Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Fehlermeldung:"Problem beim Starten von C:\Users\user\AppData\Local\Temp\ch810.exe" (https://www.trojaner-board.de/114755-fehlermeldung-problem-beim-starten-c-users-user-appdata-local-temp-ch810-exe.html)

Ethan_Hunt 11.05.2012 21:58
Da brauchte der PC doch gleich viel länger beim Neustarten als sonst :)

Hier das Ergebnis:

Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files (x86)\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
========== FILES ==========
C:\Program Files (x86)\Ask.com\Updater folder moved successfully.
C:\Program Files (x86)\Ask.com\assets\oobe folder moved successfully.
C:\Program Files (x86)\Ask.com\assets folder moved successfully.
C:\Program Files (x86)\Ask.com folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 425019 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: user
->Temp folder emptied: 24699983 bytes
->Temporary Internet Files folder emptied: 4276936 bytes
->Java cache emptied: 3655688 bytes
->Flash cache emptied: 506 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 52693362 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 749 bytes
RecycleBin emptied: 1421557 bytes
 
Total Files Cleaned = 83,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: user
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.42.3 log created on 05112012_225314

Files\Folders moved on Reboot...
C:\Users\user\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

cosinus 11.05.2012 21:59
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Ethan_Hunt 11.05.2012 22:12
Ich hoffe es hat alles geklappt (er hat einen threat angezeigt - habe deinen Hinweis beachtet und erst einmal nur auf Skip "gedrückt")

Code:
23:05:37.0250 2204        TDSS rootkit removing tool 2.7.34.0 May  2 2012 09:59:18
23:05:37.0403 2204        ============================================================
23:05:37.0403 2204        Current date / time: 2012/05/11 23:05:37.0403
23:05:37.0403 2204        SystemInfo:
23:05:37.0403 2204       
23:05:37.0403 2204        OS Version: 6.1.7601 ServicePack: 1.0
23:05:37.0404 2204        Product type: Workstation
23:05:37.0404 2204        ComputerName: ****
23:05:37.0404 2204        UserName: user
23:05:37.0404 2204        Windows directory: C:\Windows
23:05:37.0404 2204        System windows directory: C:\Windows
23:05:37.0404 2204        Running under WOW64
23:05:37.0404 2204        Processor architecture: Intel x64
23:05:37.0404 2204        Number of processors: 4
23:05:37.0404 2204        Page size: 0x1000
23:05:37.0404 2204        Boot type: Normal boot
23:05:37.0404 2204        ============================================================
23:05:38.0352 2204        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:05:38.0362 2204        Drive \Device\Harddisk2\DR2 - Size: 0x7AC00000 (1.92 Gb), SectorSize: 0x200, Cylinders: 0xFA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
23:05:38.0422 2204        ============================================================
23:05:38.0422 2204        \Device\Harddisk0\DR0:
23:05:38.0422 2204        MBR partitions:
23:05:38.0422 2204        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1D4C800, BlocksNum 0x394E9000
23:05:38.0422 2204        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3B235800, BlocksNum 0x394D0800
23:05:38.0422 2204        ============================================================
23:05:38.0431 2204        C: <-> \Device\Harddisk0\DR0\Partition0
23:05:38.0465 2204        D: <-> \Device\Harddisk0\DR0\Partition1
23:05:38.0465 2204        ============================================================
23:05:38.0465 2204        Initialize success
23:05:38.0465 2204        ============================================================
23:06:12.0852 1388        ============================================================
23:06:12.0852 1388        Scan started
23:06:12.0852 1388        Mode: Manual; SigCheck; TDLFS;
23:06:12.0852 1388        ============================================================
23:06:14.0080 1388        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
23:06:14.0174 1388        1394ohci - ok
23:06:14.0266 1388        ACDaemon        (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
23:06:14.0303 1388        ACDaemon - ok
23:06:14.0355 1388        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
23:06:14.0370 1388        ACPI - ok
23:06:14.0402 1388        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
23:06:14.0441 1388        AcpiPmi - ok
23:06:14.0522 1388        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
23:06:14.0531 1388        AdobeARMservice - ok
23:06:14.0652 1388        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
23:06:14.0666 1388        AdobeFlashPlayerUpdateSvc - ok
23:06:14.0734 1388        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
23:06:14.0757 1388        adp94xx - ok
23:06:14.0799 1388        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
23:06:14.0817 1388        adpahci - ok
23:06:14.0831 1388        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
23:06:14.0845 1388        adpu320 - ok
23:06:14.0867 1388        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
23:06:14.0918 1388        AeLookupSvc - ok
23:06:14.0988 1388        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
23:06:15.0031 1388        AFD - ok
23:06:15.0071 1388        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
23:06:15.0084 1388        agp440 - ok
23:06:15.0111 1388        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
23:06:15.0161 1388        ALG - ok
23:06:15.0198 1388        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
23:06:15.0211 1388        aliide - ok
23:06:15.0223 1388        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
23:06:15.0236 1388        amdide - ok
23:06:15.0260 1388        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
23:06:15.0301 1388        AmdK8 - ok
23:06:15.0384 1388        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
23:06:15.0424 1388        AmdPPM - ok
23:06:15.0498 1388        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
23:06:15.0513 1388        amdsata - ok
23:06:15.0842 1388        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
23:06:15.0858 1388        amdsbs - ok
23:06:15.0945 1388        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
23:06:15.0958 1388        amdxata - ok
23:06:16.0320 1388        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
23:06:16.0332 1388        AntiVirSchedulerService - ok
23:06:16.0380 1388        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
23:06:16.0390 1388        AntiVirService - ok
23:06:16.0430 1388        AntiVirWebService (676894fa57b671fec5c3f05f8929e03b) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
23:06:16.0447 1388        AntiVirWebService - ok
23:06:16.0524 1388        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
23:06:16.0580 1388        AppID - ok
23:06:16.0629 1388        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
23:06:16.0706 1388        AppIDSvc - ok
23:06:16.0741 1388        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
23:06:16.0794 1388        Appinfo - ok
23:06:16.0882 1388        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
23:06:16.0892 1388        Apple Mobile Device - ok
23:06:16.0923 1388        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
23:06:16.0937 1388        arc - ok
23:06:16.0954 1388        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
23:06:16.0969 1388        arcsas - ok
23:06:16.0983 1388        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
23:06:17.0039 1388        AsyncMac - ok
23:06:17.0088 1388        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
23:06:17.0101 1388        atapi - ok
23:06:17.0176 1388        atksgt          (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys
23:06:17.0191 1388        atksgt - ok
23:06:17.0248 1388        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
23:06:17.0313 1388        AudioEndpointBuilder - ok
23:06:17.0320 1388        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
23:06:17.0357 1388        AudioSrv - ok
23:06:17.0408 1388        avgntflt        (26e38b5a58c6c55fafbc563eeddb0867) C:\Windows\system32\DRIVERS\avgntflt.sys
23:06:17.0420 1388        avgntflt - ok
23:06:17.0458 1388        avipbb          (9d1f00beff84cbbf46d7f052bc7e0565) C:\Windows\system32\DRIVERS\avipbb.sys
23:06:17.0470 1388        avipbb - ok
23:06:17.0508 1388        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
23:06:17.0518 1388        avkmgr - ok
23:06:17.0550 1388        avmaudio        (bd39d7cfd9d6a73396b618113a8e8d57) C:\Windows\system32\DRIVERS\avmaudio.sys
23:06:17.0579 1388        avmaudio - ok
23:06:17.0610 1388        avmaura        (bd39d7cfd9d6a73396b618113a8e8d57) C:\Windows\system32\DRIVERS\avmaura.sys
23:06:17.0620 1388        avmaura - ok
23:06:17.0702 1388        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
23:06:17.0793 1388        AxInstSV - ok
23:06:17.0848 1388        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
23:06:17.0898 1388        b06bdrv - ok
23:06:17.0915 1388        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
23:06:17.0949 1388        b57nd60a - ok
23:06:17.0988 1388        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
23:06:18.0008 1388        BDESVC - ok
23:06:18.0026 1388        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
23:06:18.0083 1388        Beep - ok
23:06:18.0157 1388        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
23:06:18.0201 1388        BFE - ok
23:06:18.0250 1388        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
23:06:18.0318 1388        BITS - ok
23:06:18.0364 1388        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
23:06:18.0396 1388        blbdrive - ok
23:06:18.0488 1388        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
23:06:18.0504 1388        Bonjour Service - ok
23:06:18.0543 1388        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
23:06:18.0558 1388        bowser - ok
23:06:18.0584 1388        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
23:06:18.0616 1388        BrFiltLo - ok
23:06:18.0631 1388        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
23:06:18.0648 1388        BrFiltUp - ok
23:06:18.0683 1388        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
23:06:18.0739 1388        Browser - ok
23:06:18.0765 1388        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
23:06:18.0820 1388        Brserid - ok
23:06:18.0837 1388        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
23:06:18.0868 1388        BrSerWdm - ok
23:06:18.0894 1388        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
23:06:18.0920 1388        BrUsbMdm - ok
23:06:18.0934 1388        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
23:06:18.0959 1388        BrUsbSer - ok
23:06:18.0977 1388        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
23:06:19.0004 1388        BTHMODEM - ok
23:06:19.0034 1388        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
23:06:19.0086 1388        bthserv - ok
23:06:19.0113 1388        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
23:06:19.0146 1388        cdfs - ok
23:06:19.0191 1388        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
23:06:19.0222 1388        cdrom - ok
23:06:19.0271 1388        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
23:06:19.0329 1388        CertPropSvc - ok
23:06:19.0361 1388        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
23:06:19.0375 1388        circlass - ok
23:06:19.0411 1388        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
23:06:19.0426 1388        CLFS - ok
23:06:19.0470 1388        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:06:19.0483 1388        clr_optimization_v2.0.50727_32 - ok
23:06:19.0520 1388        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
23:06:19.0533 1388        clr_optimization_v2.0.50727_64 - ok
23:06:19.0582 1388        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:06:19.0594 1388        clr_optimization_v4.0.30319_32 - ok
23:06:19.0620 1388        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
23:06:19.0634 1388        clr_optimization_v4.0.30319_64 - ok
23:06:19.0657 1388        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
23:06:19.0691 1388        CmBatt - ok
23:06:19.0719 1388        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
23:06:19.0732 1388        cmdide - ok
23:06:19.0777 1388        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
23:06:19.0805 1388        CNG - ok
23:06:19.0824 1388        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
23:06:19.0835 1388        Compbatt - ok
23:06:19.0867 1388        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
23:06:19.0897 1388        CompositeBus - ok
23:06:19.0911 1388        COMSysApp - ok
23:06:19.0925 1388        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
23:06:19.0936 1388        crcdisk - ok
23:06:19.0971 1388        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
23:06:20.0021 1388        CryptSvc - ok
23:06:20.0064 1388        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
23:06:20.0114 1388        DcomLaunch - ok
23:06:20.0151 1388        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
23:06:20.0211 1388        defragsvc - ok
23:06:20.0260 1388        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
23:06:20.0313 1388        DfsC - ok
23:06:20.0334 1388        DgiVecp - ok
23:06:20.0396 1388        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
23:06:20.0432 1388        Dhcp - ok
23:06:20.0450 1388        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
23:06:20.0485 1388        discache - ok
23:06:20.0511 1388        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
23:06:20.0522 1388        Disk - ok
23:06:20.0557 1388        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
23:06:20.0608 1388        Dnscache - ok
23:06:20.0651 1388        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
23:06:20.0704 1388        dot3svc - ok
23:06:20.0749 1388        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
23:06:20.0783 1388        Dot4 - ok
23:06:20.0827 1388        Dot4Print      (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\DRIVERS\Dot4Prt.sys
23:06:20.0862 1388        Dot4Print - ok
23:06:20.0892 1388        dot4usb        (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
23:06:20.0922 1388        dot4usb - ok
23:06:20.0962 1388        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
23:06:21.0014 1388        DPS - ok
23:06:21.0047 1388        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
23:06:21.0079 1388        drmkaud - ok
23:06:21.0338 1388        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
23:06:21.0366 1388        DXGKrnl - ok
23:06:21.0396 1388        e1yexpress      (50ad8fc1dc800ff36087994c8f7fdff2) C:\Windows\system32\DRIVERS\e1y60x64.sys
23:06:21.0413 1388        e1yexpress - ok
23:06:21.0434 1388        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
23:06:21.0483 1388        EapHost - ok
23:06:21.0639 1388        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
23:06:21.0713 1388        ebdrv - ok
23:06:21.0808 1388        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
23:06:21.0863 1388        EFS - ok
23:06:21.0934 1388        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
23:06:21.0973 1388        ehRecvr - ok
23:06:21.0999 1388        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
23:06:22.0043 1388        ehSched - ok
23:06:22.0114 1388        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
23:06:22.0137 1388        elxstor - ok
23:06:22.0161 1388        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
23:06:22.0193 1388        ErrDev - ok
23:06:22.0242 1388        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
23:06:22.0301 1388        EventSystem - ok
23:06:22.0326 1388        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
23:06:22.0361 1388        exfat - ok
23:06:22.0382 1388        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
23:06:22.0428 1388        fastfat - ok
23:06:22.0508 1388        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
23:06:22.0536 1388        Fax - ok
23:06:22.0562 1388        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
23:06:22.0575 1388        fdc - ok
23:06:22.0586 1388        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
23:06:22.0642 1388        fdPHost - ok
23:06:22.0665 1388        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
23:06:22.0713 1388        FDResPub - ok
23:06:22.0735 1388        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
23:06:22.0746 1388        FileInfo - ok
23:06:22.0757 1388        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
23:06:22.0813 1388        Filetrace - ok
23:06:22.0845 1388        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
23:06:22.0875 1388        flpydisk - ok
23:06:22.0914 1388        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
23:06:22.0933 1388        FltMgr - ok
23:06:23.0007 1388        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
23:06:23.0068 1388        FontCache - ok
23:06:23.0124 1388        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
23:06:23.0136 1388        FontCache3.0.0.0 - ok
23:06:23.0180 1388        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
23:06:23.0194 1388        FsDepends - ok
23:06:23.0226 1388        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
23:06:23.0238 1388        Fs_Rec - ok
23:06:23.0282 1388        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
23:06:23.0303 1388        fvevol - ok
23:06:23.0318 1388        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
23:06:23.0332 1388        gagp30kx - ok
23:06:23.0382 1388        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
23:06:23.0391 1388        GEARAspiWDM - ok
23:06:23.0444 1388        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
23:06:23.0506 1388        gpsvc - ok
23:06:23.0582 1388        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:06:23.0595 1388        gupdate - ok
23:06:23.0604 1388        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:06:23.0616 1388        gupdatem - ok
23:06:23.0631 1388        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
23:06:23.0681 1388        hcw85cir - ok
23:06:23.0736 1388        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
23:06:23.0771 1388        HdAudAddService - ok
23:06:23.0802 1388        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
23:06:23.0833 1388        HDAudBus - ok
23:06:23.0857 1388        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
23:06:23.0885 1388        HidBatt - ok
23:06:23.0902 1388        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
23:06:23.0937 1388        HidBth - ok
23:06:23.0958 1388        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
23:06:23.0993 1388        HidIr - ok
23:06:24.0013 1388        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
23:06:24.0069 1388        hidserv - ok
23:06:24.0128 1388        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
23:06:24.0143 1388        HidUsb - ok
23:06:24.0178 1388        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
23:06:24.0231 1388        hkmsvc - ok
23:06:24.0273 1388        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
23:06:24.0314 1388        HomeGroupListener - ok
23:06:24.0351 1388        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
23:06:24.0381 1388        HomeGroupProvider - ok
23:06:24.0437 1388        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
23:06:24.0451 1388        HpSAMD - ok
23:06:24.0521 1388        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
23:06:24.0579 1388        HTTP - ok
23:06:24.0611 1388        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
23:06:24.0622 1388        hwpolicy - ok
23:06:24.0655 1388        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
23:06:24.0668 1388        i8042prt - ok
23:06:24.0711 1388        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
23:06:24.0729 1388        iaStorV - ok
23:06:24.0811 1388        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
23:06:24.0816 1388        IDriverT ( UnsignedFile.Multi.Generic ) - warning
23:06:24.0816 1388        IDriverT - detected UnsignedFile.Multi.Generic (1)
23:06:24.0900 1388        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
23:06:24.0925 1388        idsvc - ok
23:06:25.0014 1388        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
23:06:25.0029 1388        iirsp - ok
23:06:25.0093 1388        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
23:06:25.0158 1388        IKEEXT - ok
23:06:25.0190 1388        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
23:06:25.0201 1388        intelide - ok
23:06:25.0229 1388        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
23:06:25.0257 1388        intelppm - ok
23:06:25.0290 1388        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
23:06:25.0341 1388        IPBusEnum - ok
23:06:25.0366 1388        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:06:25.0398 1388        IpFilterDriver - ok
23:06:25.0453 1388        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
23:06:25.0468 1388        IPMIDRV - ok
23:06:25.0515 1388        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
23:06:25.0574 1388        IPNAT - ok
23:06:25.0683 1388        iPod Service    (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe
23:06:25.0706 1388        iPod Service - ok
23:06:25.0723 1388        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
23:06:25.0756 1388        IRENUM - ok
23:06:25.0805 1388        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
23:06:25.0818 1388        isapnp - ok
23:06:25.0855 1388        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
23:06:25.0874 1388        iScsiPrt - ok
23:06:25.0895 1388        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
23:06:25.0907 1388        kbdclass - ok
23:06:25.0919 1388        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
23:06:25.0950 1388        kbdhid - ok
23:06:25.0974 1388        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:06:25.0987 1388        KeyIso - ok
23:06:26.0002 1388        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
23:06:26.0015 1388        KSecDD - ok
23:06:26.0029 1388        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
23:06:26.0041 1388        KSecPkg - ok
23:06:26.0063 1388        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
23:06:26.0109 1388        ksthunk - ok
23:06:26.0162 1388        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
23:06:26.0221 1388        KtmRm - ok
23:06:26.0282 1388        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
23:06:26.0336 1388        LanmanServer - ok
23:06:26.0417 1388        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
23:06:26.0472 1388        LanmanWorkstation - ok
23:06:26.0538 1388        lirsgt          (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys
23:06:26.0549 1388        lirsgt - ok
23:06:26.0580 1388        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
23:06:26.0620 1388        lltdio - ok
23:06:26.0658 1388        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
23:06:26.0698 1388        lltdsvc - ok
23:06:26.0707 1388        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
23:06:26.0740 1388        lmhosts - ok
23:06:26.0764 1388        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
23:06:26.0777 1388        LSI_FC - ok
23:06:26.0790 1388        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
23:06:26.0802 1388        LSI_SAS - ok
23:06:26.0812 1388        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
23:06:26.0824 1388        LSI_SAS2 - ok
23:06:26.0849 1388        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
23:06:26.0862 1388        LSI_SCSI - ok
23:06:26.0886 1388        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
23:06:26.0920 1388        luafv - ok
23:06:26.0976 1388        lvpopf64        (c586cc39820b6e7fe3657fed8329d300) C:\Windows\system32\DRIVERS\lvpopf64.sys
23:06:26.0991 1388        lvpopf64 - ok
23:06:27.0031 1388        LVPr2M64        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
23:06:27.0040 1388        LVPr2M64 - ok
23:06:27.0054 1388        LVPr2Mon        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
23:06:27.0063 1388        LVPr2Mon - ok
23:06:27.0154 1388        LVPrcS64        (9cd0dc863be5d40a762f7d84f11a8471) C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
23:06:27.0166 1388        LVPrcS64 - ok
23:06:27.0215 1388        LVRS64          (224ab3850f573a419f921c41a15d7f5b) C:\Windows\system32\DRIVERS\lvrs64.sys
23:06:27.0230 1388        LVRS64 - ok
23:06:27.0503 1388        LVUVC64        (bfba84b8a9c233ae42b11cf7bdfc6c01) C:\Windows\system32\DRIVERS\lvuvc64.sys
23:06:27.0617 1388        LVUVC64 - ok
23:06:27.0703 1388        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
23:06:27.0737 1388        Mcx2Svc - ok
23:06:27.0782 1388        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
23:06:27.0796 1388        megasas - ok
23:06:27.0820 1388        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
23:06:27.0838 1388        MegaSR - ok
23:06:27.0928 1388        Microsoft Office Groove Audit Service (123271bd5237ab991dc5c21fdf8835eb) C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
23:06:27.0940 1388        Microsoft Office Groove Audit Service - ok
23:06:27.0965 1388        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
23:06:28.0005 1388        MMCSS - ok
23:06:28.0020 1388        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
23:06:28.0053 1388        Modem - ok
23:06:28.0071 1388        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
23:06:28.0103 1388        monitor - ok
23:06:28.0149 1388        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
23:06:28.0160 1388        mouclass - ok
23:06:28.0172 1388        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
23:06:28.0183 1388        mouhid - ok
23:06:28.0212 1388        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
23:06:28.0225 1388        mountmgr - ok
23:06:28.0253 1388        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
23:06:28.0269 1388        mpio - ok
23:06:28.0297 1388        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
23:06:28.0331 1388        mpsdrv - ok
23:06:28.0417 1388        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
23:06:28.0482 1388        MpsSvc - ok
23:06:28.0509 1388        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
23:06:28.0538 1388        MRxDAV - ok
23:06:28.0571 1388        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
23:06:28.0604 1388        mrxsmb - ok
23:06:28.0647 1388        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:06:28.0682 1388        mrxsmb10 - ok
23:06:28.0702 1388        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:06:28.0716 1388        mrxsmb20 - ok
23:06:28.0748 1388        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
23:06:28.0761 1388        msahci - ok
23:06:28.0796 1388        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
23:06:28.0808 1388        msdsm - ok
23:06:28.0833 1388        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
23:06:28.0869 1388        MSDTC - ok
23:06:28.0912 1388        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
23:06:28.0949 1388        Msfs - ok
23:06:28.0962 1388        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
23:06:29.0006 1388        mshidkmdf - ok
23:06:29.0036 1388        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
23:06:29.0048 1388        msisadrv - ok
23:06:29.0079 1388        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
23:06:29.0113 1388        MSiSCSI - ok
23:06:29.0116 1388        msiserver - ok
23:06:29.0129 1388        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
23:06:29.0176 1388        MSKSSRV - ok
23:06:29.0196 1388        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
23:06:29.0249 1388        MSPCLOCK - ok
23:06:29.0279 1388        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
23:06:29.0334 1388        MSPQM - ok
23:06:29.0375 1388        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
23:06:29.0390 1388        MsRPC - ok
23:06:29.0424 1388        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
23:06:29.0434 1388        mssmbios - ok
23:06:29.0500 1388        MSSQL$SQLEXPRESS - ok
23:06:29.0560 1388        MSSQLServerADHelper100 (f1761c8fb2b25a32c6d63e36bb88c3ae) c:\Program Files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
23:06:29.0573 1388        MSSQLServerADHelper100 - ok
23:06:29.0591 1388        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
23:06:29.0639 1388        MSTEE - ok
23:06:29.0943 1388        msvsmon90      (cb4a082af58d1a0969f931816d5cfb05) C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe
23:06:30.0033 1388        msvsmon90 - ok
23:06:30.0138 1388        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
23:06:30.0152 1388        MTConfig - ok
23:06:30.0169 1388        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
23:06:30.0184 1388        Mup - ok
23:06:30.0232 1388        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
23:06:30.0288 1388        napagent - ok
23:06:30.0339 1388        NasPmService - ok
23:06:30.0377 1388        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
23:06:30.0412 1388        NativeWifiP - ok
23:06:30.0501 1388        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
23:06:30.0530 1388        NDIS - ok
23:06:30.0540 1388        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
23:06:30.0573 1388        NdisCap - ok
23:06:30.0588 1388        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
23:06:30.0634 1388        NdisTapi - ok
23:06:30.0682 1388        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
23:06:30.0732 1388        Ndisuio - ok
23:06:30.0768 1388        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
23:06:30.0827 1388        NdisWan - ok
23:06:30.0853 1388        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
23:06:30.0902 1388        NDProxy - ok
23:06:30.0935 1388        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
23:06:30.0985 1388        NetBIOS - ok
23:06:31.0023 1388        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
23:06:31.0074 1388        NetBT - ok
23:06:31.0098 1388        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:06:31.0110 1388        Netlogon - ok
23:06:31.0141 1388        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
23:06:31.0191 1388        Netman - ok
23:06:31.0212 1388        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
23:06:31.0257 1388        netprofm - ok
23:06:31.0307 1388        netr28x        (b72bb9496a126fcfc7fc5945ded9b411) C:\Windows\system32\DRIVERS\netr28x.sys
23:06:31.0345 1388        netr28x - ok
23:06:31.0477 1388        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
23:06:31.0489 1388        NetTcpPortSharing - ok
23:06:31.0651 1388        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
23:06:31.0666 1388        nfrd960 - ok
23:06:31.0821 1388        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
23:06:31.0871 1388        NlaSvc - ok
23:06:31.0894 1388        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
23:06:31.0926 1388        Npfs - ok
23:06:31.0945 1388        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
23:06:32.0001 1388        nsi - ok
23:06:32.0016 1388        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
23:06:32.0064 1388        nsiproxy - ok
23:06:32.0157 1388        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
23:06:32.0194 1388        Ntfs - ok
23:06:32.0288 1388        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
23:06:32.0326 1388        Null - ok
23:06:32.0859 1388        nvlddmkm        (aaf5559039e99d0cc22e25255f3dc06e) C:\Windows\system32\DRIVERS\nvlddmkm.sys
23:06:33.0039 1388        nvlddmkm - ok
23:06:33.0157 1388        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
23:06:33.0172 1388        nvraid - ok
23:06:33.0188 1388        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
23:06:33.0204 1388        nvstor - ok
23:06:33.0235 1388        nvsvc          (c20f9e2deec656c67f7986dd3a50ec62) C:\Windows\system32\nvvsvc.exe
23:06:33.0247 1388        nvsvc - ok
23:06:33.0265 1388        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
23:06:33.0279 1388        nv_agp - ok
23:06:33.0387 1388        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
23:06:33.0406 1388        odserv - ok
23:06:33.0436 1388        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
23:06:33.0466 1388        ohci1394 - ok
23:06:33.0519 1388        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
23:06:33.0532 1388        ose - ok
23:06:33.0573 1388        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
23:06:33.0621 1388        p2pimsvc - ok
23:06:33.0654 1388        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
23:06:33.0673 1388        p2psvc - ok
23:06:33.0707 1388        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
23:06:33.0721 1388        Parport - ok
23:06:33.0751 1388        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
23:06:33.0764 1388        partmgr - ok
23:06:33.0783 1388        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
23:06:33.0817 1388        PcaSvc - ok
23:06:33.0854 1388        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
23:06:33.0870 1388        pci - ok
23:06:33.0881 1388        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
23:06:33.0892 1388        pciide - ok
23:06:33.0913 1388        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
23:06:33.0927 1388        pcmcia - ok
23:06:33.0943 1388        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
23:06:33.0954 1388        pcw - ok
23:06:33.0992 1388        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
23:06:34.0042 1388        PEAUTH - ok
23:06:34.0114 1388        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
23:06:34.0147 1388        PerfHost - ok
23:06:34.0272 1388        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
23:06:34.0334 1388        pla - ok
23:06:34.0396 1388        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
23:06:34.0425 1388        PlugPlay - ok
23:06:34.0453 1388        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
23:06:34.0485 1388        PNRPAutoReg - ok
23:06:34.0515 1388        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
23:06:34.0531 1388        PNRPsvc - ok
23:06:34.0580 1388        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
23:06:34.0639 1388        PolicyAgent - ok
23:06:34.0667 1388        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
23:06:34.0717 1388        Power - ok
23:06:34.0785 1388        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
23:06:34.0822 1388        PptpMiniport - ok
23:06:34.0843 1388        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
23:06:34.0869 1388        Processor - ok
23:06:34.0897 1388        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
23:06:34.0941 1388        ProfSvc - ok
23:06:34.0972 1388        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:06:34.0985 1388        ProtectedStorage - ok
23:06:35.0028 1388        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
23:06:35.0065 1388        Psched - ok
23:06:35.0140 1388        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
23:06:35.0175 1388        ql2300 - ok
23:06:35.0279 1388        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
23:06:35.0294 1388        ql40xx - ok
23:06:35.0324 1388        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
23:06:35.0360 1388        QWAVE - ok
23:06:35.0378 1388        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
23:06:35.0406 1388        QWAVEdrv - ok
23:06:35.0420 1388        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
23:06:35.0455 1388        RasAcd - ok
23:06:35.0483 1388        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
23:06:35.0514 1388        RasAgileVpn - ok
23:06:35.0530 1388        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
23:06:35.0580 1388        RasAuto - ok
23:06:35.0609 1388        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
23:06:35.0660 1388        Rasl2tp - ok
23:06:35.0727 1388        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
23:06:35.0785 1388        RasMan - ok
23:06:35.0820 1388        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
23:06:35.0877 1388        RasPppoe - ok
23:06:35.0899 1388        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
23:06:35.0946 1388        RasSstp - ok
23:06:35.0989 1388        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
23:06:36.0048 1388        rdbss - ok
23:06:36.0065 1388        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
23:06:36.0094 1388        rdpbus - ok
23:06:36.0115 1388        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
23:06:36.0148 1388        RDPCDD - ok
23:06:36.0163 1388        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
23:06:36.0210 1388        RDPENCDD - ok
23:06:36.0227 1388        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
23:06:36.0259 1388        RDPREFMP - ok
23:06:36.0299 1388        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
23:06:36.0352 1388        RDPWD - ok
23:06:36.0399 1388        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
23:06:36.0416 1388        rdyboost - ok
23:06:36.0448 1388        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
23:06:36.0505 1388        RemoteAccess - ok
23:06:36.0530 1388        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
23:06:36.0580 1388        RemoteRegistry - ok
23:06:36.0599 1388        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
23:06:36.0652 1388        RpcEptMapper - ok
23:06:36.0675 1388        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
23:06:36.0704 1388        RpcLocator - ok
23:06:36.0746 1388        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
23:06:36.0786 1388        RpcSs - ok
23:06:36.0877 1388        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
23:06:36.0929 1388        rspndr - ok
23:06:36.0968 1388        SaiK0836        (2b44ff231cac210a32904c310fb476cd) C:\Windows\system32\DRIVERS\SaiK0836.sys
23:06:36.0980 1388        SaiK0836 - ok
23:06:37.0008 1388        SaiMini        (793c2c61357a38351aceee5df12e56b5) C:\Windows\system32\DRIVERS\SaiMini.sys
23:06:37.0015 1388        SaiMini - ok
23:06:37.0020 1388        SaiNtBus        (432284f4bdd98073c5d1b657c3855c0f) C:\Windows\system32\drivers\SaiBus.sys
23:06:37.0029 1388        SaiNtBus - ok
23:06:37.0056 1388        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:06:37.0068 1388        SamSs - ok
23:06:37.0103 1388        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
23:06:37.0116 1388        sbp2port - ok
23:06:37.0150 1388        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
23:06:37.0200 1388        SCardSvr - ok
23:06:37.0224 1388        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
23:06:37.0254 1388        scfilter - ok
23:06:37.0327 1388        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
23:06:37.0377 1388        Schedule - ok
23:06:37.0411 1388        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
23:06:37.0441 1388        SCPolicySvc - ok
23:06:37.0479 1388        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
23:06:37.0517 1388        SDRSVC - ok
23:06:37.0567 1388        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
23:06:37.0615 1388        secdrv - ok
23:06:37.0643 1388        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
23:06:37.0689 1388        seclogon - ok
23:06:37.0713 1388        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
23:06:37.0763 1388        SENS - ok
23:06:37.0785 1388        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
23:06:37.0806 1388        SensrSvc - ok
23:06:37.0828 1388        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
23:06:37.0839 1388        Serenum - ok
23:06:37.0862 1388        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
23:06:37.0891 1388        Serial - ok
23:06:37.0921 1388        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
23:06:37.0932 1388        sermouse - ok
23:06:37.0971 1388        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
23:06:38.0016 1388        SessionEnv - ok
23:06:38.0046 1388        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
23:06:38.0084 1388        sffdisk - ok
23:06:38.0092 1388        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
23:06:38.0123 1388        sffp_mmc - ok
23:06:38.0126 1388        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
23:06:38.0149 1388        sffp_sd - ok
23:06:38.0189 1388        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
23:06:38.0200 1388        sfloppy - ok
23:06:38.0243 1388        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
23:06:38.0302 1388        SharedAccess - ok
23:06:38.0351 1388        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
23:06:38.0402 1388        ShellHWDetection - ok
23:06:38.0439 1388        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
23:06:38.0452 1388        SiSRaid2 - ok
23:06:38.0469 1388        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
23:06:38.0481 1388        SiSRaid4 - ok
23:06:38.0502 1388        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
23:06:38.0534 1388        Smb - ok
23:06:38.0557 1388        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
23:06:38.0589 1388        SNMPTRAP - ok
23:06:38.0592 1388        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
23:06:38.0603 1388        spldr - ok
23:06:38.0655 1388        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
23:06:38.0691 1388        Spooler - ok
23:06:38.0852 1388        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
23:06:38.0940 1388        sppsvc - ok
23:06:39.0029 1388        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
23:06:39.0084 1388        sppuinotify - ok
23:06:39.0186 1388        SQLAgent$SQLEXPRESS (eb2fd937449b7aceb39372f875eb8e78) c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE
23:06:39.0203 1388        SQLAgent$SQLEXPRESS - ok
23:06:39.0250 1388        SQLBrowser      (99de6acfa5ca83fad6a765c81c6f129f) c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
23:06:39.0267 1388        SQLBrowser - ok
23:06:39.0320 1388        SQLWriter      (6d65985945b03ca59b67d0b73702fc7b) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
23:06:39.0334 1388        SQLWriter - ok
23:06:39.0400 1388        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
23:06:39.0439 1388        srv - ok
23:06:39.0477 1388        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
23:06:39.0513 1388        srv2 - ok
23:06:39.0541 1388        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
23:06:39.0574 1388        srvnet - ok
23:06:39.0617 1388        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
23:06:39.0671 1388        SSDPSRV - ok
23:06:39.0674 1388        SSPORT - ok
23:06:39.0718 1388        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
23:06:39.0753 1388        SstpSvc - ok
23:06:39.0778 1388        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
23:06:39.0789 1388        stexstor - ok
23:06:39.0855 1388        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
23:06:39.0883 1388        stisvc - ok
23:06:39.0908 1388        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
23:06:39.0919 1388        swenum - ok
23:06:39.0961 1388        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
23:06:40.0018 1388        swprv - ok
23:06:40.0120 1388        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
23:06:40.0173 1388        SysMain - ok
23:06:40.0252 1388        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
23:06:40.0274 1388        TabletInputService - ok
23:06:40.0303 1388        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
23:06:40.0349 1388        TapiSrv - ok
23:06:40.0378 1388        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
23:06:40.0430 1388        TBS - ok
23:06:40.0565 1388        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
23:06:40.0612 1388        Tcpip - ok
23:06:40.0798 1388        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
23:06:40.0835 1388        TCPIP6 - ok
23:06:40.0888 1388        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
23:06:40.0933 1388        tcpipreg - ok
23:06:40.0963 1388        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
23:06:40.0975 1388        TDPIPE - ok
23:06:41.0006 1388        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
23:06:41.0038 1388        TDTCP - ok
23:06:41.0074 1388        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
23:06:41.0127 1388        tdx - ok
23:06:41.0334 1388        TeamViewer7    (74fc70ae64a7b7dabec9697ce0a1f4fa) C:\Users\user\temp\TeamViewer\Version7\TeamViewer_Service.exe
23:06:41.0383 1388        TeamViewer7 - ok
23:06:41.0488 1388        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
23:06:41.0502 1388        TermDD - ok
23:06:41.0553 1388        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
23:06:41.0608 1388        TermService - ok
23:06:41.0631 1388        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
23:06:41.0663 1388        Themes - ok
23:06:41.0696 1388        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
23:06:41.0729 1388        THREADORDER - ok
23:06:41.0738 1388        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
23:06:41.0786 1388        TrkWks - ok
23:06:41.0835 1388        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
23:06:41.0887 1388        TrustedInstaller - ok
23:06:41.0918 1388        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
23:06:41.0949 1388        tssecsrv - ok
23:06:41.0985 1388        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
23:06:42.0007 1388        TsUsbFlt - ok
23:06:42.0060 1388        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
23:06:42.0113 1388        tunnel - ok
23:06:42.0145 1388        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
23:06:42.0158 1388        uagp35 - ok
23:06:42.0199 1388        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
23:06:42.0251 1388        udfs - ok
23:06:42.0286 1388        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
23:06:42.0299 1388        UI0Detect - ok
23:06:42.0332 1388        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
23:06:42.0344 1388        uliagpkx - ok
23:06:42.0387 1388        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
23:06:42.0402 1388        umbus - ok
23:06:42.0425 1388        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
23:06:42.0438 1388        UmPass - ok
23:06:42.0465 1388        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
23:06:42.0526 1388        upnphost - ok
23:06:42.0576 1388        USBAAPL64      (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys
23:06:42.0619 1388        USBAAPL64 - ok
23:06:42.0659 1388        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
23:06:42.0695 1388        usbaudio - ok
23:06:42.0734 1388        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
23:06:42.0784 1388        usbccgp - ok
23:06:42.0798 1388        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
23:06:42.0816 1388        usbcir - ok
23:06:42.0828 1388        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
23:06:42.0858 1388        usbehci - ok
23:06:42.0914 1388        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
23:06:42.0947 1388        usbhub - ok
23:06:43.0043 1388        USBMULCD        (f9b3054339a71f16430f6585ebc8be96) C:\Windows\system32\drivers\CM10664.sys
23:06:43.0097 1388        USBMULCD - ok
23:06:43.0110 1388        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
23:06:43.0139 1388        usbohci - ok
23:06:43.0167 1388        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
23:06:43.0197 1388        usbprint - ok
23:06:43.0230 1388        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
23:06:43.0245 1388        usbscan - ok
23:06:43.0274 1388        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:06:43.0321 1388        USBSTOR - ok
23:06:43.0335 1388        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
23:06:43.0368 1388        usbuhci - ok
23:06:43.0387 1388        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
23:06:43.0420 1388        UxSms - ok
23:06:43.0446 1388        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
23:06:43.0457 1388        VaultSvc - ok
23:06:43.0490 1388        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
23:06:43.0503 1388        vdrvroot - ok
23:06:43.0550 1388        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
23:06:43.0602 1388        vds - ok
23:06:43.0632 1388        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
23:06:43.0646 1388        vga - ok
23:06:43.0659 1388        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
23:06:43.0707 1388        VgaSave - ok
23:06:43.0743 1388        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
23:06:43.0756 1388        vhdmp - ok
23:06:43.0784 1388        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
23:06:43.0797 1388        viaide - ok
23:06:43.0808 1388        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
23:06:43.0821 1388        volmgr - ok
23:06:43.0869 1388        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
23:06:43.0886 1388        volmgrx - ok
23:06:43.0913 1388        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
23:06:43.0928 1388        volsnap - ok
23:06:43.0957 1388        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
23:06:43.0970 1388        vsmraid - ok
23:06:44.0058 1388        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
23:06:44.0125 1388        VSS - ok
23:06:44.0237 1388        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
23:06:44.0271 1388        vwifibus - ok
23:06:44.0298 1388        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
23:06:44.0317 1388        vwififlt - ok
23:06:44.0336 1388        vwifimp        (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
23:06:44.0352 1388        vwifimp - ok
23:06:44.0380 1388        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
23:06:44.0417 1388        W32Time - ok
23:06:44.0430 1388        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
23:06:44.0456 1388        WacomPen - ok
23:06:44.0502 1388        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
23:06:44.0556 1388        WANARP - ok
23:06:44.0559 1388        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
23:06:44.0592 1388        Wanarpv6 - ok
23:06:44.0674 1388        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
23:06:44.0715 1388        wbengine - ok
23:06:44.0797 1388        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
23:06:44.0819 1388        WbioSrvc - ok
23:06:44.0858 1388        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
23:06:44.0898 1388        wcncsvc - ok
23:06:44.0920 1388        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
23:06:44.0946 1388        WcsPlugInService - ok
23:06:44.0987 1388        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
23:06:45.0000 1388        Wd - ok
23:06:45.0039 1388        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
23:06:45.0064 1388        Wdf01000 - ok
23:06:45.0081 1388        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
23:06:45.0153 1388        WdiServiceHost - ok
23:06:45.0156 1388        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
23:06:45.0174 1388        WdiSystemHost - ok
23:06:45.0215 1388        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
23:06:45.0254 1388        WebClient - ok
23:06:45.0287 1388        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
23:06:45.0341 1388        Wecsvc - ok
23:06:45.0362 1388        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
23:06:45.0407 1388        wercplsupport - ok
23:06:45.0442 1388        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
23:06:45.0475 1388        WerSvc - ok
23:06:45.0513 1388        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
23:06:45.0545 1388        WfpLwf - ok
23:06:45.0553 1388        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
23:06:45.0565 1388        WIMMount - ok
23:06:45.0569 1388        WinHttpAutoProxySvc - ok
23:06:45.0622 1388        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
23:06:45.0655 1388        Winmgmt - ok
23:06:45.0753 1388        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
23:06:45.0816 1388        WinRM - ok
23:06:46.0003 1388        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
23:06:46.0038 1388        WinUsb - ok
23:06:46.0103 1388        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
23:06:46.0151 1388        Wlansvc - ok
23:06:46.0310 1388        wlidsvc        (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
23:06:46.0356 1388        wlidsvc - ok
23:06:46.0470 1388        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
23:06:46.0504 1388        WmiAcpi - ok
23:06:46.0553 1388        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
23:06:46.0582 1388        wmiApSrv - ok
23:06:46.0620 1388        WMPNetworkSvc - ok
23:06:46.0637 1388        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
23:06:46.0659 1388        WPCSvc - ok
23:06:46.0696 1388        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
23:06:46.0713 1388        WPDBusEnum - ok
23:06:46.0734 1388        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
23:06:46.0781 1388        ws2ifsl - ok
23:06:46.0826 1388        WSDPrintDevice  (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys
23:06:46.0854 1388        WSDPrintDevice - ok
23:06:46.0859 1388        WSearch - ok
23:06:46.0968 1388        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
23:06:47.0048 1388        wuauserv - ok
23:06:47.0174 1388        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
23:06:47.0220 1388        WudfPf - ok
23:06:47.0249 1388        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
23:06:47.0296 1388        WUDFRd - ok
23:06:47.0328 1388        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
23:06:47.0360 1388        wudfsvc - ok
23:06:47.0385 1388        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
23:06:47.0420 1388        WwanSvc - ok
23:06:47.0497 1388        X6va003 - ok
23:06:47.0525 1388        X6va005 - ok
23:06:47.0576 1388        X6va008 - ok
23:06:47.0663 1388        YahooAUService  (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
23:06:47.0681 1388        YahooAUService - ok
23:06:47.0709 1388        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
23:06:47.0889 1388        \Device\Harddisk0\DR0 - ok
23:06:47.0892 1388        Boot (0x1200)  (0da1dc0ff4ee97dc10e5c1a8660d6ae0) \Device\Harddisk0\DR0\Partition0
23:06:47.0893 1388        \Device\Harddisk0\DR0\Partition0 - ok
23:06:47.0919 1388        Boot (0x1200)  (c23d6699d3e870f6aa8926d198af3019) \Device\Harddisk0\DR0\Partition1
23:06:47.0920 1388        \Device\Harddisk0\DR0\Partition1 - ok
23:06:47.0921 1388        ============================================================
23:06:47.0921 1388        Scan finished
23:06:47.0921 1388        ============================================================
23:06:47.0934 3668        Detected object count: 1
23:06:47.0934 3668        Actual detected object count: 1
23:07:01.0950 3668        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
23:07:01.0950 3668        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 11.05.2012 22:57
Du hast alles richtig gemacht :)

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Ethan_Hunt 12.05.2012 07:39
Guten morgen,

Eine Frage habe ich, bevor ich ComboFix ausführe:
Es ist folgendes Problem aufgetreten und zwar habe ich zuerst Avira deaktiviert allerdings habe ich trotzdem eine Fehlermeldung von ComboFix bekommen, dass Avira noch aktiv sei. Nach weiteren versuchen Avira zu deaktivieren habe ich es jetzt deinstalliert aber dennoch erhalte ich weiterhin die Fehlermeldung, dass Avira noch aktiv sei!

Kann ich ComboFix trotzdem ausführen?

So nachdem ich meinen PC ein zweites Mal neu gestartet habe hat jetzt alles geklappt!
Hier nun das entstandende log:

Code:
Combofix Logfile:

       
Code:

       
ComboFix 12-05-12.01 - user 12.05.2012   9:45.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8191.6825 [GMT 2:00]
ausgeführt von:: c:\users\user\Downloads\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\cflog\CrashLog_20101101.txt
c:\cflog\CrashLog_20101102.txt
c:\cflog\CrashLog_20101217.txt
c:\cflog\CrashLog_20110202.txt
c:\cflog\EPLog.txt
c:\users\user\AppData\Local\lame_enc.dll
c:\users\user\AppData\Local\no23xwrapper.dll
c:\users\user\AppData\Local\ogg.dll
c:\users\user\AppData\Local\vorbis.dll
c:\users\user\AppData\Local\vorbisenc.dll
c:\users\user\AppData\Local\vorbisfile.dll
c:\users\user\AppData\Roaming\.#
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-04-12 bis 2012-05-12  ))))))))))))))))))))))))))))))
.
.
2012-05-12 07:56 . 2012-05-12 07:56        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-05-11 20:53 . 2012-05-11 20:53        --------        d-----w-        C:\_OTL
2012-05-10 16:02 . 2012-05-10 16:02        --------        d-----w-        c:\users\user\AppData\Local\AskToolbar
2012-05-09 13:03 . 2012-05-09 13:03        --------        d-----w-        c:\users\user\workspace
2012-05-09 12:14 . 2012-05-09 12:19        --------        d-----w-        c:\program files\Sandboxie
2012-05-09 11:34 . 2012-05-09 11:34        --------        d-----w-        c:\users\Default\AppData\Local\AskToolbar
2012-05-09 11:33 . 2012-05-12 06:26        --------        d-----w-        c:\programdata\Avira
2012-05-09 10:49 . 2012-03-31 06:05        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-09 10:49 . 2012-03-31 04:39        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-05-09 10:49 . 2012-03-31 04:39        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-05-09 10:49 . 2012-03-31 03:10        3146240        ----a-w-        c:\windows\system32\win32k.sys
2012-05-09 10:49 . 2012-03-03 06:35        1544704        ----a-w-        c:\windows\system32\DWrite.dll
2012-05-09 10:49 . 2012-03-03 05:31        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll
2012-05-09 10:45 . 2012-03-17 07:58        75120        ----a-w-        c:\windows\system32\drivers\partmgr.sys
2012-05-09 10:44 . 2012-03-30 11:35        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-05-09 10:44 . 2012-03-31 05:42        1732096        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2012-05-09 10:44 . 2012-03-31 05:40        1402880        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2012-05-09 10:44 . 2012-03-31 05:40        1367552        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-09 10:44 . 2012-03-31 05:40        1393664        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2012-05-09 10:44 . 2012-03-31 04:29        936960        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-08 19:18 . 2012-05-08 19:18        --------        d-----w-        c:\program files (x86)\ESET
2012-05-08 05:20 . 2012-05-08 05:20        --------        d-----w-        c:\users\user\AppData\Roaming\Malwarebytes
2012-05-08 05:20 . 2012-05-08 05:20        --------        d-----w-        c:\programdata\Malwarebytes
2012-05-08 05:20 . 2012-05-08 05:20        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-05-08 05:20 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-05-06 10:33 . 2010-09-30 07:02        484656        ----a-w-        c:\windows\ssndii.exe
2012-05-06 10:33 . 2012-05-06 10:33        --------        d-----w-        c:\windows\Samsung
2012-05-06 10:33 . 2009-09-11 07:48        33792        ----a-w-        c:\windows\system32\Spool\prtprocs\x64\sst3cpc.dll
2012-05-06 10:32 . 2009-09-11 07:48        27648        ----a-w-        c:\windows\system32\sst3cl6.dll
2012-05-06 10:32 . 2009-09-11 07:47        151552        ----a-w-        c:\windows\system32\sst3cci.exe
2012-05-06 10:32 . 2009-09-11 07:47        89600        ----a-w-        c:\windows\system32\sst3cci.dll
2012-05-06 10:32 . 2009-09-10 08:49        47104        ----a-w-        c:\windows\system32\ssusbp64.dll
2012-05-06 10:32 . 2009-09-10 08:49        74240        ----a-w-        c:\windows\system32\ssdevm64.dll
2012-05-06 10:32 . 2009-09-10 08:49        49152        ----a-w-        c:\windows\SysWow64\ssusbpn.dll
2012-05-06 10:32 . 2009-09-10 08:49        81920        ----a-w-        c:\windows\SysWow64\ssdevm.dll
2012-05-06 10:32 . 2009-09-10 08:49        44544        ----a-w-        c:\windows\SysWow64\msxml4a.dll
2012-05-06 10:32 . 2009-09-10 08:49        38160        ----a-w-        c:\windows\SysWow64\msxml2r.dll
2012-05-06 10:32 . 2009-09-10 08:49        21776        ----a-w-        c:\windows\SysWow64\msxml2a.dll
2012-05-06 10:32 . 2009-09-10 08:49        701440        ----a-w-        c:\windows\SysWow64\msxml2.dll
2012-05-06 10:31 . 2012-05-06 10:31        --------        d-----w-        c:\program files (x86)\Samsung
2012-05-06 10:31 . 2009-09-10 07:50        11576        ------w-        c:\windows\SysWow64\drivers\SSPORT.SYS
2012-05-06 09:56 . 2012-05-06 09:56        --------        d-----w-        c:\programdata\Samsung
2012-05-05 10:49 . 2012-05-05 10:49        --------        d-----w-        c:\program files (x86)\7-Zip
2012-04-28 12:44 . 2012-04-28 12:48        --------        d-----w-        c:\users\user\.freemind
2012-04-28 12:44 . 2012-04-28 12:44        --------        d-----w-        c:\program files (x86)\FreeMind
2012-04-22 20:16 . 2012-04-22 20:16        --------        d-----w-        c:\program files (x86)\Microsoft
2012-04-15 14:16 . 2012-04-15 14:16        --------        d-----w-        c:\program files (x86)\Common Files\Adobe
2012-04-13 07:43 . 2012-03-01 06:46        23408        ----a-w-        c:\windows\system32\drivers\fs_rec.sys
2012-04-13 07:43 . 2012-03-01 06:33        81408        ----a-w-        c:\windows\system32\imagehlp.dll
2012-04-13 07:43 . 2012-03-01 05:37        172544        ----a-w-        c:\windows\SysWow64\wintrust.dll
2012-04-13 07:43 . 2012-03-01 05:33        159232        ----a-w-        c:\windows\SysWow64\imagehlp.dll
2012-04-13 07:43 . 2012-03-01 06:38        220672        ----a-w-        c:\windows\system32\wintrust.dll
2012-04-13 07:43 . 2012-03-01 06:28        5120        ----a-w-        c:\windows\system32\wmi.dll
2012-04-13 07:43 . 2012-03-01 05:29        5120        ----a-w-        c:\windows\SysWow64\wmi.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 11:05 . 2012-04-08 16:52        419488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-05 11:05 . 2011-05-18 12:10        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 10:30 . 2012-04-10 06:30        8744608        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-02-17 06:38 . 2012-03-14 11:09        1031680        ----a-w-        c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 11:09        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 11:09        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 11:09        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-02-15 10:01 . 2012-02-15 10:01        52736        ----a-w-        c:\windows\system32\drivers\usbaapl64.sys
2012-02-15 10:01 . 2012-02-15 10:01        4547944        ----a-w-        c:\windows\system32\usbaaplrc.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2010-05-25 619008]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2010-06-07 618496]
.
c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BUFFALO NAS Navigator.lnk - c:\program files (x86)\BUFFALO\NASNAVI\NasNavi.exe [2009-12-24 1897952]
NAS Scheduler.lnk - c:\program files (x86)\BUFFALO\NASNAVI\nassche.exe [2010-11-5 206128]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files (x86)\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2011-12-25 66864]
p6_19_erinnerung.lnk - c:\program files (x86)\phase6\phase6_19\WinStart\p6erinnerung.exe [2007-2-11 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-14 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-14 136176]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech Webcam 200(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
R3 SaiK0836;SaiK0836;c:\windows\system32\DRIVERS\SaiK0836.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [x]
R3 X6va003;X6va003;c:\users\user\AppData\Local\Temp\0037DC8.tmp [x]
R3 X6va005;X6va005;c:\users\user\AppData\Local\Temp\005FA45.tmp [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128]
R4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-10 369688]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 LVPrcS64;Process Monitor;c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe [2010-05-07 197976]
S2 NasPmService;NAS PM Service;c:\program files (x86)\BUFFALO\NASNAVI\nassvc.exe [2008-07-11 251184]
S2 TeamViewer7;TeamViewer 7;c:\users\user\temp\TeamViewer\Version7\TeamViewer_Service.exe [2012-02-23 2886528]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [x]
S3 avmaura;AVM USB-Fernanschluss;c:\windows\system32\DRIVERS\avmaura.sys [x]
S3 e1yexpress;Intel(R) Gigabit-Netzwerkverbindungstreiber;c:\windows\system32\DRIVERS\e1y60x64.sys [x]
S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
S3 netr28x;Ralink 802.11n-Drahtlostreiber für Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 11:05]
.
2012-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-14 18:17]
.
2012-05-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-14 18:17]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2010-07-01 8151040]
"ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2010-07-07 310272]
"SaiMfd"="c:\program files\Saitek\SD6\Software\SaiMfd.exe" [2010-07-07 158208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://de.yahoo.com/?fr=fp-yie9
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=www-proxy.t-online.de:80;https=sec-proxy-online.de:80;ftp=ftp-proxy.t-online:80
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files (x86)\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files (x86)\Ask.com\GenericAskToolbar.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files (x86)\Ask.com\GenericAskToolbar.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-{79A765E1-C399-405B-85AF-466F52E918B0} - c:\program files (x86)\Ask.com\Updater\Updater.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va003]
"ImagePath"="\??\c:\users\user\AppData\Local\Temp\0037DC8.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\user\AppData\Local\Temp\005FA45.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\users\user\temp\TeamViewer\Version7\TeamViewer.exe
c:\users\user\temp\TeamViewer\Version7\tv_w32.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-05-12  10:14:49 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-05-12 08:14
.
Vor Suchlauf: 12 Verzeichnis(se), 352.132.661.248 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 351.939.248.128 Bytes frei
.
- - End Of File - - 438F514EF8DB828365E0905D0A00C0EA

--- --- ---
Oh wow, ich hab gerade mal einen Blick auf meine Firewall geworfen! - Sie funktioniert wieder einwandfrei (zumindestens laut Windows) :D

cosinus 12.05.2012 20:19
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Ethan_Hunt 12.05.2012 20:56
Gesagt getan

hier das Log

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-12 21:24:37
-----------------------------
21:24:37.496    OS Version: Windows x64 6.1.7601 Service Pack 1
21:24:37.496    Number of processors: 4 586 0x170A
21:24:37.496    ComputerName: ****  UserName: user
21:24:39.337    Initialize success
21:33:06.311    AVAST engine defs: 12051200
21:34:19.132    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:34:19.132    Disk 0 Vendor: Hitachi_ ST6O Size: 953869MB BusType: 8
21:34:19.148    Disk 0 MBR read successfully
21:34:19.148    Disk 0 MBR scan
21:34:19.148    Disk 0 Windows 7 default MBR code
21:34:19.164    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        15000 MB offset 2048
21:34:19.164    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      469458 MB offset 30722048
21:34:19.195    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      469409 MB offset 992172032
21:34:19.226    Disk 0 scanning C:\Windows\system32\drivers
21:34:26.823    Service scanning
21:34:50.629    Modules scanning
21:34:50.629    Disk 0 trace - called modules:
21:34:50.644    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorV.sys hal.dll
21:34:50.644    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008964060]
21:34:50.660    3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800770e050]
21:34:51.471    AVAST engine scan C:\Windows
21:34:53.936    AVAST engine scan C:\Windows\system32
21:37:09.239    AVAST engine scan C:\Windows\system32\drivers
21:37:18.881    AVAST engine scan C:\Users\user
21:42:46.922    AVAST engine scan C:\ProgramData
21:43:43.847    Scan finished successfully
21:51:43.376    Disk 0 MBR has been saved successfully to "C:\Users\user\Desktop\MBR.dat"
21:51:43.376    The log file has been saved successfully to "C:\Users\user\Desktop\aswMBR.txt"

cosinus 12.05.2012 21:36
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Ethan_Hunt 13.05.2012 10:06
Auftrag ausgeführt:

Hier das Log von Malwarebytes:

Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.12.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
user :: ****[Administrator]

12.05.2012 23:32:04
mbam-log-2012-05-12 (23-32-04).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 460284
Laufzeit: 54 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
und hier das Log von SUPERAntiSpyware
Ich hab versehentlich beim ersten Mal einen Quick Scan durchgeführt, beim zweiten Mal (zweites Log) aber dann noch einmal einen Full Scan

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/13/2012 at 08:39 AM

Application Version : 5.0.1148

Core Rules Database Version : 8590
Trace Rules Database Version: 6402

Scan type      : Quick Scan
Total Scan Time : 00:02:59

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 655
Memory threats detected  : 0
Registry items scanned    : 54434
Registry threats detected : 0
File items scanned        : 11046
File threats detected    : 6

Adware.Tracking Cookie
        C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\67A8UJAL.txt [ /ad.yieldmanager.com ]
        C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\MMP2JTVA.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\4TD4GCIL.txt [ /doubleclick.net ]
        C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\DY7P0PV9.txt [ /adfarm1.adition.com ]
        C:\USERS\USER\Cookies\MMP2JTVA.txt [ Cookie:user@ad2.adfarm1.adition.com/ ]
        C:\USERS\USER\Cookies\DY7P0PV9.txt [ Cookie:user@adfarm1.adition.com/ ]
hier jetzt noch einmal der Full Scan

Code:
SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 05/13/2012 bei 10:52 AM

Version der Applikation : 5.0.1148

Version der Kern-Datenbank : 8590
Version der Spur-Datenbank : 6402

Scan Art      : kompletter Scann
Totale Scann-Zeit : 02:10:05

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Gescannte Speicherelemente  : 671
Erfasste Speicher-Bedrohungen  : 0
Gescannte Register-Elemente  : 67543
Erfasste Register-Bedrohungen  : 0
Gescannte Datei-Elemente    : 346079
Erfasste Datei-Elemente  : 0

cosinus 13.05.2012 16:03
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Ethan_Hunt 13.05.2012 16:39
Also mein System ist wieder komplett normal und ich habe keine "Beschwerden" werden mehr - und vorallem funktioniert die Firewall wieder und die Fehlermeldung ist auch weg!

Danke für die Tipps mit den Cookies! Hast du denn noch irgendwelche Ratschläge für mich, wie ich mein System schützen kann (reicht Avira aus)?

Ist mein System denn nun Viren frei?

cosinus 14.05.2012 08:02
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Ethan_Hunt 14.05.2012 14:34
Super!!! :)


Vielen Dank für deine Hilfe!!!

Ohne dich und trojaner board wäre ich wahrscheinlich immer noch am Verzweifeln!!!

Dankeschön!


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:11 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131