16:44:11.0398 0x1668  VerifierExt - ok
16:44:11.0407 0x1668  vhdmp - ok
16:44:11.0414 0x1668  vhf - ok
16:44:11.0423 0x1668  vmbus - ok
16:44:11.0430 0x1668  VMBusHID - ok
16:44:11.0439 0x1668  vmgid - ok
16:44:11.0447 0x1668  vmicguestinterface - ok
16:44:11.0456 0x1668  vmicheartbeat - ok
16:44:11.0464 0x1668  vmickvpexchange - ok
16:44:11.0474 0x1668  vmicrdv - ok
16:44:11.0480 0x1668  vmicshutdown - ok
16:44:11.0488 0x1668  vmictimesync - ok
16:44:11.0495 0x1668  vmicvmsession - ok
16:44:11.0504 0x1668  vmicvss - ok
16:44:11.0512 0x1668  volmgr - ok
16:44:11.0521 0x1668  volmgrx - ok
16:44:11.0528 0x1668  volsnap - ok
16:44:11.0537 0x1668  volume - ok
16:44:11.0544 0x1668  vpci - ok
16:44:11.0553 0x1668  vsmraid - ok
16:44:11.0561 0x1668  VSS - ok
16:44:11.0570 0x1668  VSTXRAID - ok
16:44:11.0579 0x1668  vwifibus - ok
16:44:11.0589 0x1668  vwififlt - ok
16:44:11.0598 0x1668  vwifimp - ok
16:44:11.0608 0x1668  W32Time - ok
16:44:11.0661 0x1668  w3logsvc - ok
16:44:11.0668 0x1668  W3SVC - ok
16:44:11.0676 0x1668  WacomPen - ok
16:44:11.0684 0x1668  WalletService - ok
16:44:11.0691 0x1668  wanarp - ok
16:44:11.0698 0x1668  wanarpv6 - ok
16:44:11.0706 0x1668  WAS - ok
16:44:11.0714 0x1668  wbengine - ok
16:44:11.0723 0x1668  WbioSrvc - ok
16:44:11.0730 0x1668  wcifs - ok
16:44:11.0739 0x1668  Wcmsvc - ok
16:44:11.0748 0x1668  wcncsvc - ok
16:44:11.0756 0x1668  wcnfs - ok
16:44:11.0765 0x1668  WdBoot - ok
16:44:11.0775 0x1668  Wdf01000 - ok
16:44:11.0785 0x1668  WdFilter - ok
16:44:11.0795 0x1668  WdiServiceHost - ok
16:44:11.0802 0x1668  WdiSystemHost - ok
16:44:11.0810 0x1668  wdiwifi - ok
16:44:11.0819 0x1668  WdNisDrv - ok
16:44:11.0825 0x1668  WdNisSvc - ok
16:44:11.0835 0x1668  WebClient - ok
16:44:11.0842 0x1668  Wecsvc - ok
16:44:11.0851 0x1668  WEPHOSTSVC - ok
16:44:11.0859 0x1668  wercplsupport - ok
16:44:11.0867 0x1668  WerSvc - ok
16:44:11.0875 0x1668  WFPLWFS - ok
16:44:11.0885 0x1668  WiaRpc - ok
16:44:11.0892 0x1668  WIMMount - ok
16:44:11.0897 0x1668  WinDefend - ok
16:44:11.0915 0x1668  WindowsTrustedRT - ok
16:44:11.0923 0x1668  WindowsTrustedRTProxy - ok
16:44:11.0933 0x1668  WinHttpAutoProxySvc - ok
16:44:11.0942 0x1668  WinMad - ok
16:44:11.0955 0x1668  Winmgmt - ok
16:44:11.0962 0x1668  WinRM - ok
16:44:11.0979 0x1668  WINUSB - ok
16:44:11.0986 0x1668  WinVerbs - ok
16:44:11.0994 0x1668  wisvc - ok
16:44:12.0003 0x1668  WlanSvc - ok
16:44:12.0011 0x1668  wlidsvc - ok
16:44:12.0019 0x1668  WmiAcpi - ok
16:44:12.0031 0x1668  wmiApSrv - ok
16:44:12.0038 0x1668  WMPNetworkSvc - ok
16:44:12.0047 0x1668  Wof - ok
16:44:12.0060 0x1668  workfolderssvc - ok
16:44:12.0068 0x1668  WPDBusEnum - ok
16:44:12.0078 0x1668  WpdUpFltr - ok
16:44:12.0087 0x1668  WpnService - ok
16:44:12.0095 0x1668  WpnUserService - ok
16:44:12.0108 0x1668  ws2ifsl - ok
16:44:12.0116 0x1668  wscsvc - ok
16:44:12.0124 0x1668  WSDPrintDevice - ok
16:44:12.0131 0x1668  WSearch - ok
16:44:12.0143 0x1668  wuauserv - ok
16:44:12.0151 0x1668  WudfPf - ok
16:44:12.0158 0x1668  WUDFRd - ok
16:44:12.0167 0x1668  wudfsvc - ok
16:44:12.0174 0x1668  WUDFWpdFs - ok
16:44:12.0184 0x1668  WwanSvc - ok
16:44:12.0192 0x1668  XblAuthManager - ok
16:44:12.0201 0x1668  XblGameSave - ok
16:44:12.0209 0x1668  xboxgip - ok
16:44:12.0218 0x1668  XboxNetApiSvc - ok
16:44:12.0226 0x1668  xinputhid - ok
16:44:12.0231 0x1668  ================ Scan global ===============================
16:44:12.0262 0x1668  [ Global ] - ok
16:44:12.0262 0x1668  ================ Scan MBR ==================================
16:44:12.0267 0x1668  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:44:12.0421 0x1668  \Device\Harddisk0\DR0 - ok
16:44:12.0439 0x1668  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
16:44:12.0451 0x1668  \Device\Harddisk1\DR1 - ok
16:44:12.0452 0x1668  ================ Scan VBR ==================================
16:44:12.0453 0x1668  [ 014AFD868BD0049D18D642FD5BC2F6E2 ] \Device\Harddisk0\DR0\Partition1
16:44:12.0455 0x1668  \Device\Harddisk0\DR0\Partition1 - ok
16:44:12.0460 0x1668  [ 5520853F5E4F50F2882077AEDDAB2738 ] \Device\Harddisk0\DR0\Partition2
16:44:12.0462 0x1668  \Device\Harddisk0\DR0\Partition2 - ok
16:44:12.0468 0x1668  [ 7FEE470E99E743FD34E26F9BA9BC50D1 ] \Device\Harddisk1\DR1\Partition1
16:44:12.0470 0x1668  \Device\Harddisk1\DR1\Partition1 - ok
16:44:12.0471 0x1668  ================ Scan generic autorun ======================
16:44:12.0476 0x1668  Logitech Download Assistant - ok
16:44:12.0477 0x1668  WindowsDefender - ok
16:44:12.0510 0x1668  [ 4C6AAABB264526A9C845A39AEBB79B69, B27F869E8B44CC5F1F9ADCA53AA848C16D706587ED9C7F995AE59BF9B0426523 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe
16:44:12.0524 0x1668  StartCCC - ok
16:44:12.0554 0x1668  [ 4B5985DC72C3546A890C881A6EA5BE5A, CEB1B4F63517E9E4F7E473A70EE1B1968AD45AD41C6900CE38040F8CF857D98F ] C:\Program Files (x86)\avmwlanstick\FRITZWLANMini.exe
16:44:12.0571 0x1668  AVMWlanClient - ok
16:44:12.0607 0x1668  OneDriveSetup - ok
16:44:12.0610 0x1668  OneDriveSetup - ok
16:44:12.0657 0x1668  [ 49610A409DFAE252AE6A07E400013178, 4191C5BF1BF0E029F58F71BC9B06C1A817FA6250EC6F33C6C680EDE4A2B47F19 ] C:\Users\Julius\AppData\Roaming\Spotify\SpotifyWebHelper.exe
16:44:12.0686 0x1668  Spotify Web Helper - ok
16:44:12.0710 0x1668  [ 1D7DD340E13DF9585EABB849CFC3E11B, 31CCD9753402DC030C641214B4ECB48A757BCD9F427A143A88745C62EFF87766 ] C:\Users\Julius\AppData\Local\Microsoft\OneDrive\OneDrive.exe
16:44:12.0722 0x1668  OneDrive - ok
16:44:12.0724 0x1668  Waiting for KSN requests completion. In queue: 14
16:44:13.0745 0x1668  AV detected via SS2: Windows Defender, C:\Program Files\Windows Defender\MSASCui.exe ( 4.10.14393.187 ), 0x61100 ( enabled : updated )
16:44:13.0751 0x1668  Win FW state via NFP2: enabled ( trusted )
16:44:14.0170 0x1668  ============================================================
16:44:14.0170 0x1668  Scan finished
16:44:14.0170 0x1668  ============================================================
16:44:14.0182 0x0464  Detected object count: 0
16:44:14.0182 0x0464  Actual detected object count: 0