Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Browser & Antivirenprogramme stürzen ständig ab nach Virenfund (https://www.trojaner-board.de/116871-browser-antivirenprogramme-stuerzen-staendig-ab-virenfund.html)

myspam69 08.06.2012 19:18
Browser & Antivirenprogramme stürzen ständig ab nach Virenfund
 
Hallo zusammen,

auch hier ein kleines Problem ... aber der Reihe nach:

Wie alles anfing:
  • Auto-Protect von Norton Antivirus 2012 stürzt immer ab (Fehler 3035,6), Reparatur von Auto-Protect schlägt fehl.
  • Gleichzeitig stürzen Firefox und Chrome ab beim Versuch, diese zu starten
  • De-install von NAV (mit Norton Removal Tool) und Neuinstallation bei Norton führt erst zur Besserung. Dann wieder dieselben Symptome wie oben beschrieben.
  • Erneutes de-install von NAV (wieder mit Norton Removal Tool) OHNE Neuinstallation von NAV löst das Problem mit den Browsern
  • Dann Installation von Avira: Zunächst scheint alles zu funktionieren, dann stürzen Avira-Dienste ab, Update geht nicht und auch die Browser (FF12 / Chrome 19) stürzen wieder ab (IE 9 geht).
  • De-installation von Avira und nach Neustart Installation von Avast. Wieder Probleme mit Antivirus und den Browsern (FF12/GC19)
  • De-install aller Antivirenprogramme führt dazu, daß die Browser wieder laufen.
  • Installation von Malwarebytes Anti-Malware deutet auf einige Funde hin. Werden unter Quarantäne gestellt. Neuer Scan führt zu keinen neuen Ergebnissen.
  • Danach wieder Installation von Norton Antivirus 2012: Probleme beim Update, FF12 stürzt ab ...
  • Damit ich den PC nutzen kann, habe ich jetzt erstmal alle Antivirenprogramme deinstalliert. Einzig Malwarebytes ist noch drauf. Aber das ist ja wohl auch kein Zustand.

Ähnliches habe ich in den Foren schon gelesen - aber bevor ich jetzt die diversen beschriebenen Tools selbst anwende und mir das System vollständig zerschieße ... vielleicht könnt ihr mir weiterhelfen!

Danke schon jetzt!

Grüße,
Myspam69

-------------------- LOGFILES---------------------------------------

Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.27.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
FH :: FH-PC [Administrator]

Schutz: Aktiviert

27.04.2012 20:32:53
mbam-log-2012-04-27 (20-32-53).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 202624
Laufzeit: 1 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 4
HKCU\SOFTWARE\JRMX9X1GML (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\ZE18MW23GY (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
OTL.TXT

OTL Logfile:
Code:
OTL logfile created on: 08.06.2012 20:26:30 - Run 5
OTL by OldTimer - Version 3.2.47.0    Folder = C:\Users\FH\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 5,97 Gb Available Physical Memory | 74,61% Memory free
16,00 Gb Paging File | 13,94 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,39 Gb Total Space | 62,77 Gb Free Space | 42,88% Space Free | Partition Type: NTFS
Drive D: | 687,37 Gb Total Space | 300,10 Gb Free Space | 43,66% Space Free | Partition Type: NTFS
Drive Z: | 97,66 Gb Total Space | 39,94 Gb Free Space | 40,90% Space Free | Partition Type: NTFS
 
Computer Name: FH-PC | User Name: FH | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.08 19:48:16 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\FH\Downloads\OTL.exe
PRC - [2012.06.08 19:48:09 | 000,050,477 | ---- | M] () -- C:\Users\FH\Downloads\Defogger.exe
PRC - [2012.06.06 21:15:27 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.05.08 00:31:08 | 003,331,872 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\FH\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.02.23 13:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
PRC - [2012.02.23 12:40:40 | 002,886,528 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.01.18 08:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.01.10 16:24:20 | 000,993,848 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe
PRC - [2011.01.10 16:24:20 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe
PRC - [2011.01.10 16:24:20 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
PRC - [2010.09.23 18:15:18 | 000,350,256 | ---- | M] (AnchorFree Inc.) -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2010.09.23 01:25:24 | 000,107,568 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
PRC - [2010.09.23 01:24:22 | 000,265,776 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
PRC - [2010.09.22 21:19:06 | 000,325,168 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2009.04.10 10:33:16 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.04.10 10:32:46 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.08 19:48:09 | 000,050,477 | ---- | M] () -- C:\Users\FH\Downloads\Defogger.exe
MOD - [2012.06.06 21:15:27 | 002,042,848 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.03.17 01:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2010.09.23 01:25:24 | 000,107,568 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
MOD - [2010.09.23 01:25:04 | 000,006,192 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\lang\gui-ger.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.04.10 12:17:16 | 000,097,552 | ---- | M] (SANDBOXIE L.T.D) [Disabled | Stopped] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV:64bit: - [2011.04.20 02:04:20 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.06.04 20:53:34 | 003,417,376 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll -- (Akamai)
SRV - [2012.05.09 18:42:29 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.02.23 12:40:40 | 002,886,528 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.01.31 16:09:34 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.18 08:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.22 18:30:58 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\nlssrv32.exe -- (nlsX86cc)
SRV - [2011.07.05 02:33:00 | 000,032,768 | ---- | M] (STRATO) [Auto | Running] -- C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe -- (STRATO HiDrive Service)
SRV - [2011.01.10 16:24:20 | 000,993,848 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011.01.10 16:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010.09.23 18:15:18 | 000,350,256 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010.09.23 01:25:28 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2010.09.23 01:24:22 | 000,265,776 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010.09.22 21:19:06 | 000,325,168 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.10 10:32:46 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) Intel(R)
SRV - [2008.10.20 22:18:26 | 000,071,096 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.04.18 15:05:16 | 000,019,304 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2012.04.10 12:17:14 | 000,164,528 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Stopped] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.01.18 08:44:36 | 004,865,568 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64) Logitech HD Webcam C270(UVC)
DRV:64bit: - [2012.01.18 08:44:28 | 000,351,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2012.01.11 21:03:38 | 000,230,864 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2011.07.05 02:33:02 | 000,031,232 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2011.05.12 14:03:12 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\2DB9.tmp -- (MEMSWEEP2)
DRV:64bit: - [2011.04.20 02:44:50 | 009,319,936 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2011.04.20 02:44:50 | 009,319,936 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.04.20 01:22:34 | 000,306,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.04.13 15:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.03.30 13:05:55 | 000,035,112 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.12.14 05:54:12 | 000,058,472 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (TEAM) Realtek Virtual Miniport Driver for Teaming (NDIS 6.0)
DRV:64bit: - [2010.12.14 05:54:12 | 000,058,472 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (RTTEAMPT) Realtek Teaming Protocol Driver (NDIS 6.0)
DRV:64bit: - [2010.12.14 05:54:12 | 000,027,136 | ---- | M] (Realtek                                            ) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\RtNdPt60.sys -- (RtNdPt60)
DRV:64bit: - [2010.12.14 05:54:12 | 000,024,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan60.sys -- (VLAN) Realtek Virtual Miniport Driver for VLAN (NDIS 6.2)
DRV:64bit: - [2010.12.14 05:54:12 | 000,024,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan60.sys -- (RTVLANPT) Realtek Vlan Protocol Driver (NDIS 6.2)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.11 08:37:32 | 000,408,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.09.22 21:19:02 | 000,056,832 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HssDrv.sys -- (HssDrv)
DRV:64bit: - [2010.09.01 10:30:58 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)
DRV:64bit: - [2010.06.16 22:33:40 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2010.05.07 19:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2Mon)
DRV:64bit: - [2010.05.07 19:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2M64)
DRV:64bit: - [2009.11.12 14:48:56 | 000,005,504 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\StarOpen.sys -- (StarOpen)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 10:47:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.04.10 10:23:56 | 000,409,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2007.06.25 05:37:14 | 000,108,032 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtlh64.sys -- (RTL8169)
DRV - [2010.01.29 11:40:16 | 000,115,600 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys -- (ISODrive)
DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2736476
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F7 9F 0D 3D 98 D0 C9 01  [binary data]
IE - HKCU\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;<local>
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\FH\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\FH\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\bluejeans.com/bjnplugin: C:\Users\FH\AppData\Roaming\bluejeans\bjnplugin\1.0.0.220\npbjnplugin_1.0.0.220.dll (bluejeans)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009.11.05 22:36:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.06 21:15:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.05.28 21:52:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FH\AppData\Roaming\mozilla\Extensions
[2012.06.03 10:32:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FH\AppData\Roaming\mozilla\Firefox\Profiles\ax7ky0ja.default\extensions
[2012.05.24 20:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FH\AppData\Roaming\mozilla\Firefox\Profiles\i7ll0yj0.default\extensions
[2012.06.06 21:15:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.05.28 22:03:07 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\FH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AX7KY0JA.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.06.03 10:32:27 | 000,185,022 | ---- | M] () (No name found) -- C:\USERS\FH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AX7KY0JA.DEFAULT\EXTENSIONS\ARTUR.DUBOVOY@GMAIL.COM.XPI
[2012.06.06 21:15:27 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.06.06 21:15:26 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.06 21:15:26 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.06 21:15:26 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.06 21:15:26 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.06 21:15:26 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.06 21:15:26 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\FH\AppData\Local\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\FH\AppData\Local\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\FH\AppData\Local\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\FH\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Java(TM) Platform SE 6 U32 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.320.5 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\FH\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Adblock Plus (Beta) = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\
CHR - Extension: Google-Suche = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.06.04 21:11:10 | 000,000,808 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - No CLSID value found.
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\FH\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab (JordanUploader Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.1.cab (DLM Control)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21D71C66-535B-4CB0-A3DD-134E02477C89}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5DAC882A-A34A-42D2-A89A-94D5B3266E0F}: DhcpNameServer = 10.48.88.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC72F0FF-9D9B-46DF-B805-5FC6E603247A}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.09.23 07:58:44 | 000,000,019 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.07 21:08:20 | 000,000,000 | ---D | C] -- C:\Users\FH\Doctor Web
[2012.06.06 21:55:54 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012.06.06 18:12:56 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Roaming\bluejeans
[2012.06.04 22:36:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2012.06.04 20:52:08 | 000,000,000 | ---D | C] -- C:\Users\FH\DoctorWeb
[2012.06.04 19:27:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
[2012.06.04 19:27:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos
[2012.06.03 20:40:40 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.03 20:40:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.05.30 18:26:32 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.05.28 21:52:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.05.19 21:00:57 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[8 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.08 19:48:52 | 000,000,000 | ---- | M] () -- C:\Users\FH\defogger_reenable
[2012.06.08 19:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.08 19:41:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000UA.job
[2012.06.08 19:24:53 | 001,622,524 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.08 19:24:53 | 000,698,738 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.08 19:24:53 | 000,655,054 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.08 19:24:53 | 000,148,818 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.08 19:24:53 | 000,121,926 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.08 18:05:46 | 004,512,144 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.08 18:05:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.08 18:05:27 | 2146,291,711 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.07 17:54:23 | 000,015,520 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.07 17:54:23 | 000,015,520 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.07 17:41:00 | 000,001,056 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000Core.job
[2012.06.05 19:11:12 | 000,000,185 | ---- | M] () -- C:\Users\FH\Desktop\DrWeb.csv
[2012.06.04 22:36:25 | 000,002,103 | ---- | M] () -- C:\Users\FH\Desktop\HijackThis.lnk
[2012.06.04 21:11:10 | 000,000,808 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.06.03 20:47:23 | 000,001,851 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.06.03 20:40:41 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.30 18:30:50 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.05.30 18:26:33 | 000,002,306 | ---- | M] () -- C:\Users\FH\Desktop\Google Chrome.lnk
[2012.05.29 21:47:08 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLev.DAT
[2012.05.28 21:52:02 | 000,001,140 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.05.28 21:39:47 | 001,854,885 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1301000.01C\Cat.DB
[2012.05.17 12:04:26 | 000,008,942 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1301000.01C\VT20120410.035
[2012.05.13 10:55:47 | 000,093,020 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symtdiv.sys.ptx
[2012.05.13 10:55:46 | 000,001,051 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symnetv64.cat.ptx
[2012.05.13 10:55:46 | 000,000,218 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symnetv.inf.ptx
[2012.05.13 10:55:45 | 000,098,554 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symnets.sys.ptx
[2012.05.13 10:55:44 | 000,271,008 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symefa64.sys.ptx
[2012.05.13 10:55:44 | 000,002,428 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symnet64.cat.ptx
[2012.05.13 10:55:44 | 000,000,218 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symnet.inf.ptx
[2012.05.13 10:55:38 | 000,004,084 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symefa64.cat.ptx
[2012.05.13 10:55:38 | 000,001,969 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\srtspx64.sys.ptx
[2012.05.13 10:55:38 | 000,000,295 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\symefa.inf.ptx
[2012.05.13 10:55:37 | 000,267,375 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\srtsp64.sys.ptx
[2012.05.13 10:55:37 | 000,006,310 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\srtspx64.cat.ptx
[2012.05.13 10:55:37 | 000,000,263 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\srtspx64.inf.ptx
[2012.05.13 10:55:34 | 000,000,263 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\srtsp64.inf.ptx
[2012.05.13 10:55:33 | 000,023,997 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\ironx64.sys.ptx
[2012.05.13 10:55:33 | 000,020,971 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\ccsetx64.sys.ptx
[2012.05.13 10:55:33 | 000,005,138 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\srtsp64.cat.ptx
[2012.05.13 10:55:33 | 000,002,554 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\iron.cat.ptx
[2012.05.13 10:55:33 | 000,000,224 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\iron.inf.ptx
[2012.05.13 10:55:32 | 000,002,542 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\ccsetx64.cat.ptx
[2012.05.13 10:55:32 | 000,000,268 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\ccsetx64.inf.ptx
[2012.05.13 09:47:36 | 000,000,172 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1307010.005\isolate.ini
[8 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.08 19:48:52 | 000,000,000 | ---- | C] () -- C:\Users\FH\defogger_reenable
[2012.06.08 18:05:29 | 004,512,144 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.05 19:11:12 | 000,000,185 | ---- | C] () -- C:\Users\FH\Desktop\DrWeb.csv
[2012.06.04 22:36:25 | 000,002,103 | ---- | C] () -- C:\Users\FH\Desktop\HijackThis.lnk
[2012.06.03 20:40:41 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.30 18:26:33 | 000,002,306 | ---- | C] () -- C:\Users\FH\Desktop\Google Chrome.lnk
[2012.05.28 21:52:02 | 000,001,152 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.05.28 21:52:02 | 000,001,140 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.05.19 20:15:34 | 000,001,116 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2012.04.11 20:40:26 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Commands
[2012.04.11 20:40:26 | 000,000,268 | RH-- | C] () -- C:\Users\FH\AppData\Roaming\ColorTable
[2012.04.11 20:39:50 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Common
[2012.04.11 20:39:50 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Command Line Utility
[2012.04.10 19:45:38 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat
[2012.01.18 08:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.01.18 08:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.01.18 08:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.11.01 21:44:04 | 000,004,608 | ---- | C] () -- C:\Windows\SysWow64\ColorEfexPro4FC64.dll
[2011.09.22 18:31:04 | 000,003,584 | ---- | C] () -- C:\Windows\SysWow64\ColorEfexPro4FC32.dll
[2011.09.03 20:44:01 | 000,002,112 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2011.08.26 10:21:39 | 001,648,266 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.06.29 20:27:44 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Halftone
[2011.03.17 17:51:46 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.03.12 10:49:52 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2010.10.24 18:22:21 | 000,001,940 | ---- | C] () -- C:\Users\FH\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010.08.19 18:27:36 | 000,000,268 | RH-- | C] () -- C:\Users\FH\AppData\Roaming\ColorSync
[2010.08.19 18:27:36 | 000,000,268 | RH-- | C] () -- C:\Users\FH\AppData\Roaming\Colors
[2010.08.19 18:27:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2010.08.19 18:27:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2010.08.19 18:27:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2010.06.25 21:06:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== LOP Check ==========
 
[2012.01.07 21:15:24 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\AllDup
[2011.01.14 21:46:38 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Amazon
[2009.11.05 22:40:51 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Anthropics
[2009.11.15 18:55:44 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\AVM
[2012.06.06 18:12:56 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\bluejeans
[2012.04.29 10:55:48 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\BOM
[2010.12.21 20:58:42 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Buhl Data Service
[2010.04.27 20:40:54 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Canneverbe Limited
[2012.05.28 10:14:54 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Dropbox
[2010.08.17 18:07:31 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\DxO Labs
[2010.01.14 19:54:37 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\FRITZ!
[2011.11.15 23:49:25 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Garmin
[2011.09.02 18:33:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\gtk-2.0
[2010.05.26 18:34:22 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\HDRsoft
[2009.11.05 22:40:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\ImgBurn
[2012.04.29 10:55:58 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\IrfanView
[2010.12.10 19:07:26 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Leadertech
[2011.10.03 20:08:52 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MAGIX
[2009.11.05 22:41:01 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MiK
[2012.04.29 10:55:48 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Mp3tag
[2011.12.11 12:02:39 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MusicBee
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Nik Software
[2010.08.20 20:14:18 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Nikon
[2011.05.26 20:20:16 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\OfficeRecovery
[2010.08.17 18:05:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\PACE Anti-Piracy
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\PanoramaStudio
[2011.09.10 21:39:16 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\QuickScan
[2011.07.19 19:46:29 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.09.12 19:03:57 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\STRATO
[2012.05.09 21:39:28 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\TeamViewer
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Tracker Software
[2012.01.14 13:48:27 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\TrueCrypt
[2012.02.21 20:44:09 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\uTorrent
[2012.06.07 11:26:51 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 192 bytes -> C:\Windows:nlsPreferences
@Alternate Data Stream - 1211 bytes -> C:\ProgramData\Microsoft:ck9qpEKUMFdL4haXexlDj
@Alternate Data Stream - 1118 bytes -> C:\Program Files (x86)\Common Files\System:nwi1Gl8XuWH80eHoCayQDbwxI6G12R
@Alternate Data Stream - 1018 bytes -> C:\ProgramData\Microsoft:OimpulZPjuzt1pwO0p7Retjpbr

< End of report >
--- --- ---


OTL.EXTRAS

OTL Logfile:
Code:
OTL Extras logfile created on: 08.06.2012 20:26:30 - Run 5
OTL by OldTimer - Version 3.2.47.0    Folder = C:\Users\FH\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 5,97 Gb Available Physical Memory | 74,61% Memory free
16,00 Gb Paging File | 13,94 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,39 Gb Total Space | 62,77 Gb Free Space | 42,88% Space Free | Partition Type: NTFS
Drive D: | 687,37 Gb Total Space | 300,10 Gb Free Space | 43,66% Space Free | Partition Type: NTFS
Drive Z: | 97,66 Gb Total Space | 39,94 Gb Free Space | 40,90% Space Free | Partition Type: NTFS
 
Computer Name: FH-PC | User Name: FH | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{925B737D-C00C-4447-9199-19426BEA6390}" = rport=25652 | protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{C290E958-D54E-4BCF-B7BF-2016A955B471}" = rport=25652 | protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{C52D31D4-F1A3-4D53-893F-F11B5A010041}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{DBD96B19-E067-486F-9492-8CBBAEC16AFD}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{107D3D17-E624-4138-A754-83B63E4294EA}" = dir=out | app=%programfiles% (x86)\nikon\capture nx 2\capture nx 2.exe |
"{115489E2-803C-4BED-B3F1-825341EADE2F}" = protocol=6 | dir=in | app=c:\users\fh\appdata\local\akamai\netsession_win.exe |
"{1606367E-E773-4835-95C6-DC51E76E3A53}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |
"{1E53C63F-C9D0-471B-9F47-CE48B6F3474B}" = protocol=6 | dir=in | app=c:\users\fh\appdata\local\temp\7zsb6fc.tmp\symnrt.exe |
"{2DB75C95-727D-4861-810D-94106551659A}" = protocol=17 | dir=in | app=c:\users\fh\appdata\roaming\dropbox\bin\dropbox.exe |
"{4CA2A7DA-EBD5-453C-9D2D-F64C95C36074}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{5114D7DA-4E5C-4C76-8C12-811330526D3D}" = protocol=17 | dir=in | app=c:\users\fh\appdata\local\temp\7zsb6fc.tmp\symnrt.exe |
"{53356469-E88B-4DE4-A032-2D1440F00E0D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{57904181-C9C5-4F12-BE91-8EF4EFBCA946}" = dir=out | app=%programfiles% (x86)\ultraiso\drivers\isocmd.exe |
"{715C3A0B-C856-4749-8852-9F08D77D8C7E}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |
"{7194C49F-7EBD-4CDA-97FB-0C004A5C1C5D}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7EDBA861-414E-4361-8AFF-16EA4686B83B}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{7F13236E-400E-460A-ACA3-B356F9957F56}" = protocol=17 | dir=in | app=c:\users\fh\appdata\local\akamai\netsession_win.exe |
"{8180C875-2799-45DB-BA41-368FC8C5CF07}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{A8619E62-E98E-452C-8F12-46622FFB4314}" = dir=out | app=%programfiles% (x86)\ultraiso\ultraiso.exe |
"{B0FDAAF3-3B2D-43DF-A50D-0D2337DA228D}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{B20A7145-1D7C-4B1A-9AA5-D1EAAC778ADF}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |
"{B3EC49B2-1A0C-4911-A9C8-062BC73A16E2}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{B53CFCC7-7B4E-452F-BF8B-696E830A1F3C}" = protocol=6 | dir=in | app=c:\users\fh\appdata\roaming\dropbox\bin\dropbox.exe |
"{BFD3128B-B939-4AF1-BFE4-D1303B360141}" = protocol=17 | dir=in | app=c:\users\fh\appdata\local\temp\7zs8229.tmp\symnrt.exe |
"{C7D38809-A164-44E8-8A53-A83B605A456C}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |
"{D4F3AB45-3CE8-4F02-917B-80C201E994FB}" = protocol=6 | dir=in | app=c:\users\fh\appdata\local\temp\7zs8229.tmp\symnrt.exe |
"{D631C0D2-8162-4BD2-877A-3F951FDAB5BE}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{FB18C66D-3C61-4E1E-A498-4DF43DCB72B2}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"TCP Query User{0DCC1362-AD05-4BB1-AF6D-EB7D11E46567}C:\program files (x86)\strato ag\strato hidrive\openvpn\openvpn.exe" = protocol=6 | dir=in | app=c:\program files (x86)\strato ag\strato hidrive\openvpn\openvpn.exe |
"TCP Query User{133E0C5E-9EEB-4431-9331-3D9D998E5C5C}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{2BA9E9BE-8F52-47F9-BBBE-CEB676544F6B}C:\users\fh\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\fh\appdata\local\akamai\netsession_win.exe |
"TCP Query User{A4DCF56F-4686-4DC5-BCF9-F3DEDCCD3916}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"TCP Query User{AE0EA2BE-E730-43A3-9267-D8923BC847B0}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"TCP Query User{EA08CFF1-584E-4A88-825D-3BC8C93B9A0F}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"TCP Query User{F0C1DBC0-FD14-48ED-8615-A0B142FB574A}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{0F9C667E-A29B-448E-83E7-9DEFEA362B7F}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{407A549D-9FDE-45D9-AAE8-AC3165EA1DBE}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"UDP Query User{7315C854-790F-4A02-935B-EE1448B2AB6F}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe |
"UDP Query User{96B68CE4-BEBE-48A4-B26B-3836AA927692}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{A29B585F-619F-4BE1-9B9D-D2AC9588B879}C:\program files (x86)\strato ag\strato hidrive\openvpn\openvpn.exe" = protocol=17 | dir=in | app=c:\program files (x86)\strato ag\strato hidrive\openvpn\openvpn.exe |
"UDP Query User{C444A7E3-DDEA-4719-8E20-37BD80D45926}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{EF75128F-BC76-41A1-848E-85CC36D604A4}C:\users\fh\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\fh\appdata\local\akamai\netsession_win.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03AC245F-4C64-425C-89CF-7783C1D3AB2C}" = Microsoft Sync Framework 2.0 Provider Services (x64) ENU
"{11953C65-BB4E-4CA4-B0F0-2600A4B20040}" = Picture Control Utility x64
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0465-000001000000}" = 7-Zip 4.65 (x64 edition)
"{32508A23-C9EA-4D29-83CA-97A42A13701E}" = Microsoft Sync Framework Services v1.0 (x64)
"{3ED4AD02-F631-4A4C-AAC8-2325996E5A56}" = Microsoft IntelliPoint 8.1
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{53D7A054-4598-4947-A159-E8FCC77720AB}" = Microsoft Sync Framework Runtime v1.0 (x64)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{635BE602-BB9C-4C59-8CC5-93F9366E8A21}" = ViewNX 2
"{669A82E0-43E2-4645-8A2E-1A3DE78F8312}" = Adobe Photoshop Lightroom 4 64-bit
"{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{88DAAF05-5A72-46D2-A7C5-C3759697E943}" = SyncToy 2.1 (x64)
"{8B485965-8EFE-464A-842F-CF8F18C3DFD7}" = iCloud
"{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}" = Microsoft Sync Framework 2.0 Core Components (x64) ENU
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CF8FFD12-602B-422D-AF1D-511B411E7632}" = iTunes
"{D285FC5F-3021-32E9-9C59-24CA325BDC5C}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (03/08/2007 2.2.1.0)
"A35BD68D4A1B3E191138E3C9AA417190A9468F7E" = Windows-Treiberpaket - Leaf Imaging Ltd. Image  (02/11/2010 )
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"AutopanoGiga2.5" = Kolor Autopano Giga 2.5
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft IntelliPoint 8.1" = Microsoft IntelliPoint 8.1
"Recuva" = Recuva
"Sandboxie" = Sandboxie 3.68 (64-bit)
"WinRAR archiver" = WinRAR archiver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{07A8ED9E-B98E-437F-B750-241B412BE924}" = Garmin USB Drivers
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0AA86CEE-2C8C-4ABB-8F95-B8D8E852C62C}" = SportTracks 3.1
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 29
"{325045C9-F040-3D98-892D-53D5E840266C}" = Google Talk Plugin
"{3E00C574-B650-401D-A898-4581AAD6CC74}" = STRATO HiDrive
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{4478067C-D35C-47C3-BF6C-1BF8F9FC6546}" = bjnplugin
"{46B70DEB-97B3-4E38-B746-EC16905E6A8F}" = WISO Sparbuch 2010
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FBBEDB1-14D0-4F53-8537-1EE0F39F8FF8}" = MusicBee
"{5AE1721C-A430-4886-B3A1-8D6E5E6CD2A8}" = DxO Optics Pro 6
"{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}" = Nikon Movie Editor
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{659DA17C-5C44-45EB-99D7-ABC1202138E3}" = PictureMedley
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE2AE713-75EF-4CA6-82FB-3E1BBA8DD608}" = DxO Optics Pro 7
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = v2011.build.46
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DADC7AB0-E554-4705-9F6A-83EA82ED708E}" = Realtek Ethernet Diagnostic Utility
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E6FA148F-1E7D-4A42-A9A2-7DFABC2C6A2B}" = SportTracks 2.1
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe AIR" = Adobe AIR
"Akamai" = Akamai NetSession Interface Service
"AllDup_is1" = AllDup 3.2.22
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Biet-O-Matic v2.10.1" = Biet-O-Matic v2.10.1
"Capture NX 2" = Capture NX 2
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Color Efex Pro 3.0 Complete NX2" = Color Efex Pro 3.0 Complete for Capture NX 2
"Color Efex Pro 4" = Color Efex Pro 4
"ExifPro 2.0" = ExifPro 2.0 Photo Viewer
"HijackThis" = HijackThis 2.0.2
"HotspotShield" = Hotspot Shield 1.52
"ImgBurn" = ImgBurn
"IrfanView" = IrfanView (remove only)
"JDownloader" = JDownloader
"Lidl-Fotos_is1" = Lidl-Fotos
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Mozilla Firefox 13.0 (x86 de)" = Mozilla Firefox 13.0 (x86 de)
"Mp3tag" = Mp3tag v2.49a
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OpenStreetMap Plugin V2_is1" = OpenStreetMap Plugin V2
"OpenStreetMap Plugin_is1" = OpenStreetMap Plugin
"PanoramaStudio" = PanoramaStudio 1.5 (uninstall)
"PhotomatixPro3_is1" = Photomatix Pro version 3.0
"Picasa 3" = Picasa 3
"Secunia PSI" = Secunia PSI (2.0.0.3001)
"Sophos-AntiRootkit" = Sophos Anti-Rootkit 1.5.20
"TeamViewer 7" = TeamViewer 7
"TrueCrypt" = TrueCrypt
"UltraISO_is1" = UltraISO Premium V9.36
"uTorrent" = µTorrent
"V3.2_is1" = File Scavenger 3.2
"VLC media player" = VLC media player 2.0.0
"Winamp" = Winamp
"WinISO_is1" = WinISO 5.3
"Wubi" = Ubuntu
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"uTorrent" = µTorrent
"Winamp Detect" = Winamp Application Detect
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.11.2011 15:11:54 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 02.11.2011 14:48:08 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 03.11.2011 14:06:37 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 04.11.2011 14:34:07 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 05.11.2011 05:47:41 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 05.11.2011 09:31:09 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 05.11.2011 14:48:09 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 06.11.2011 06:03:03 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 06.11.2011 15:08:11 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 07.11.2011 14:16:22 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
Error - 08.11.2011 14:06:52 | Computer Name = FH-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: A required certificate is not within its validity period when verifying
 against the current system clock or the timestamp in the signed file.  .
 
[ System Events ]
Error - 07.06.2012 05:27:33 | Computer Name = FH-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Multimedia Class Scheduler" wurde unerwartet beendet. Dies
 ist bereits 3 Mal passiert.
 
Error - 07.06.2012 05:27:33 | Computer Name = FH-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Windows Management Instrumentation" wurde unerwartet beendet.
 Dies ist bereits 4 Mal passiert.
 
Error - 07.06.2012 05:27:33 | Computer Name = FH-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Windows Update" wurde unerwartet beendet. Dies ist bereits
 4 Mal passiert.
 
Error - 07.06.2012 05:27:38 | Computer Name = FH-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Windows Management Instrumentation" wurde unerwartet beendet.
 Dies ist bereits 5 Mal passiert.
 
Error - 07.06.2012 05:27:38 | Computer Name = FH-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Windows Update" wurde unerwartet beendet. Dies ist bereits
 5 Mal passiert.
 
Error - 07.06.2012 05:27:41 | Computer Name = FH-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Windows Management Instrumentation" wurde unerwartet beendet.
 Dies ist bereits 6 Mal passiert.
 
Error - 07.06.2012 05:27:41 | Computer Name = FH-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Windows Update" wurde unerwartet beendet. Dies ist bereits
 6 Mal passiert.
 
Error - 07.06.2012 05:29:16 | Computer Name = FH-PC | Source = DCOM | ID = 10010
Description =
 
Error - 07.06.2012 05:30:11 | Computer Name = FH-PC | Source = Microsoft-Windows-Kernel-General | ID = 5
Description =
 
Error - 07.06.2012 16:05:16 | Computer Name = FH-PC | Source = DCOM | ID = 10010
Description =
 
 
< End of report >
--- --- ---

[/CODE]

cosinus 10.06.2012 18:13
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

myspam69 10.06.2012 21:38
Danke! Hier schon mal das ESET log:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b04f6a1d226a2d4ebadf0119156d4e6a
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-10 08:32:36
# local_time=2012-06-10 10:32:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 3533557 3533557 0 0
# compatibility_mode=768 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 0 90984512 0 0
# compatibility_mode=8192 67108863 100 0 205 205 0 0
# scanned=294016
# found=1
# cleaned=0
# scan_time=5694
C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe        a variant of Win32/HotSpotShield application (unable to clean)        00000000000000000000000000000000        I

Malwarebytes Log:

Code:
Malwarebytes Anti-Malware (PRO) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.10.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
FH :: FH-PC [Administrator]

Schutz: Aktiviert

10.06.2012 13:42:51
mbam-log-2012-06-10 (13-42-51).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 499683
Laufzeit: 47 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Nachtrag:

Habe die von ESET gefundene Date mit Virustotal gescannt. Hier das Ergebnis:
Code:
ClamAV        PUA.Win32.Packer.MingwGcc-2
NOD32        a variant of Win32/HotSpotShield

cosinus 11.06.2012 09:43
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

myspam69 11.06.2012 14:46
Hi Arne,

Der normale Modus von Windows geht. Es fehlt auch kein Ordner bzw es sind keine leeren Ordner vorhanden. Alles scheint normal, bis ich wieder versuche ein Antibirenprogramm zu installieren.

cosinus 11.06.2012 15:43
Du sollst jetzt auch nicht irgendwelche Virenscanner installieren! V.a. schon garnicht ohne Absprache!

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

myspam69 14.06.2012 06:55
Hier der Custom Quici-Scan mit OTL:

OTL Logfile:
Code:
OTL logfile created on: 14.06.2012 07:41:40 - Run 6
OTL by OldTimer - Version 3.2.47.0    Folder = C:\Users\FH\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,08 Gb Available Physical Memory | 76,02% Memory free
16,00 Gb Paging File | 14,28 Gb Available in Paging File | 89,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,39 Gb Total Space | 62,28 Gb Free Space | 42,54% Space Free | Partition Type: NTFS
Drive D: | 687,37 Gb Total Space | 294,29 Gb Free Space | 42,81% Space Free | Partition Type: NTFS
 
Computer Name: FH-PC | User Name: FH | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.14 07:41:21 | 001,533,976 | ---- | M] (Google Inc.) -- C:\Users\FH\AppData\Local\Temp\CR_59630.tmp\setup.exe
PRC - [2012.06.08 22:00:00 | 001,464,232 | ---- | M] () -- C:\Users\FH\AppData\Local\Google\Update\Install\{595F1A4D-1BEA-4334-B82E-C2EA8B5CE32B}\chrome_updater.exe
PRC - [2012.06.08 19:48:16 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\FH\Downloads\OTL.exe
PRC - [2012.05.08 00:31:08 | 003,331,872 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\FH\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.02.23 13:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
PRC - [2012.02.23 12:40:40 | 002,886,528 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.01.18 08:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.01.10 16:24:20 | 000,993,848 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe
PRC - [2011.01.10 16:24:20 | 000,399,416 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe
PRC - [2011.01.10 16:24:20 | 000,291,896 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
PRC - [2010.09.23 18:15:18 | 000,350,256 | ---- | M] (AnchorFree Inc.) -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2010.09.23 01:25:24 | 000,107,568 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
PRC - [2010.09.23 01:24:22 | 000,265,776 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
PRC - [2010.09.22 21:19:06 | 000,325,168 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
PRC - [2009.04.10 10:33:16 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.04.10 10:32:46 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.08 22:00:00 | 001,464,232 | ---- | M] () -- C:\Users\FH\AppData\Local\Google\Update\Install\{595F1A4D-1BEA-4334-B82E-C2EA8B5CE32B}\chrome_updater.exe
MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.09.23 01:25:24 | 000,107,568 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\openvpntray.exe
MOD - [2010.09.23 01:25:04 | 000,006,192 | ---- | M] () -- C:\Program Files (x86)\Hotspot Shield\bin\lang\gui-ger.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.04.10 12:17:16 | 000,097,552 | ---- | M] (SANDBOXIE L.T.D) [Disabled | Stopped] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV:64bit: - [2011.04.20 02:04:20 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.06.10 10:37:42 | 000,257,224 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.04 20:53:34 | 003,417,376 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll -- (Akamai)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.02.23 12:40:40 | 002,886,528 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.01.31 16:09:34 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.18 08:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.22 18:30:58 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Disabled | Stopped] -- C:\Windows\SysWOW64\nlssrv32.exe -- (nlsX86cc)
SRV - [2011.07.05 02:33:00 | 000,032,768 | ---- | M] (STRATO) [Auto | Running] -- C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe -- (STRATO HiDrive Service)
SRV - [2011.01.10 16:24:20 | 000,993,848 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2011.01.10 16:24:20 | 000,399,416 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010.09.23 18:15:18 | 000,350,256 | ---- | M] (AnchorFree Inc.) [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe -- (HssSrv)
SRV - [2010.09.23 01:25:28 | 000,057,640 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE -- (HssTrayService)
SRV - [2010.09.23 01:24:22 | 000,265,776 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe -- (HotspotShieldService)
SRV - [2010.09.22 21:19:06 | 000,325,168 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe -- (HssWd)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.10 10:32:46 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) Intel(R)
SRV - [2008.10.20 22:18:26 | 000,071,096 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.04.18 15:05:16 | 000,019,304 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV:64bit: - [2012.04.10 12:17:14 | 000,164,528 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Stopped] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.01.18 08:44:36 | 004,865,568 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64) Logitech HD Webcam C270(UVC)
DRV:64bit: - [2012.01.18 08:44:28 | 000,351,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2012.01.11 21:03:38 | 000,230,864 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2011.07.05 02:33:02 | 000,031,232 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2011.05.12 14:03:12 | 000,006,144 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\2DB9.tmp -- (MEMSWEEP2)
DRV:64bit: - [2011.04.20 02:44:50 | 009,319,936 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2011.04.20 02:44:50 | 009,319,936 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.04.20 01:22:34 | 000,306,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.04.13 15:04:38 | 000,045,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.03.30 13:05:55 | 000,035,112 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.03.04 21:44:12 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.12.14 05:54:12 | 000,058,472 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (TEAM) Realtek Virtual Miniport Driver for Teaming (NDIS 6.0)
DRV:64bit: - [2010.12.14 05:54:12 | 000,058,472 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (RTTEAMPT) Realtek Teaming Protocol Driver (NDIS 6.0)
DRV:64bit: - [2010.12.14 05:54:12 | 000,027,136 | ---- | M] (Realtek                                            ) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\RtNdPt60.sys -- (RtNdPt60)
DRV:64bit: - [2010.12.14 05:54:12 | 000,024,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan60.sys -- (VLAN) Realtek Virtual Miniport Driver for VLAN (NDIS 6.2)
DRV:64bit: - [2010.12.14 05:54:12 | 000,024,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan60.sys -- (RTVLANPT) Realtek Vlan Protocol Driver (NDIS 6.2)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.11 08:37:32 | 000,408,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.09.22 21:19:02 | 000,056,832 | ---- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HssDrv.sys -- (HssDrv)
DRV:64bit: - [2010.09.01 10:30:58 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)
DRV:64bit: - [2010.06.16 22:33:40 | 000,037,888 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\taphss.sys -- (taphss)
DRV:64bit: - [2010.05.07 19:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2Mon)
DRV:64bit: - [2010.05.07 19:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LVPr2M64.sys -- (LVPr2M64)
DRV:64bit: - [2009.11.12 14:48:56 | 000,005,504 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\StarOpen.sys -- (StarOpen)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 10:47:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.04.10 10:23:56 | 000,409,112 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2007.06.25 05:37:14 | 000,108,032 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2007.05.14 16:06:18 | 000,027,520 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV - [2010.01.29 11:40:16 | 000,115,600 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys -- (ISODrive)
DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2736476
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F7 9F 0D 3D 98 D0 C9 01  [binary data]
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - No CLSID value found
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;<local>
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_257.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\FH\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\FH\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\bluejeans.com/bjnplugin: C:\Users\FH\AppData\Roaming\bluejeans\bjnplugin\1.0.0.220\npbjnplugin_1.0.0.220.dll (bluejeans)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009.11.05 22:36:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.06 21:15:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.05.28 21:52:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FH\AppData\Roaming\mozilla\Extensions
[2012.06.14 07:39:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FH\AppData\Roaming\mozilla\Firefox\Profiles\ax7ky0ja.default\extensions
[2012.06.14 07:39:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FH\AppData\Roaming\mozilla\Firefox\Profiles\ax7ky0ja.default\extensions\staged
[2012.05.24 20:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\FH\AppData\Roaming\mozilla\Firefox\Profiles\i7ll0yj0.default\extensions
[2012.06.06 21:15:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.05.28 22:03:07 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\FH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AX7KY0JA.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.06.03 10:32:27 | 000,185,022 | ---- | M] () (No name found) -- C:\USERS\FH\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AX7KY0JA.DEFAULT\EXTENSIONS\ARTUR.DUBOVOY@GMAIL.COM.XPI
[2012.06.06 21:15:27 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.06.06 21:15:26 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.06 21:15:26 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.06 21:15:26 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.06 21:15:26 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.06 21:15:26 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.06 21:15:26 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\FH\AppData\Local\Google\Chrome\Application\19.0.1084.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\FH\AppData\Local\Google\Chrome\Application\19.0.1084.52\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\FH\AppData\Local\Google\Chrome\Application\19.0.1084.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\FH\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\FH\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
CHR - plugin: Java(TM) Platform SE 6 U32 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.320.5 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\FH\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Adblock Plus (Beta) = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\
CHR - Extension: Google-Suche = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\FH\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.06.04 21:11:10 | 000,000,808 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll (AnchorFree Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - No CLSID value found.
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O3 - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000..\Run: [AdobeBridge]  File not found
O4 - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000..\Run: [Akamai NetSession Interface] C:\Users\FH\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab (JordanUploader Class)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.1.cab (DLM Control)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{21D71C66-535B-4CB0-A3DD-134E02477C89}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5DAC882A-A34A-42D2-A89A-94D5B3266E0F}: DhcpNameServer = 10.48.88.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC72F0FF-9D9B-46DF-B805-5FC6E603247A}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.09.23 07:58:44 | 000,000,019 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk - C:\PROGRA~2\WISO\STEUER~2\MSHAKT~1.EXE - ()
MsConfig:64bit - StartUpReg: LWS - hkey= - key= - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
MsConfig:64bit - StartUpReg: Nikon Message Center 2 - hkey= - key= - C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
MsConfig:64bit - StartUpReg: Nikon Transfer Monitor - hkey= - key= - C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
MsConfig:64bit - StartUpReg: SandboxieControl - hkey= - key= - C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5E78002A-1612-021B-5A6C-6FFD9A1C2471} - Internet Explorer
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: vidc.i420 - lvcod64.dll (Logitech Inc.)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\SysWow64\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.MP42 - MPG4C32.dll File not found
Drivers32: vidc.yv12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.10 20:54:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.06.10 12:25:44 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Roaming\vlc
[2012.06.10 12:25:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.06.10 10:40:52 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Local\Macromedia
[2012.06.07 21:08:20 | 000,000,000 | ---D | C] -- C:\Users\FH\Doctor Web
[2012.06.06 21:55:54 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012.06.06 18:12:56 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Roaming\bluejeans
[2012.06.04 22:36:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HijackThis
[2012.06.04 20:52:08 | 000,000,000 | ---D | C] -- C:\Users\FH\DoctorWeb
[2012.06.04 19:27:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
[2012.06.04 19:27:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos
[2012.06.03 20:40:40 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.03 20:40:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.05.30 18:26:32 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.05.28 21:52:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.05.19 21:00:57 | 000,000,000 | ---D | C] -- C:\Users\FH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[8 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.14 07:42:25 | 000,002,391 | ---- | M] () -- C:\Users\FH\Desktop\Google Chrome.lnk
[2012.06.14 07:42:25 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000UA.job
[2012.06.14 07:42:16 | 000,015,520 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.14 07:42:16 | 000,015,520 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.14 07:42:11 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.14 07:37:28 | 001,622,524 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.14 07:37:28 | 000,698,738 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.14 07:37:28 | 000,655,054 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.14 07:37:28 | 000,148,818 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.14 07:37:28 | 000,121,926 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.14 07:36:05 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLev.DAT
[2012.06.14 07:30:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.14 07:30:09 | 2146,291,711 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.10 18:19:29 | 004,929,456 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.10 12:25:40 | 000,001,076 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.06.07 17:41:00 | 000,001,056 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000Core.job
[2012.06.05 19:11:12 | 000,000,185 | ---- | M] () -- C:\Users\FH\Desktop\DrWeb.csv
[2012.06.04 22:36:25 | 000,002,103 | ---- | M] () -- C:\Users\FH\Desktop\HijackThis.lnk
[2012.06.04 21:11:10 | 000,000,808 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.06.03 20:47:23 | 000,001,851 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.06.03 20:40:41 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.30 18:30:50 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.05.28 21:52:02 | 000,001,140 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.05.28 21:39:47 | 001,854,885 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1301000.01C\Cat.DB
[2012.05.17 12:04:26 | 000,008,942 | ---- | M] () -- C:\Windows\SysNative\drivers\NAVx64\1301000.01C\VT20120410.035
[8 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.10 12:25:40 | 000,001,076 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.06.08 18:05:29 | 004,929,456 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.05 19:11:12 | 000,000,185 | ---- | C] () -- C:\Users\FH\Desktop\DrWeb.csv
[2012.06.04 22:36:25 | 000,002,103 | ---- | C] () -- C:\Users\FH\Desktop\HijackThis.lnk
[2012.06.03 20:40:41 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.30 18:26:33 | 000,002,391 | ---- | C] () -- C:\Users\FH\Desktop\Google Chrome.lnk
[2012.05.28 21:52:02 | 000,001,152 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.05.28 21:52:02 | 000,001,140 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.05.19 20:15:34 | 000,001,116 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2012.04.11 20:40:26 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Commands
[2012.04.11 20:40:26 | 000,000,268 | RH-- | C] () -- C:\Users\FH\AppData\Roaming\ColorTable
[2012.04.11 20:39:50 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Common
[2012.04.11 20:39:50 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Command Line Utility
[2012.04.10 19:45:38 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\cd.dat
[2012.01.18 08:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.01.18 08:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.01.18 08:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.11.01 21:44:04 | 000,004,608 | ---- | C] () -- C:\Windows\SysWow64\ColorEfexPro4FC64.dll
[2011.09.22 18:31:04 | 000,003,584 | ---- | C] () -- C:\Windows\SysWow64\ColorEfexPro4FC32.dll
[2011.09.03 20:44:01 | 000,002,112 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2011.08.26 10:21:39 | 001,648,266 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.06.29 20:27:44 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Halftone
[2011.03.17 17:51:46 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.03.12 10:49:52 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2010.10.24 18:22:21 | 000,001,940 | ---- | C] () -- C:\Users\FH\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010.08.19 18:27:36 | 000,000,268 | RH-- | C] () -- C:\Users\FH\AppData\Roaming\ColorSync
[2010.08.19 18:27:36 | 000,000,268 | RH-- | C] () -- C:\Users\FH\AppData\Roaming\Colors
[2010.08.19 18:27:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2010.08.19 18:27:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2010.08.19 18:27:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2010.06.25 21:06:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== LOP Check ==========
 
[2012.01.07 21:15:24 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\AllDup
[2011.01.14 21:46:38 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Amazon
[2009.11.05 22:40:51 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Anthropics
[2009.11.15 18:55:44 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\AVM
[2012.06.06 18:12:56 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\bluejeans
[2012.04.29 10:55:48 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\BOM
[2010.12.21 20:58:42 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Buhl Data Service
[2010.04.27 20:40:54 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Canneverbe Limited
[2012.05.28 10:14:54 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Dropbox
[2010.08.17 18:07:31 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\DxO Labs
[2010.01.14 19:54:37 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\FRITZ!
[2011.11.15 23:49:25 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Garmin
[2011.09.02 18:33:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\gtk-2.0
[2010.05.26 18:34:22 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\HDRsoft
[2009.11.05 22:40:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\ImgBurn
[2012.04.29 10:55:58 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\IrfanView
[2010.12.10 19:07:26 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Leadertech
[2011.10.03 20:08:52 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MAGIX
[2009.11.05 22:41:01 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MiK
[2012.04.29 10:55:48 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Mp3tag
[2011.12.11 12:02:39 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MusicBee
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Nik Software
[2010.08.20 20:14:18 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Nikon
[2011.05.26 20:20:16 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\OfficeRecovery
[2010.08.17 18:05:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\PACE Anti-Piracy
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\PanoramaStudio
[2011.09.10 21:39:16 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\QuickScan
[2011.07.19 19:46:29 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.09.12 19:03:57 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\STRATO
[2012.05.09 21:39:28 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\TeamViewer
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Tracker Software
[2012.01.14 13:48:27 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\TrueCrypt
[2012.02.21 20:44:09 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\uTorrent
[2012.06.07 11:26:51 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.04.10 20:05:17 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Adobe
[2011.07.19 19:46:29 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Adobe Mini Bridge CS5
[2009.08.11 21:13:30 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\AdobeUM
[2012.01.07 21:15:24 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\AllDup
[2011.01.14 21:46:38 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Amazon
[2009.11.05 22:40:51 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Anthropics
[2012.03.10 20:10:29 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Apple Computer
[2009.11.15 18:55:44 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\AVM
[2012.06.06 18:12:56 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\bluejeans
[2012.04.29 10:55:48 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\BOM
[2010.12.21 20:58:42 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Buhl Data Service
[2010.04.27 20:40:54 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Canneverbe Limited
[2011.04.08 08:03:05 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Download Manager
[2012.05.28 10:14:54 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Dropbox
[2011.01.15 23:37:48 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\dvdcss
[2010.08.17 18:07:31 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\DxO Labs
[2010.01.14 19:54:37 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\FRITZ!
[2011.11.15 23:49:25 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Garmin
[2011.09.02 18:33:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\gtk-2.0
[2010.05.26 18:34:22 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\HDRsoft
[2010.02.08 21:52:06 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Identities
[2009.11.05 22:40:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\ImgBurn
[2009.11.05 22:40:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\InstallShield
[2012.04.29 10:55:58 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\IrfanView
[2010.12.10 19:07:26 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Leadertech
[2009.11.05 22:40:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Macromedia
[2011.10.03 20:08:52 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MAGIX
[2012.04.27 20:31:59 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Malwarebytes
[2009.07.14 09:45:14 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Media Center Programs
[2012.01.25 21:06:51 | 000,000,000 | --SD | M] -- C:\Users\FH\AppData\Roaming\Microsoft
[2009.11.05 22:41:01 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MiK
[2012.05.28 21:52:15 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Mozilla
[2012.04.29 10:55:48 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Mp3tag
[2011.12.11 12:02:39 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\MusicBee
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Nik Software
[2010.08.20 20:14:18 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Nikon
[2011.05.26 20:20:16 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\OfficeRecovery
[2010.08.17 18:05:53 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\PACE Anti-Piracy
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\PanoramaStudio
[2011.09.10 21:39:16 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\QuickScan
[2011.03.14 08:34:24 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Real
[2012.06.06 18:51:29 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Skype
[2010.12.13 18:04:03 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\skypePM
[2011.07.19 19:46:29 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.09.12 19:03:57 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\STRATO
[2012.05.09 21:39:28 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\TeamViewer
[2009.11.05 22:41:02 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Tracker Software
[2012.01.14 13:48:27 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\TrueCrypt
[2012.02.21 20:44:09 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\uTorrent
[2012.06.10 16:11:44 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\vlc
[2012.05.28 10:02:35 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\Winamp
[2010.01.01 20:16:43 | 000,000,000 | ---D | M] -- C:\Users\FH\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2012.05.25 16:25:40 | 000,057,480 | ---- | M] () -- C:\Users\FH\AppData\Roaming\bluejeans\bjnplugin\1.0.0.220\bjnUpdatePlugin.exe
[2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\FH\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2012.02.15 01:03:44 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Users\FH\AppData\Roaming\Dropbox\bin\Uninstall.exe
[2011.12.18 20:32:48 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\FH\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2012.04.11 20:40:53 | 000,061,440 | R--- | M] (Acresso Software Inc.) -- C:\Users\FH\AppData\Roaming\Microsoft\Installer\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}\ARPPRODUCTICON.exe
[2010.08.11 20:30:50 | 000,335,872 | R--- | M] (InstallShield Software Corp.) -- C:\Users\FH\AppData\Roaming\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
[2011.10.08 21:05:29 | 000,053,248 | R--- | M] (Acresso Software Inc.) -- C:\Users\FH\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
[2012.01.16 20:29:46 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\FH\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
[2009.06.10 19:07:46 | 000,449,816 | ---- | M] (Tracker Software Products Ltd.) -- C:\Users\FH\AppData\Roaming\Tracker Software\LiveUpdate\Updates\LiveUpdate.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.04.10 10:23:56 | 000,409,112 | ---- | M] (Intel Corporation) MD5=F27742D576F355972C94952671658DC2 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.04.10 10:23:56 | 000,409,112 | ---- | M] (Intel Corporation) MD5=F27742D576F355972C94952671658DC2 -- C:\Windows\SysNative\drivers\iaStor.sys
[2009.04.10 10:23:56 | 000,409,112 | ---- | M] (Intel Corporation) MD5=F27742D576F355972C94952671658DC2 -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_8f0eb682dfbca40b\iaStor.sys
[2009.04.10 10:12:34 | 000,331,288 | ---- | M] (Intel Corporation) MD5=F397C2EBF0C01ED62F2A215018FDD221 -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 192 bytes -> C:\Windows:nlsPreferences
@Alternate Data Stream - 1211 bytes -> C:\ProgramData\Microsoft:ck9qpEKUMFdL4haXexlDj
@Alternate Data Stream - 1118 bytes -> C:\Program Files (x86)\Common Files\System:nwi1Gl8XuWH80eHoCayQDbwxI6G12R
@Alternate Data Stream - 1018 bytes -> C:\ProgramData\Microsoft:OimpulZPjuzt1pwO0p7Retjpbr

< End of report >
--- --- ---

cosinus 14.06.2012 12:10
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2736476
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F7 9F 0D 3D 98 D0 C9 01  [binary data]
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - No CLSID value found
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;<local>
O2 - BHO: (no name) - {C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} - No CLSID value found.
O3 - HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.09.23 07:58:44 | 000,000,019 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
@Alternate Data Stream - 192 bytes -> C:\Windows:nlsPreferences
@Alternate Data Stream - 1211 bytes -> C:\ProgramData\Microsoft:ck9qpEKUMFdL4haXexlDj
@Alternate Data Stream - 1118 bytes -> C:\Program Files (x86)\Common Files\System:nwi1Gl8XuWH80eHoCayQDbwxI6G12R
@Alternate Data Stream - 1018 bytes -> C:\ProgramData\Microsoft:OimpulZPjuzt1pwO0p7Retjpbr
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

myspam69 14.06.2012 19:22
Alles wie beschrieben erledigt. Hier ist das Logfile:

Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{7e111a5c-3d11-4f56-9463-5310c3c69025} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ not found.
HKEY_USERS\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}\ not found.
HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F}\ not found.
Registry value HKEY_USERS\S-1-5-21-3505417148-2086896735-3607467643-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
ADS C:\Windows:nlsPreferences deleted successfully.
ADS C:\ProgramData\Microsoft:ck9qpEKUMFdL4haXexlDj deleted successfully.
ADS C:\Program Files (x86)\Common Files\System:nwi1Gl8XuWH80eHoCayQDbwxI6G12R deleted successfully.
ADS C:\ProgramData\Microsoft:OimpulZPjuzt1pwO0p7Retjpbr deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: FH
->Temp folder emptied: 155744 bytes
->Temporary Internet Files folder emptied: 2242966 bytes
->Java cache emptied: 9778066 bytes
->FireFox cache emptied: 49404275 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 57206 bytes
 
User: FH.FH-PC
->Temp folder emptied: 54013 bytes
->Temporary Internet Files folder emptied: 32768 bytes
->Flash cache emptied: 2843 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 49152 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 60468026 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67697 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 117,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: FH
->Flash cache emptied: 0 bytes
 
User: FH.FH-PC
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.47.0 log created on 06142012_201542

Files\Folders moved on Reboot...
C:\Users\FH\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

cosinus 15.06.2012 12:07
Code:
[2012.06.06 21:55:54 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
Was hast du mit dem TDSS-Killer schon gemacht?

Dieses Tool ist KEIN Spielzeug! Man sollte niemals pauschal alle Funde mit dem Tool entfernen!

POste alle Logs vom TDSS-Killer, die müssten direkt auf C: liegen

myspam69 16.06.2012 10:07
TDSS Log:

Code:
21:53:44.0955 2600        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
21:53:45.0041 2600        ============================================================
21:53:45.0041 2600        Current date / time: 2012/06/06 21:53:45.0041
21:53:45.0041 2600        SystemInfo:
21:53:45.0041 2600       
21:53:45.0041 2600        OS Version: 6.1.7601 ServicePack: 1.0
21:53:45.0041 2600        Product type: Workstation
21:53:45.0042 2600        ComputerName: FH-PC
21:53:45.0042 2600        UserName: FH
21:53:45.0042 2600        Windows directory: C:\Windows
21:53:45.0042 2600        System windows directory: C:\Windows
21:53:45.0042 2600        Running under WOW64
21:53:45.0042 2600        Processor architecture: Intel x64
21:53:45.0042 2600        Number of processors: 2
21:53:45.0042 2600        Page size: 0x1000
21:53:45.0042 2600        Boot type: Normal boot
21:53:45.0042 2600        ============================================================
21:53:45.0294 2600        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0CADE00 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x700FC, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040
21:53:45.0303 2600        ============================================================
21:53:45.0303 2600        \Device\Harddisk0\DR0:
21:53:45.0304 2600        MBR partitions:
21:53:45.0304 2600        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
21:53:45.0304 2600        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x124C5800
21:53:45.0304 2600        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x124F8000, BlocksNum 0x55EBD000
21:53:45.0328 2600        \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x683B5800, BlocksNum 0xC350000
21:53:45.0328 2600        ============================================================
21:53:45.0391 2600        C: <-> \Device\Harddisk0\DR0\Partition1
21:53:45.0421 2600        D: <-> \Device\Harddisk0\DR0\Partition2
21:53:45.0450 2600        Z: <-> \Device\Harddisk0\DR0\Partition3
21:53:45.0450 2600        ============================================================
21:53:45.0450 2600        Initialize success
21:53:45.0450 2600        ============================================================
21:54:06.0527 2728        ============================================================
21:54:06.0527 2728        Scan started
21:54:06.0527 2728        Mode: Manual; SigCheck; TDLFS;
21:54:06.0527 2728        ============================================================
21:54:07.0172 2728        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:54:07.0227 2728        1394ohci - ok
21:54:07.0280 2728        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:54:07.0298 2728        ACPI - ok
21:54:07.0329 2728        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:54:07.0349 2728        AcpiPmi - ok
21:54:07.0453 2728        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:54:07.0464 2728        AdobeARMservice - ok
21:54:07.0572 2728        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:54:07.0585 2728        AdobeFlashPlayerUpdateSvc - ok
21:54:07.0635 2728        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:54:07.0651 2728        adp94xx - ok
21:54:07.0682 2728        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:54:07.0694 2728        adpahci - ok
21:54:07.0708 2728        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:54:07.0718 2728        adpu320 - ok
21:54:07.0750 2728        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:54:07.0788 2728        AeLookupSvc - ok
21:54:07.0854 2728        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:54:07.0888 2728        AFD - ok
21:54:07.0929 2728        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:54:07.0942 2728        agp440 - ok
21:54:08.0181 2728        Akamai          (c775d704feb2b600a5bf7b0b088546af) c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll
21:54:08.0181 2728        Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll. md5: c775d704feb2b600a5bf7b0b088546af
21:54:08.0187 2728        Akamai ( HiddenFile.Multi.Generic ) - warning
21:54:08.0188 2728        Akamai - detected HiddenFile.Multi.Generic (1)
21:54:08.0281 2728        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:54:08.0309 2728        ALG - ok
21:54:08.0366 2728        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:54:08.0378 2728        aliide - ok
21:54:08.0431 2728        AMD External Events Utility (a359974eaac83a435497c52f62a2e590) C:\Windows\system32\atiesrxx.exe
21:54:08.0459 2728        AMD External Events Utility - ok
21:54:08.0472 2728        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:54:08.0485 2728        amdide - ok
21:54:08.0505 2728        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:54:08.0541 2728        AmdK8 - ok
21:54:08.0972 2728        amdkmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:54:09.0072 2728        amdkmdag - ok
21:54:09.0216 2728        amdkmdap        (6b4e9261b613b047a9a145f328889968) C:\Windows\system32\DRIVERS\atikmpag.sys
21:54:09.0240 2728        amdkmdap - ok
21:54:09.0262 2728        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:54:09.0277 2728        AmdPPM - ok
21:54:09.0297 2728        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:54:09.0311 2728        amdsata - ok
21:54:09.0343 2728        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:54:09.0358 2728        amdsbs - ok
21:54:09.0379 2728        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:54:09.0391 2728        amdxata - ok
21:54:09.0457 2728        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:54:09.0512 2728        AppID - ok
21:54:09.0536 2728        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:54:09.0580 2728        AppIDSvc - ok
21:54:09.0611 2728        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:54:09.0651 2728        Appinfo - ok
21:54:09.0756 2728        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:54:09.0766 2728        Apple Mobile Device - ok
21:54:09.0817 2728        AppMgmt        (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
21:54:09.0841 2728        AppMgmt - ok
21:54:09.0862 2728        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:54:09.0876 2728        arc - ok
21:54:09.0883 2728        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:54:09.0895 2728        arcsas - ok
21:54:09.0979 2728        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:54:09.0990 2728        aspnet_state - ok
21:54:10.0010 2728        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:54:10.0051 2728        AsyncMac - ok
21:54:10.0077 2728        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:54:10.0085 2728        atapi - ok
21:54:10.0513 2728        atikmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:54:10.0601 2728        atikmdag - ok
21:54:10.0731 2728        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:54:10.0780 2728        AudioEndpointBuilder - ok
21:54:10.0785 2728        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:54:10.0815 2728        AudioSrv - ok
21:54:10.0857 2728        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:54:10.0890 2728        AxInstSV - ok
21:54:10.0968 2728        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:54:10.0996 2728        b06bdrv - ok
21:54:11.0039 2728        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:54:11.0064 2728        b57nd60a - ok
21:54:11.0100 2728        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:54:11.0121 2728        BDESVC - ok
21:54:11.0139 2728        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:54:11.0185 2728        Beep - ok
21:54:11.0241 2728        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:54:11.0299 2728        BFE - ok
21:54:11.0344 2728        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:54:11.0392 2728        BITS - ok
21:54:11.0436 2728        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:54:11.0462 2728        blbdrive - ok
21:54:11.0571 2728        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
21:54:11.0586 2728        Bonjour Service - ok
21:54:11.0619 2728        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:54:11.0628 2728        bowser - ok
21:54:11.0639 2728        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:54:11.0662 2728        BrFiltLo - ok
21:54:11.0681 2728        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:54:11.0701 2728        BrFiltUp - ok
21:54:11.0734 2728        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:54:11.0784 2728        Browser - ok
21:54:11.0812 2728        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:54:11.0834 2728        Brserid - ok
21:54:11.0862 2728        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:54:11.0886 2728        BrSerWdm - ok
21:54:11.0897 2728        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:54:11.0924 2728        BrUsbMdm - ok
21:54:11.0937 2728        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:54:11.0953 2728        BrUsbSer - ok
21:54:11.0982 2728        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:54:12.0003 2728        BTHMODEM - ok
21:54:12.0040 2728        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:54:12.0066 2728        bthserv - ok
21:54:12.0084 2728        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:54:12.0121 2728        cdfs - ok
21:54:12.0163 2728        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
21:54:12.0190 2728        cdrom - ok
21:54:12.0227 2728        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:54:12.0277 2728        CertPropSvc - ok
21:54:12.0300 2728        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:54:12.0313 2728        circlass - ok
21:54:12.0353 2728        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:54:12.0371 2728        CLFS - ok
21:54:12.0422 2728        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:54:12.0429 2728        clr_optimization_v2.0.50727_32 - ok
21:54:12.0476 2728        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:54:12.0487 2728        clr_optimization_v2.0.50727_64 - ok
21:54:12.0537 2728        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:54:12.0548 2728        clr_optimization_v4.0.30319_32 - ok
21:54:12.0570 2728        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:54:12.0582 2728        clr_optimization_v4.0.30319_64 - ok
21:54:12.0588 2728        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:54:12.0615 2728        CmBatt - ok
21:54:12.0636 2728        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:54:12.0648 2728        cmdide - ok
21:54:12.0687 2728        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
21:54:12.0713 2728        CNG - ok
21:54:12.0738 2728        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:54:12.0746 2728        Compbatt - ok
21:54:12.0776 2728        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:54:12.0788 2728        CompositeBus - ok
21:54:12.0800 2728        COMSysApp - ok
21:54:12.0810 2728        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:54:12.0819 2728        crcdisk - ok
21:54:12.0854 2728        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
21:54:12.0899 2728        CryptSvc - ok
21:54:12.0943 2728        CSC            (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
21:54:12.0969 2728        CSC - ok
21:54:13.0015 2728        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
21:54:13.0037 2728        CscService - ok
21:54:13.0085 2728        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:54:13.0142 2728        DcomLaunch - ok
21:54:13.0178 2728        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:54:13.0214 2728        defragsvc - ok
21:54:13.0265 2728        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:54:13.0315 2728        DfsC - ok
21:54:13.0354 2728        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:54:13.0381 2728        Dhcp - ok
21:54:13.0405 2728        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:54:13.0445 2728        discache - ok
21:54:13.0471 2728        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:54:13.0480 2728        Disk - ok
21:54:13.0510 2728        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:54:13.0530 2728        Dnscache - ok
21:54:13.0564 2728        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:54:13.0602 2728        dot3svc - ok
21:54:13.0631 2728        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:54:13.0675 2728        DPS - ok
21:54:13.0708 2728        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:54:13.0726 2728        drmkaud - ok
21:54:13.0795 2728        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:54:13.0822 2728        DXGKrnl - ok
21:54:13.0847 2728        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:54:13.0884 2728        EapHost - ok
21:54:14.0043 2728        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:54:14.0092 2728        ebdrv - ok
21:54:14.0178 2728        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:54:14.0206 2728        EFS - ok
21:54:14.0264 2728        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:54:14.0293 2728        ehRecvr - ok
21:54:14.0324 2728        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:54:14.0339 2728        ehSched - ok
21:54:14.0403 2728        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:54:14.0423 2728        elxstor - ok
21:54:14.0448 2728        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:54:14.0466 2728        ErrDev - ok
21:54:14.0526 2728        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:54:14.0576 2728        EventSystem - ok
21:54:14.0594 2728        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:54:14.0629 2728        exfat - ok
21:54:14.0648 2728        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:54:14.0685 2728        fastfat - ok
21:54:14.0751 2728        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:54:14.0782 2728        Fax - ok
21:54:14.0796 2728        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:54:14.0823 2728        fdc - ok
21:54:14.0852 2728        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:54:14.0900 2728        fdPHost - ok
21:54:14.0916 2728        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:54:14.0950 2728        FDResPub - ok
21:54:14.0966 2728        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:54:14.0975 2728        FileInfo - ok
21:54:14.0988 2728        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:54:15.0013 2728        Filetrace - ok
21:54:15.0027 2728        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:54:15.0036 2728        flpydisk - ok
21:54:15.0064 2728        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:54:15.0075 2728        FltMgr - ok
21:54:15.0146 2728        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:54:15.0174 2728        FontCache - ok
21:54:15.0246 2728        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:54:15.0255 2728        FontCache3.0.0.0 - ok
21:54:15.0292 2728        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:54:15.0305 2728        FsDepends - ok
21:54:15.0331 2728        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:54:15.0343 2728        Fs_Rec - ok
21:54:15.0384 2728        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:54:15.0403 2728        fvevol - ok
21:54:15.0424 2728        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:54:15.0433 2728        gagp30kx - ok
21:54:15.0462 2728        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
21:54:15.0468 2728        GEARAspiWDM - ok
21:54:15.0532 2728        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:54:15.0572 2728        gpsvc - ok
21:54:15.0602 2728        grmnusb        (b9893a68032a6d9addb5b98287c630f7) C:\Windows\system32\drivers\grmnusb.sys
21:54:15.0608 2728        grmnusb - ok
21:54:15.0666 2728        gusvc          (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
21:54:15.0679 2728        gusvc - ok
21:54:15.0693 2728        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:54:15.0711 2728        hcw85cir - ok
21:54:15.0773 2728        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:54:15.0799 2728        HdAudAddService - ok
21:54:15.0849 2728        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:54:15.0876 2728        HDAudBus - ok
21:54:15.0890 2728        hdgnlava - ok
21:54:15.0902 2728        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:54:15.0927 2728        HidBatt - ok
21:54:15.0944 2728        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:54:15.0968 2728        HidBth - ok
21:54:15.0986 2728        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:54:16.0017 2728        HidIr - ok
21:54:16.0040 2728        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:54:16.0088 2728        hidserv - ok
21:54:16.0115 2728        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:54:16.0133 2728        HidUsb - ok
21:54:16.0155 2728        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:54:16.0190 2728        hkmsvc - ok
21:54:16.0214 2728        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:54:16.0225 2728        HomeGroupListener - ok
21:54:16.0250 2728        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:54:16.0274 2728        HomeGroupProvider - ok
21:54:16.0365 2728        HotspotShieldService (b2afa712b3cdf8ad04d85c56546bb174) C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
21:54:16.0372 2728        HotspotShieldService ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0372 2728        HotspotShieldService - detected UnsignedFile.Multi.Generic (1)
21:54:16.0411 2728        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:54:16.0420 2728        HpSAMD - ok
21:54:16.0441 2728        HssDrv          (a60c877e1cd3aa2e4e5ccd8af305c0f1) C:\Windows\system32\DRIVERS\HssDrv.sys
21:54:16.0476 2728        HssDrv - ok
21:54:16.0537 2728        HssSrv          (b8b90bb7011556691d432aaecaa0d26c) C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
21:54:16.0544 2728        HssSrv ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0544 2728        HssSrv - detected UnsignedFile.Multi.Generic (1)
21:54:16.0575 2728        HssTrayService  (8faab97946600e312cb3398061ad3059) C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
21:54:16.0579 2728        HssTrayService ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0579 2728        HssTrayService - detected UnsignedFile.Multi.Generic (1)
21:54:16.0585 2728        HssWd - ok
21:54:16.0648 2728        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:54:16.0686 2728        HTTP - ok
21:54:16.0707 2728        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:54:16.0716 2728        hwpolicy - ok
21:54:16.0736 2728        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:54:16.0746 2728        i8042prt - ok
21:54:16.0809 2728        IAANTMON        (549275dc1004e09f92167b98b0ce63fe) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
21:54:16.0824 2728        IAANTMON - ok
21:54:16.0871 2728        iaStor          (f27742d576f355972c94952671658dc2) C:\Windows\system32\DRIVERS\iaStor.sys
21:54:16.0886 2728        iaStor - ok
21:54:16.0917 2728        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:54:16.0935 2728        iaStorV - ok
21:54:16.0974 2728        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:54:16.0987 2728        IDriverT ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0987 2728        IDriverT - detected UnsignedFile.Multi.Generic (1)
21:54:17.0077 2728        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:54:17.0096 2728        idsvc - ok
21:54:17.0187 2728        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:54:17.0200 2728        iirsp - ok
21:54:17.0263 2728        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:54:17.0321 2728        IKEEXT - ok
21:54:17.0336 2728        iktydhah - ok
21:54:17.0369 2728        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:54:17.0382 2728        intelide - ok
21:54:17.0402 2728        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:54:17.0426 2728        intelppm - ok
21:54:17.0483 2728        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:54:17.0532 2728        IPBusEnum - ok
21:54:17.0564 2728        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:54:17.0597 2728        IpFilterDriver - ok
21:54:17.0644 2728        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:54:17.0689 2728        iphlpsvc - ok
21:54:17.0705 2728        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:54:17.0725 2728        IPMIDRV - ok
21:54:17.0747 2728        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:54:17.0773 2728        IPNAT - ok
21:54:17.0897 2728        iPod Service    (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe
21:54:17.0920 2728        iPod Service - ok
21:54:17.0942 2728        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:54:17.0963 2728        IRENUM - ok
21:54:17.0980 2728        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:54:17.0989 2728        isapnp - ok
21:54:18.0010 2728        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:54:18.0021 2728        iScsiPrt - ok
21:54:18.0105 2728        ISODrive        (9c6f3f69163133fb8e56ac4a6e163452) C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys
21:54:18.0118 2728        ISODrive - ok
21:54:18.0141 2728        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
21:54:18.0154 2728        kbdclass - ok
21:54:18.0187 2728        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
21:54:18.0214 2728        kbdhid - ok
21:54:18.0237 2728        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:18.0251 2728        KeyIso - ok
21:54:18.0268 2728        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
21:54:18.0281 2728        KSecDD - ok
21:54:18.0298 2728        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
21:54:18.0313 2728        KSecPkg - ok
21:54:18.0341 2728        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:54:18.0389 2728        ksthunk - ok
21:54:18.0426 2728        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:54:18.0465 2728        KtmRm - ok
21:54:18.0513 2728        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:54:18.0557 2728        LanmanServer - ok
21:54:18.0583 2728        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:54:18.0618 2728        LanmanWorkstation - ok
21:54:18.0654 2728        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:54:18.0701 2728        lltdio - ok
21:54:18.0725 2728        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:54:18.0761 2728        lltdsvc - ok
21:54:18.0777 2728        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:54:18.0802 2728        lmhosts - ok
21:54:18.0829 2728        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:54:18.0839 2728        LSI_FC - ok
21:54:18.0847 2728        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:54:18.0856 2728        LSI_SAS - ok
21:54:18.0866 2728        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:54:18.0875 2728        LSI_SAS2 - ok
21:54:18.0890 2728        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:54:18.0899 2728        LSI_SCSI - ok
21:54:18.0924 2728        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:54:18.0959 2728        luafv - ok
21:54:18.0996 2728        LVPr2M64        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:54:19.0003 2728        LVPr2M64 - ok
21:54:19.0019 2728        LVPr2Mon        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:54:19.0026 2728        LVPr2Mon - ok
21:54:19.0060 2728        LVRS64          (0c85b2b6fb74b36a251792d45e0ef860) C:\Windows\system32\DRIVERS\lvrs64.sys
21:54:19.0072 2728        LVRS64 - ok
21:54:19.0296 2728        LVUVC64        (ff3a488924b0032b1a9ca6948c1fa9e8) C:\Windows\system32\DRIVERS\lvuvc64.sys
21:54:19.0360 2728        LVUVC64 - ok
21:54:19.0475 2728        MBAMProtector  (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
21:54:19.0489 2728        MBAMProtector - ok
21:54:19.0580 2728        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
21:54:19.0599 2728        MBAMService - ok
21:54:19.0620 2728        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:54:19.0640 2728        Mcx2Svc - ok
21:54:19.0668 2728        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:54:19.0676 2728        megasas - ok
21:54:19.0698 2728        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:54:19.0709 2728        MegaSR - ok
21:54:19.0743 2728        MEMSWEEP2      (f9ce67e9e0226079b59107b649851f96) C:\Windows\system32\2DB9.tmp
21:54:19.0755 2728        MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - warning
21:54:19.0755 2728        MEMSWEEP2 - detected UnsignedFile.Multi.Generic (1)
21:54:19.0829 2728        Microsoft SharePoint Workspace Audit Service - ok
21:54:19.0865 2728        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:54:19.0904 2728        MMCSS - ok
21:54:19.0919 2728        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:54:19.0951 2728        Modem - ok
21:54:19.0977 2728        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:54:19.0998 2728        monitor - ok
21:54:20.0032 2728        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:54:20.0045 2728        mouclass - ok
21:54:20.0062 2728        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:54:20.0080 2728        mouhid - ok
21:54:20.0100 2728        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:54:20.0109 2728        mountmgr - ok
21:54:20.0141 2728        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:54:20.0151 2728        mpio - ok
21:54:20.0169 2728        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:54:20.0195 2728        mpsdrv - ok
21:54:20.0263 2728        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:54:20.0325 2728        MpsSvc - ok
21:54:20.0353 2728        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:54:20.0377 2728        MRxDAV - ok
21:54:20.0400 2728        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:54:20.0425 2728        mrxsmb - ok
21:54:20.0460 2728        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:54:20.0489 2728        mrxsmb10 - ok
21:54:20.0521 2728        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:54:20.0535 2728        mrxsmb20 - ok
21:54:20.0547 2728        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:54:20.0560 2728        msahci - ok
21:54:20.0574 2728        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:54:20.0585 2728        msdsm - ok
21:54:20.0608 2728        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:54:20.0627 2728        MSDTC - ok
21:54:20.0660 2728        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:54:20.0685 2728        Msfs - ok
21:54:20.0694 2728        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:54:20.0732 2728        mshidkmdf - ok
21:54:20.0742 2728        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:54:20.0751 2728        msisadrv - ok
21:54:20.0789 2728        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:54:20.0843 2728        MSiSCSI - ok
21:54:20.0845 2728        msiserver - ok
21:54:20.0863 2728        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:54:20.0901 2728        MSKSSRV - ok
21:54:20.0916 2728        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:54:20.0956 2728        MSPCLOCK - ok
21:54:20.0959 2728        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:54:21.0000 2728        MSPQM - ok
21:54:21.0032 2728        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:54:21.0044 2728        MsRPC - ok
21:54:21.0058 2728        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:54:21.0067 2728        mssmbios - ok
21:54:21.0082 2728        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:54:21.0108 2728        MSTEE - ok
21:54:21.0123 2728        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:54:21.0141 2728        MTConfig - ok
21:54:21.0164 2728        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:54:21.0173 2728        Mup - ok
21:54:21.0219 2728        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:54:21.0248 2728        napagent - ok
21:54:21.0284 2728        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:54:21.0309 2728        NativeWifiP - ok
21:54:21.0370 2728        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:54:21.0397 2728        NDIS - ok
21:54:21.0422 2728        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:54:21.0456 2728        NdisCap - ok
21:54:21.0480 2728        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:54:21.0515 2728        NdisTapi - ok
21:54:21.0555 2728        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:54:21.0583 2728        Ndisuio - ok
21:54:21.0620 2728        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:54:21.0657 2728        NdisWan - ok
21:54:21.0682 2728        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:54:21.0715 2728        NDProxy - ok
21:54:21.0726 2728        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:54:21.0752 2728        NetBIOS - ok
21:54:21.0788 2728        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:54:21.0827 2728        NetBT - ok
21:54:21.0851 2728        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:21.0861 2728        Netlogon - ok
21:54:21.0908 2728        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:54:21.0948 2728        Netman - ok
21:54:22.0050 2728        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0061 2728        NetMsmqActivator - ok
21:54:22.0064 2728        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0075 2728        NetPipeActivator - ok
21:54:22.0111 2728        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:54:22.0154 2728        netprofm - ok
21:54:22.0159 2728        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0167 2728        NetTcpActivator - ok
21:54:22.0169 2728        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0177 2728        NetTcpPortSharing - ok
21:54:22.0220 2728        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:54:22.0233 2728        nfrd960 - ok
21:54:22.0274 2728        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:54:22.0313 2728        NlaSvc - ok
21:54:22.0410 2728        nlsX86cc        (b1ef4686961986dffb7fe8f18e6fcb5b) C:\Windows\SysWOW64\nlssrv32.exe
21:54:22.0419 2728        nlsX86cc - ok
21:54:22.0492 2728        NMSAccessU      (fd306fbcce7adb1077b709742e7148e9) C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
21:54:22.0502 2728        NMSAccessU - ok
21:54:22.0510 2728        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:54:22.0542 2728        Npfs - ok
21:54:22.0553 2728        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:54:22.0589 2728        nsi - ok
21:54:22.0603 2728        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:54:22.0638 2728        nsiproxy - ok
21:54:22.0735 2728        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:54:22.0769 2728        Ntfs - ok
21:54:22.0872 2728        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:54:22.0909 2728        Null - ok
21:54:22.0940 2728        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:54:22.0950 2728        nvraid - ok
21:54:22.0977 2728        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:54:22.0987 2728        nvstor - ok
21:54:23.0013 2728        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:54:23.0023 2728        nv_agp - ok
21:54:23.0037 2728        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:54:23.0056 2728        ohci1394 - ok
21:54:23.0111 2728        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:54:23.0122 2728        ose - ok
21:54:23.0411 2728        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:54:23.0475 2728        osppsvc - ok
21:54:23.0564 2728        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:54:23.0594 2728        p2pimsvc - ok
21:54:23.0629 2728        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:54:23.0648 2728        p2psvc - ok
21:54:23.0707 2728        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:54:23.0738 2728        Parport - ok
21:54:23.0764 2728        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:54:23.0777 2728        partmgr - ok
21:54:23.0794 2728        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:54:23.0828 2728        PcaSvc - ok
21:54:23.0861 2728        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:54:23.0876 2728        pci - ok
21:54:23.0891 2728        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:54:23.0903 2728        pciide - ok
21:54:23.0921 2728        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:54:23.0936 2728        pcmcia - ok
21:54:23.0947 2728        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:54:23.0956 2728        pcw - ok
21:54:23.0994 2728        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:54:24.0032 2728        PEAUTH - ok
21:54:24.0116 2728        PeerDistSvc    (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
21:54:24.0161 2728        PeerDistSvc - ok
21:54:24.0239 2728        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:54:24.0262 2728        PerfHost - ok
21:54:24.0395 2728        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:54:24.0446 2728        pla - ok
21:54:24.0486 2728        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:54:24.0511 2728        PlugPlay - ok
21:54:24.0528 2728        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:54:24.0552 2728        PNRPAutoReg - ok
21:54:24.0580 2728        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:54:24.0592 2728        PNRPsvc - ok
21:54:24.0653 2728        Point64        (33328fa8a580885ab0065be6db266e9f) C:\Windows\system32\DRIVERS\point64.sys
21:54:24.0663 2728        Point64 - ok
21:54:24.0711 2728        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:54:24.0763 2728        PolicyAgent - ok
21:54:24.0789 2728        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:54:24.0826 2728        Power - ok
21:54:24.0868 2728        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:54:24.0920 2728        PptpMiniport - ok
21:54:24.0944 2728        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:54:24.0960 2728        Processor - ok
21:54:24.0995 2728        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
21:54:25.0034 2728        ProfSvc - ok
21:54:25.0055 2728        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:25.0064 2728        ProtectedStorage - ok
21:54:25.0088 2728        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:54:25.0114 2728        Psched - ok
21:54:25.0163 2728        PSI            (fb46e9a827a8799ebd7bfa9128c91f37) C:\Windows\system32\DRIVERS\psi_mf.sys
21:54:25.0172 2728        PSI - ok
21:54:25.0201 2728        PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
21:54:25.0212 2728        PxHlpa64 - ok
21:54:25.0287 2728        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:54:25.0320 2728        ql2300 - ok
21:54:25.0422 2728        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:54:25.0432 2728        ql40xx - ok
21:54:25.0467 2728        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:54:25.0481 2728        QWAVE - ok
21:54:25.0518 2728        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:54:25.0544 2728        QWAVEdrv - ok
21:54:25.0554 2728        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:54:25.0595 2728        RasAcd - ok
21:54:25.0629 2728        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:54:25.0655 2728        RasAgileVpn - ok
21:54:25.0671 2728        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:54:25.0698 2728        RasAuto - ok
21:54:25.0717 2728        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:54:25.0749 2728        Rasl2tp - ok
21:54:25.0793 2728        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:54:25.0830 2728        RasMan - ok
21:54:25.0848 2728        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:54:25.0889 2728        RasPppoe - ok
21:54:25.0904 2728        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:54:25.0945 2728        RasSstp - ok
21:54:25.0980 2728        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:54:26.0020 2728        rdbss - ok
21:54:26.0030 2728        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:54:26.0049 2728        rdpbus - ok
21:54:26.0062 2728        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:54:26.0088 2728        RDPCDD - ok
21:54:26.0115 2728        RDPDR          (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
21:54:26.0125 2728        RDPDR - ok
21:54:26.0143 2728        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:54:26.0182 2728        RDPENCDD - ok
21:54:26.0200 2728        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:54:26.0226 2728        RDPREFMP - ok
21:54:26.0249 2728        RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
21:54:26.0265 2728        RdpVideoMiniport - ok
21:54:26.0301 2728        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
21:54:26.0323 2728        RDPWD - ok
21:54:26.0353 2728        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:54:26.0363 2728        rdyboost - ok
21:54:26.0391 2728        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:54:26.0426 2728        RemoteAccess - ok
21:54:26.0457 2728        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:54:26.0497 2728        RemoteRegistry - ok
21:54:26.0511 2728        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:54:26.0544 2728        RpcEptMapper - ok
21:54:26.0559 2728        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:54:26.0584 2728        RpcLocator - ok
21:54:26.0635 2728        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:54:26.0664 2728        RpcSs - ok
21:54:26.0699 2728        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:54:26.0725 2728        rspndr - ok
21:54:26.0784 2728        RTL8167        (fcaf9c2c9eadf8f397c3350760ef500f) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:54:26.0794 2728        RTL8167 - ok
21:54:26.0828 2728        RTL8169        (faeeed5a8949e6ba611a7b738ad28cee) C:\Windows\system32\DRIVERS\Rtlh64.sys
21:54:26.0854 2728        RTL8169 - ok
21:54:26.0890 2728        RtNdPt60        (2b38c905492f36fe42b59da52d6b4eb7) C:\Windows\system32\DRIVERS\RtNdPt60.sys
21:54:26.0904 2728        RtNdPt60 - ok
21:54:26.0932 2728        RTTEAMPT        (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:54:26.0939 2728        RTTEAMPT - ok
21:54:26.0948 2728        RTVLANPT        (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVlan60.sys
21:54:26.0969 2728        RTVLANPT - ok
21:54:26.0986 2728        s3cap          (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
21:54:27.0004 2728        s3cap - ok
21:54:27.0025 2728        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:27.0034 2728        SamSs - ok
21:54:27.0116 2728        SbieDrv        (0fe05dd9bbf0782e2bbf0977f2034616) C:\Program Files\Sandboxie\SbieDrv.sys
21:54:27.0126 2728        SbieDrv - ok
21:54:27.0164 2728        SbieSvc        (c970c7b2fd2e811525d4578d50b535f5) C:\Program Files\Sandboxie\SbieSvc.exe
21:54:27.0172 2728        SbieSvc - ok
21:54:27.0183 2728        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:54:27.0193 2728        sbp2port - ok
21:54:27.0222 2728        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:54:27.0250 2728        SCardSvr - ok
21:54:27.0271 2728        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:54:27.0320 2728        scfilter - ok
21:54:27.0395 2728        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:54:27.0449 2728        Schedule - ok
21:54:27.0478 2728        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:54:27.0503 2728        SCPolicySvc - ok
21:54:27.0536 2728        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:54:27.0553 2728        SDRSVC - ok
21:54:27.0620 2728        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:54:27.0645 2728        secdrv - ok
21:54:27.0659 2728        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:54:27.0694 2728        seclogon - ok
21:54:27.0794 2728        Secunia PSI Agent (7198bbfbe46c0070257278c536386687) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
21:54:27.0810 2728        Secunia PSI Agent - ok
21:54:27.0846 2728        Secunia Update Agent (d2fca567f9be87e29b9a9fa32ffe79ca) C:\Program Files (x86)\Secunia\PSI\sua.exe
21:54:27.0856 2728        Secunia Update Agent - ok
21:54:27.0936 2728        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:54:27.0976 2728        SENS - ok
21:54:27.0993 2728        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:54:28.0003 2728        SensrSvc - ok
21:54:28.0031 2728        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:54:28.0048 2728        Serenum - ok
21:54:28.0067 2728        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:54:28.0084 2728        Serial - ok
21:54:28.0124 2728        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:54:28.0142 2728        sermouse - ok
21:54:28.0174 2728        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:54:28.0210 2728        SessionEnv - ok
21:54:28.0235 2728        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:54:28.0263 2728        sffdisk - ok
21:54:28.0279 2728        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:54:28.0305 2728        sffp_mmc - ok
21:54:28.0322 2728        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:54:28.0353 2728        sffp_sd - ok
21:54:28.0366 2728        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:54:28.0377 2728        sfloppy - ok
21:54:28.0414 2728        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:54:28.0442 2728        SharedAccess - ok
21:54:28.0482 2728        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:54:28.0510 2728        ShellHWDetection - ok
21:54:28.0529 2728        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:54:28.0538 2728        SiSRaid2 - ok
21:54:28.0551 2728        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:54:28.0560 2728        SiSRaid4 - ok
21:54:28.0631 2728        SkypeUpdate    (17eab7852ff9f15fbaab4e95efc0b812) C:\Program Files (x86)\Skype\Updater\Updater.exe
21:54:28.0642 2728        SkypeUpdate - ok
21:54:28.0661 2728        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:54:28.0700 2728        Smb - ok
21:54:28.0733 2728        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:54:28.0744 2728        SNMPTRAP - ok
21:54:28.0755 2728        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:54:28.0764 2728        spldr - ok
21:54:28.0816 2728        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:54:28.0859 2728        Spooler - ok
21:54:29.0043 2728        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:54:29.0120 2728        sppsvc - ok
21:54:29.0184 2728        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:54:29.0235 2728        sppuinotify - ok
21:54:29.0329 2728        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:54:29.0360 2728        srv - ok
21:54:29.0408 2728        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:54:29.0439 2728        srv2 - ok
21:54:29.0462 2728        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:54:29.0484 2728        srvnet - ok
21:54:29.0520 2728        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:54:29.0570 2728        SSDPSRV - ok
21:54:29.0588 2728        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:54:29.0615 2728        SstpSvc - ok
21:54:29.0647 2728        StarOpen        (e57b778208c783d8debab320c16a1b82) C:\Windows\system32\drivers\StarOpen.sys
21:54:29.0659 2728        StarOpen ( UnsignedFile.Multi.Generic ) - warning
21:54:29.0659 2728        StarOpen - detected UnsignedFile.Multi.Generic (1)
21:54:29.0685 2728        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:54:29.0693 2728        stexstor - ok
21:54:29.0757 2728        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:54:29.0790 2728        stisvc - ok
21:54:29.0818 2728        storflt        (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
21:54:29.0827 2728        storflt - ok
21:54:29.0833 2728        storvsc        (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
21:54:29.0842 2728        storvsc - ok
21:54:29.0921 2728        STRATO HiDrive Service (a4533f6ee3dca68be5671c0571384e3a) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
21:54:29.0924 2728        STRATO HiDrive Service ( UnsignedFile.Multi.Generic ) - warning
21:54:29.0924 2728        STRATO HiDrive Service - detected UnsignedFile.Multi.Generic (1)
21:54:29.0944 2728        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:54:29.0957 2728        swenum - ok
21:54:30.0042 2728        SwitchBoard    (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
21:54:30.0069 2728        SwitchBoard ( UnsignedFile.Multi.Generic ) - warning
21:54:30.0069 2728        SwitchBoard - detected UnsignedFile.Multi.Generic (1)
21:54:30.0119 2728        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:54:30.0161 2728        swprv - ok
21:54:30.0164 2728        Synth3dVsc - ok
21:54:30.0262 2728        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:54:30.0314 2728        SysMain - ok
21:54:30.0413 2728        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:54:30.0433 2728        TabletInputService - ok
21:54:30.0467 2728        tap0901        (bcd6a90d6fd757ce9c29ddc850f7f231) C:\Windows\system32\DRIVERS\tap0901.sys
21:54:30.0486 2728        tap0901 - ok
21:54:30.0518 2728        taphss          (f33fdc72298df4bf9813a55d21f4eb31) C:\Windows\system32\DRIVERS\taphss.sys
21:54:30.0525 2728        taphss - ok
21:54:30.0566 2728        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:54:30.0603 2728        TapiSrv - ok
21:54:30.0627 2728        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:54:30.0654 2728        TBS - ok
21:54:30.0761 2728        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:54:30.0803 2728        Tcpip - ok
21:54:30.0940 2728        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:54:30.0972 2728        TCPIP6 - ok
21:54:31.0023 2728        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:54:31.0067 2728        tcpipreg - ok
21:54:31.0086 2728        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:54:31.0106 2728        TDPIPE - ok
21:54:31.0134 2728        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:54:31.0143 2728        TDTCP - ok
21:54:31.0181 2728        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:54:31.0206 2728        tdx - ok
21:54:31.0242 2728        TEAM            (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:54:31.0249 2728        TEAM - ok
21:54:31.0448 2728        TeamViewer7    (74fc70ae64a7b7dabec9697ce0a1f4fa) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
21:54:31.0489 2728        TeamViewer7 - ok
21:54:31.0553 2728        teamviewervpn  (f5520dbb47c60ee83024b38720abda24) C:\Windows\system32\DRIVERS\teamviewervpn.sys
21:54:31.0562 2728        teamviewervpn - ok
21:54:31.0585 2728        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:54:31.0599 2728        TermDD - ok
21:54:31.0647 2728        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:54:31.0700 2728        TermService - ok
21:54:31.0738 2728        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:54:31.0760 2728        Themes - ok
21:54:31.0785 2728        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:54:31.0811 2728        THREADORDER - ok
21:54:31.0846 2728        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:54:31.0886 2728        TrkWks - ok
21:54:31.0942 2728        truecrypt      (8de922cd4fea6f83b10805df965b9a08) C:\Windows\system32\drivers\truecrypt.sys
21:54:31.0956 2728        truecrypt - ok
21:54:32.0011 2728        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:54:32.0043 2728        TrustedInstaller - ok
21:54:32.0068 2728        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:54:32.0093 2728        tssecsrv - ok
21:54:32.0117 2728        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:54:32.0134 2728        TsUsbFlt - ok
21:54:32.0138 2728        tsusbhub - ok
21:54:32.0187 2728        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:54:32.0232 2728        tunnel - ok
21:54:32.0253 2728        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:54:32.0262 2728        uagp35 - ok
21:54:32.0306 2728        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:54:32.0357 2728        udfs - ok
21:54:32.0379 2728        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:54:32.0390 2728        UI0Detect - ok
21:54:32.0410 2728        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:54:32.0419 2728        uliagpkx - ok
21:54:32.0453 2728        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
21:54:32.0476 2728        umbus - ok
21:54:32.0498 2728        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:54:32.0519 2728        UmPass - ok
21:54:32.0554 2728        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
21:54:32.0582 2728        UmRdpService - ok
21:54:32.0694 2728        UMVPFSrv        (67a95b9d129ed5399e7965cd09cf30e7) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
21:54:32.0711 2728        UMVPFSrv - ok
21:54:32.0736 2728        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:54:32.0765 2728        upnphost - ok
21:54:32.0784 2728        USBAAPL64      (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys
21:54:32.0804 2728        USBAAPL64 - ok
21:54:32.0844 2728        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
21:54:32.0864 2728        usbaudio - ok
21:54:32.0885 2728        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:54:32.0895 2728        usbccgp - ok
21:54:32.0920 2728        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:54:32.0931 2728        usbcir - ok
21:54:32.0951 2728        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
21:54:32.0960 2728        usbehci - ok
21:54:32.0985 2728        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:54:33.0009 2728        usbhub - ok
21:54:33.0026 2728        usbohci        (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
21:54:33.0036 2728        usbohci - ok
21:54:33.0048 2728        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:54:33.0069 2728        usbprint - ok
21:54:33.0084 2728        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:54:33.0108 2728        USBSTOR - ok
21:54:33.0124 2728        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
21:54:33.0145 2728        usbuhci - ok
21:54:33.0173 2728        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:54:33.0212 2728        UxSms - ok
21:54:33.0232 2728        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:33.0242 2728        VaultSvc - ok
21:54:33.0255 2728        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:54:33.0264 2728        vdrvroot - ok
21:54:33.0311 2728        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:54:33.0350 2728        vds - ok
21:54:33.0362 2728        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:54:33.0373 2728        vga - ok
21:54:33.0385 2728        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:54:33.0420 2728        VgaSave - ok
21:54:33.0433 2728        VGPU - ok
21:54:33.0473 2728        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:54:33.0484 2728        vhdmp - ok
21:54:33.0493 2728        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:54:33.0503 2728        viaide - ok
21:54:33.0562 2728        VLAN            (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVLAN60.sys
21:54:33.0569 2728        VLAN - ok
21:54:33.0605 2728        vmbus          (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
21:54:33.0616 2728        vmbus - ok
21:54:33.0626 2728        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
21:54:33.0643 2728        VMBusHID - ok
21:54:33.0661 2728        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:54:33.0670 2728        volmgr - ok
21:54:33.0705 2728        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:54:33.0717 2728        volmgrx - ok
21:54:33.0743 2728        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:54:33.0754 2728        volsnap - ok
21:54:33.0775 2728        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:54:33.0785 2728        vsmraid - ok
21:54:33.0896 2728        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:54:33.0946 2728        VSS - ok
21:54:34.0039 2728        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
21:54:34.0065 2728        vwifibus - ok
21:54:34.0101 2728        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:54:34.0130 2728        W32Time - ok
21:54:34.0141 2728        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:54:34.0151 2728        WacomPen - ok
21:54:34.0193 2728        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:54:34.0225 2728        WANARP - ok
21:54:34.0234 2728        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:54:34.0258 2728        Wanarpv6 - ok
21:54:34.0344 2728        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:54:34.0377 2728        WatAdminSvc - ok
21:54:34.0465 2728        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:54:34.0498 2728        wbengine - ok
21:54:34.0579 2728        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:54:34.0600 2728        WbioSrvc - ok
21:54:34.0634 2728        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:54:34.0660 2728        wcncsvc - ok
21:54:34.0679 2728        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:54:34.0699 2728        WcsPlugInService - ok
21:54:34.0734 2728        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:54:34.0743 2728        Wd - ok
21:54:34.0782 2728        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:54:34.0797 2728        Wdf01000 - ok
21:54:34.0813 2728        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:54:34.0837 2728        WdiServiceHost - ok
21:54:34.0839 2728        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:54:34.0853 2728        WdiSystemHost - ok
21:54:34.0886 2728        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:54:34.0912 2728        WebClient - ok
21:54:34.0934 2728        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:54:34.0977 2728        Wecsvc - ok
21:54:34.0991 2728        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:54:35.0026 2728        wercplsupport - ok
21:54:35.0047 2728        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:54:35.0074 2728        WerSvc - ok
21:54:35.0101 2728        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:54:35.0127 2728        WfpLwf - ok
21:54:35.0135 2728        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:54:35.0144 2728        WIMMount - ok
21:54:35.0193 2728        WinDefend - ok
21:54:35.0201 2728        WinHttpAutoProxySvc - ok
21:54:35.0262 2728        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:54:35.0301 2728        Winmgmt - ok
21:54:35.0408 2728        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:54:35.0459 2728        WinRM - ok
21:54:35.0580 2728        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
21:54:35.0608 2728        WinUsb - ok
21:54:35.0669 2728        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:54:35.0708 2728        Wlansvc - ok
21:54:35.0728 2728        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:54:35.0738 2728        WmiAcpi - ok
21:54:35.0803 2728        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:54:35.0831 2728        wmiApSrv - ok
21:54:35.0901 2728        WMPNetworkSvc - ok
21:54:35.0918 2728        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:54:35.0932 2728        WPCSvc - ok
21:54:35.0962 2728        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:54:35.0979 2728        WPDBusEnum - ok
21:54:36.0002 2728        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:54:36.0053 2728        ws2ifsl - ok
21:54:36.0065 2728        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:54:36.0092 2728        wscsvc - ok
21:54:36.0094 2728        WSearch - ok
21:54:36.0223 2728        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
21:54:36.0284 2728        wuauserv - ok
21:54:36.0386 2728        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:54:36.0428 2728        WudfPf - ok
21:54:36.0465 2728        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:54:36.0503 2728        wudfsvc - ok
21:54:36.0541 2728        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:54:36.0556 2728        WwanSvc - ok
21:54:36.0576 2728        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
21:54:36.0940 2728        \Device\Harddisk0\DR0 - ok
21:54:36.0942 2728        Boot (0x1200)  (0bad36234d44da07ecd9352cabff905d) \Device\Harddisk0\DR0\Partition0
21:54:36.0944 2728        \Device\Harddisk0\DR0\Partition0 - ok
21:54:36.0968 2728        Boot (0x1200)  (777b13c19d7df68449108280f2a13010) \Device\Harddisk0\DR0\Partition1
21:54:36.0969 2728        \Device\Harddisk0\DR0\Partition1 - ok
21:54:36.0983 2728        Boot (0x1200)  (2bb9fa725471a7211fc6a271a3451b14) \Device\Harddisk0\DR0\Partition2
21:54:36.0984 2728        \Device\Harddisk0\DR0\Partition2 - ok
21:54:37.0012 2728        Boot (0x1200)  (886e4e72fb1c452c861462f8cfa669af) \Device\Harddisk0\DR0\Partition3
21:54:37.0012 2728        \Device\Harddisk0\DR0\Partition3 - ok
21:54:37.0013 2728        ============================================================
21:54:37.0013 2728        Scan finished
21:54:37.0013 2728        ============================================================
21:54:37.0022 1088        Detected object count: 9
21:54:37.0022 1088        Actual detected object count: 9
21:55:21.0260 1088        Akamai ( HiddenFile.Multi.Generic ) - skipped by user
21:55:21.0260 1088        Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip
21:55:21.0260 1088        HotspotShieldService ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0260 1088        HotspotShieldService ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0262 1088        HssSrv ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0262 1088        HssSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0263 1088        HssTrayService ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0263 1088        HssTrayService ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0264 1088        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0264 1088        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0265 1088        MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0265 1088        MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0266 1088        StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0266 1088        StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0268 1088        STRATO HiDrive Service ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0268 1088        STRATO HiDrive Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0269 1088        SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0269 1088        SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:29.0035 3192        ============================================================
21:55:29.0035 3192        Scan started
21:55:29.0035 3192        Mode: Manual;
21:55:29.0035 3192        ============================================================
21:55:29.0525 3192        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:55:29.0526 3192        1394ohci - ok
21:55:29.0563 3192        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:55:29.0564 3192        ACPI - ok
21:55:29.0591 3192        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:55:29.0591 3192        AcpiPmi - ok
21:55:29.0683 3192        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:55:29.0684 3192        AdobeARMservice - ok
21:55:29.0779 3192        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:55:29.0780 3192        AdobeFlashPlayerUpdateSvc - ok
21:55:29.0824 3192        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:55:29.0827 3192        adp94xx - ok
21:55:29.0855 3192        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:55:29.0857 3192        adpahci - ok
21:55:29.0872 3192        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:55:29.0873 3192        adpu320 - ok
21:55:29.0898 3192        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:55:29.0899 3192        AeLookupSvc - ok
21:55:29.0947 3192        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:55:29.0950 3192        AFD - ok
21:55:29.0961 3192        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:55:29.0961 3192        agp440 - ok
21:55:30.0185 3192        Akamai          (c775d704feb2b600a5bf7b0b088546af) c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll
21:55:30.0185 3192        Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll. md5: c775d704feb2b600a5bf7b0b088546af
21:55:30.0191 3192        Akamai ( HiddenFile.Multi.Generic ) - warning
21:55:30.0191 3192        Akamai - detected HiddenFile.Multi.Generic (1)
21:55:30.0280 3192        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:55:30.0281 3192        ALG - ok
21:55:30.0298 3192        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:55:30.0298 3192        aliide - ok
21:55:30.0329 3192        AMD External Events Utility (a359974eaac83a435497c52f62a2e590) C:\Windows\system32\atiesrxx.exe
21:55:30.0330 3192        AMD External Events Utility - ok
21:55:30.0338 3192        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:55:30.0338 3192        amdide - ok
21:55:30.0362 3192        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:55:30.0363 3192        AmdK8 - ok
21:55:30.0832 3192        amdkmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:55:30.0872 3192        amdkmdag - ok
21:55:30.0933 3192        amdkmdap        (6b4e9261b613b047a9a145f328889968) C:\Windows\system32\DRIVERS\atikmpag.sys
21:55:30.0935 3192        amdkmdap - ok
21:55:30.0953 3192        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:55:30.0953 3192        AmdPPM - ok
21:55:30.0971 3192        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:55:30.0972 3192        amdsata - ok
21:55:30.0992 3192        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:55:30.0993 3192        amdsbs - ok
21:55:31.0012 3192        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:55:31.0012 3192        amdxata - ok
21:55:31.0040 3192        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:55:31.0040 3192        AppID - ok
21:55:31.0060 3192        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:55:31.0061 3192        AppIDSvc - ok
21:55:31.0086 3192        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:55:31.0086 3192        Appinfo - ok
21:55:31.0182 3192        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:55:31.0183 3192        Apple Mobile Device - ok
21:55:31.0218 3192        AppMgmt        (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
21:55:31.0220 3192        AppMgmt - ok
21:55:31.0236 3192        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:55:31.0237 3192        arc - ok
21:55:31.0248 3192        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:55:31.0249 3192        arcsas - ok
21:55:31.0332 3192        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:55:31.0332 3192        aspnet_state - ok
21:55:31.0346 3192        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:55:31.0346 3192        AsyncMac - ok
21:55:31.0371 3192        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:55:31.0371 3192        atapi - ok
21:55:31.0778 3192        atikmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:55:31.0817 3192        atikmdag - ok
21:55:31.0934 3192        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:55:31.0938 3192        AudioEndpointBuilder - ok
21:55:31.0945 3192        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:55:31.0949 3192        AudioSrv - ok
21:55:31.0973 3192        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:55:31.0974 3192        AxInstSV - ok
21:55:32.0031 3192        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:55:32.0034 3192        b06bdrv - ok
21:55:32.0059 3192        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:55:32.0061 3192        b57nd60a - ok
21:55:32.0087 3192        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:55:32.0088 3192        BDESVC - ok
21:55:32.0094 3192        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:55:32.0094 3192        Beep - ok
21:55:32.0145 3192        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:55:32.0149 3192        BFE - ok
21:55:32.0194 3192        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:55:32.0200 3192        BITS - ok
21:55:32.0217 3192        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:55:32.0217 3192        blbdrive - ok
21:55:32.0287 3192        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
21:55:32.0290 3192        Bonjour Service - ok
21:55:32.0310 3192        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:55:32.0311 3192        bowser - ok
21:55:32.0323 3192        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:55:32.0324 3192        BrFiltLo - ok
21:55:32.0332 3192        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:55:32.0332 3192        BrFiltUp - ok
21:55:32.0368 3192        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:55:32.0369 3192        Browser - ok
21:55:32.0390 3192        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:55:32.0392 3192        Brserid - ok
21:55:32.0406 3192        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:55:32.0407 3192        BrSerWdm - ok
21:55:32.0417 3192        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:55:32.0417 3192        BrUsbMdm - ok
21:55:32.0423 3192        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:55:32.0424 3192        BrUsbSer - ok
21:55:32.0436 3192        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:55:32.0436 3192        BTHMODEM - ok
21:55:32.0468 3192        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:55:32.0469 3192        bthserv - ok
21:55:32.0487 3192        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:55:32.0488 3192        cdfs - ok
21:55:32.0517 3192        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
21:55:32.0518 3192        cdrom - ok
21:55:32.0547 3192        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:55:32.0548 3192        CertPropSvc - ok
21:55:32.0563 3192        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:55:32.0563 3192        circlass - ok
21:55:32.0587 3192        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:55:32.0589 3192        CLFS - ok
21:55:32.0644 3192        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:55:32.0645 3192        clr_optimization_v2.0.50727_32 - ok
21:55:32.0703 3192        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:55:32.0704 3192        clr_optimization_v2.0.50727_64 - ok
21:55:32.0760 3192        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:55:32.0761 3192        clr_optimization_v4.0.30319_32 - ok
21:55:32.0785 3192        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:55:32.0786 3192        clr_optimization_v4.0.30319_64 - ok
21:55:32.0794 3192        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:55:32.0794 3192        CmBatt - ok
21:55:32.0817 3192        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:55:32.0817 3192        cmdide - ok
21:55:32.0859 3192        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
21:55:32.0861 3192        CNG - ok
21:55:32.0885 3192        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:55:32.0886 3192        Compbatt - ok
21:55:32.0908 3192        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:55:32.0908 3192        CompositeBus - ok
21:55:32.0911 3192        COMSysApp - ok
21:55:32.0925 3192        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:55:32.0925 3192        crcdisk - ok
21:55:32.0949 3192        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
21:55:32.0951 3192        CryptSvc - ok
21:55:32.0983 3192        CSC            (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
21:55:32.0986 3192        CSC - ok
21:55:33.0028 3192        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
21:55:33.0032 3192        CscService - ok
21:55:33.0068 3192        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:55:33.0072 3192        DcomLaunch - ok
21:55:33.0112 3192        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:55:33.0114 3192        defragsvc - ok
21:55:33.0167 3192        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:55:33.0168 3192        DfsC - ok
21:55:33.0187 3192        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:55:33.0190 3192        Dhcp - ok
21:55:33.0200 3192        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:55:33.0201 3192        discache - ok
21:55:33.0216 3192        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:55:33.0216 3192        Disk - ok
21:55:33.0240 3192        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:55:33.0241 3192        Dnscache - ok
21:55:33.0277 3192        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:55:33.0279 3192        dot3svc - ok
21:55:33.0326 3192        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:55:33.0328 3192        DPS - ok
21:55:33.0354 3192        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:55:33.0355 3192        drmkaud - ok
21:55:33.0404 3192        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:55:33.0410 3192        DXGKrnl - ok
21:55:33.0445 3192        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:55:33.0446 3192        EapHost - ok
21:55:33.0594 3192        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:55:33.0613 3192        ebdrv - ok
21:55:33.0698 3192        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:55:33.0700 3192        EFS - ok
21:55:33.0760 3192        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:55:33.0764 3192        ehRecvr - ok
21:55:33.0795 3192        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:55:33.0795 3192        ehSched - ok
21:55:33.0845 3192        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:55:33.0848 3192        elxstor - ok
21:55:33.0869 3192        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:55:33.0869 3192        ErrDev - ok
21:55:33.0909 3192        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:55:33.0912 3192        EventSystem - ok
21:55:33.0931 3192        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:55:33.0933 3192        exfat - ok
21:55:33.0952 3192        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:55:33.0954 3192        fastfat - ok
21:55:34.0006 3192        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:55:34.0010 3192        Fax - ok
21:55:34.0027 3192        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:55:34.0027 3192        fdc - ok
21:55:34.0034 3192        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:55:34.0035 3192        fdPHost - ok
21:55:34.0048 3192        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:55:34.0049 3192        FDResPub - ok
21:55:34.0057 3192        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:55:34.0057 3192        FileInfo - ok
21:55:34.0070 3192        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:55:34.0070 3192        Filetrace - ok
21:55:34.0084 3192        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:55:34.0084 3192        flpydisk - ok
21:55:34.0121 3192        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:55:34.0123 3192        FltMgr - ok
21:55:34.0192 3192        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:55:34.0199 3192        FontCache - ok
21:55:34.0280 3192        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:55:34.0281 3192        FontCache3.0.0.0 - ok
21:55:34.0318 3192        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:55:34.0318 3192        FsDepends - ok
21:55:34.0341 3192        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:55:34.0341 3192        Fs_Rec - ok
21:55:34.0377 3192        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:55:34.0378 3192        fvevol - ok
21:55:34.0392 3192        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:55:34.0393 3192        gagp30kx - ok
21:55:34.0414 3192        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
21:55:34.0415 3192        GEARAspiWDM - ok
21:55:34.0468 3192        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:55:34.0473 3192        gpsvc - ok
21:55:34.0497 3192        grmnusb        (b9893a68032a6d9addb5b98287c630f7) C:\Windows\system32\drivers\grmnusb.sys
21:55:34.0497 3192        grmnusb - ok
21:55:34.0552 3192        gusvc          (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
21:55:34.0553 3192        gusvc - ok
21:55:34.0563 3192        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:55:34.0563 3192        hcw85cir - ok
21:55:34.0601 3192        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:55:34.0603 3192        HdAudAddService - ok
21:55:34.0636 3192        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:55:34.0640 3192        HDAudBus - ok
21:55:34.0643 3192        hdgnlava - ok
21:55:34.0657 3192        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:55:34.0657 3192        HidBatt - ok
21:55:34.0674 3192        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:55:34.0674 3192        HidBth - ok
21:55:34.0682 3192        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:55:34.0683 3192        HidIr - ok
21:55:34.0711 3192        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:55:34.0712 3192        hidserv - ok
21:55:34.0721 3192        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:55:34.0722 3192        HidUsb - ok
21:55:34.0745 3192        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:55:34.0746 3192        hkmsvc - ok
21:55:34.0779 3192        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:55:34.0781 3192        HomeGroupListener - ok
21:55:34.0798 3192        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:55:34.0801 3192        HomeGroupProvider - ok
21:55:34.0854 3192        HotspotShieldService (b2afa712b3cdf8ad04d85c56546bb174) C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
21:55:34.0855 3192        HotspotShieldService - ok
21:55:34.0885 3192        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:55:34.0886 3192        HpSAMD - ok
21:55:34.0906 3192        HssDrv          (a60c877e1cd3aa2e4e5ccd8af305c0f1) C:\Windows\system32\DRIVERS\HssDrv.sys
21:55:34.0907 3192        HssDrv - ok
21:55:34.0961 3192        HssSrv          (b8b90bb7011556691d432aaecaa0d26c) C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
21:55:34.0963 3192        HssSrv - ok
21:55:34.0990 3192        HssTrayService  (8faab97946600e312cb3398061ad3059) C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
21:55:34.0991 3192        HssTrayService - ok
21:55:34.0993 3192        HssWd - ok
21:55:35.0047 3192        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:55:35.0051 3192        HTTP - ok
21:55:35.0073 3192        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:55:35.0073 3192        hwpolicy - ok
21:55:35.0085 3192        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:55:35.0086 3192        i8042prt - ok
21:55:35.0148 3192        IAANTMON        (549275dc1004e09f92167b98b0ce63fe) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
21:55:35.0150 3192        IAANTMON - ok
21:55:35.0188 3192        iaStor          (f27742d576f355972c94952671658dc2) C:\Windows\system32\DRIVERS\iaStor.sys
21:55:35.0191 3192        iaStor - ok
21:55:35.0224 3192        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:55:35.0227 3192        iaStorV - ok
21:55:35.0266 3192        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:55:35.0267 3192        IDriverT - ok
21:55:35.0369 3192        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:55:35.0374 3192        idsvc - ok
21:55:35.0464 3192        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:55:35.0465 3192        iirsp - ok
21:55:35.0524 3192        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:55:35.0529 3192        IKEEXT - ok
21:55:35.0532 3192        iktydhah - ok
21:55:35.0563 3192        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:55:35.0564 3192        intelide - ok
21:55:35.0571 3192        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:55:35.0572 3192        intelppm - ok
21:55:35.0594 3192        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:55:35.0596 3192        IPBusEnum - ok
21:55:35.0618 3192        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:55:35.0619 3192        IpFilterDriver - ok
21:55:35.0663 3192        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:55:35.0667 3192        iphlpsvc - ok
21:55:35.0676 3192        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:55:35.0677 3192        IPMIDRV - ok
21:55:35.0694 3192        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:55:35.0694 3192        IPNAT - ok
21:55:35.0781 3192        iPod Service    (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe
21:55:35.0786 3192        iPod Service - ok
21:55:35.0798 3192        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:55:35.0799 3192        IRENUM - ok
21:55:35.0811 3192        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:55:35.0811 3192        isapnp - ok
21:55:35.0832 3192        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:55:35.0833 3192        iScsiPrt - ok
21:55:35.0894 3192        ISODrive        (9c6f3f69163133fb8e56ac4a6e163452) C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys
21:55:35.0895 3192        ISODrive - ok
21:55:35.0905 3192        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
21:55:35.0905 3192        kbdclass - ok
21:55:35.0926 3192        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
21:55:35.0927 3192        kbdhid - ok
21:55:35.0943 3192        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:35.0944 3192        KeyIso - ok
21:55:35.0957 3192        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
21:55:35.0958 3192        KSecDD - ok
21:55:35.0971 3192        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
21:55:35.0972 3192        KSecPkg - ok
21:55:35.0981 3192        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:55:35.0981 3192        ksthunk - ok
21:55:36.0018 3192        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:55:36.0021 3192        KtmRm - ok
21:55:36.0055 3192        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:55:36.0058 3192        LanmanServer - ok
21:55:36.0085 3192        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:55:36.0088 3192        LanmanWorkstation - ok
21:55:36.0108 3192        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:55:36.0108 3192        lltdio - ok
21:55:36.0130 3192        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:55:36.0133 3192        lltdsvc - ok
21:55:36.0148 3192        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:55:36.0150 3192        lmhosts - ok
21:55:36.0169 3192        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:55:36.0170 3192        LSI_FC - ok
21:55:36.0182 3192        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:55:36.0182 3192        LSI_SAS - ok
21:55:36.0196 3192        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:55:36.0197 3192        LSI_SAS2 - ok
21:55:36.0212 3192        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:55:36.0213 3192        LSI_SCSI - ok
21:55:36.0229 3192        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:55:36.0230 3192        luafv - ok
21:55:36.0252 3192        LVPr2M64        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:55:36.0252 3192        LVPr2M64 - ok
21:55:36.0254 3192        LVPr2Mon        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:55:36.0255 3192        LVPr2Mon - ok
21:55:36.0292 3192        LVRS64          (0c85b2b6fb74b36a251792d45e0ef860) C:\Windows\system32\DRIVERS\lvrs64.sys
21:55:36.0294 3192        LVRS64 - ok
21:55:36.0516 3192        LVUVC64        (ff3a488924b0032b1a9ca6948c1fa9e8) C:\Windows\system32\DRIVERS\lvuvc64.sys
21:55:36.0542 3192        LVUVC64 - ok
21:55:36.0658 3192        MBAMProtector  (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
21:55:36.0658 3192        MBAMProtector - ok
21:55:36.0713 3192        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
21:55:36.0717 3192        MBAMService - ok
21:55:36.0738 3192        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:55:36.0740 3192        Mcx2Svc - ok
21:55:36.0769 3192        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:55:36.0770 3192        megasas - ok
21:55:36.0791 3192        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:55:36.0793 3192        MegaSR - ok
21:55:36.0811 3192        MEMSWEEP2      (f9ce67e9e0226079b59107b649851f96) C:\Windows\system32\2DB9.tmp
21:55:36.0812 3192        MEMSWEEP2 - ok
21:55:36.0871 3192        Microsoft SharePoint Workspace Audit Service - ok
21:55:36.0892 3192        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:55:36.0894 3192        MMCSS - ok
21:55:36.0905 3192        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:55:36.0905 3192        Modem - ok
21:55:36.0930 3192        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:55:36.0931 3192        monitor - ok
21:55:36.0951 3192        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:55:36.0952 3192        mouclass - ok
21:55:36.0959 3192        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:55:36.0959 3192        mouhid - ok
21:55:36.0997 3192        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:55:36.0998 3192        mountmgr - ok
21:55:37.0030 3192        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:55:37.0031 3192        mpio - ok
21:55:37.0049 3192        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:55:37.0050 3192        mpsdrv - ok
21:55:37.0114 3192        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:55:37.0120 3192        MpsSvc - ok
21:55:37.0160 3192        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:55:37.0161 3192        MRxDAV - ok
21:55:37.0189 3192        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:55:37.0190 3192        mrxsmb - ok
21:55:37.0227 3192        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:55:37.0229 3192        mrxsmb10 - ok
21:55:37.0262 3192        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:55:37.0263 3192        mrxsmb20 - ok
21:55:37.0272 3192        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:55:37.0272 3192        msahci - ok
21:55:37.0289 3192        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:55:37.0291 3192        msdsm - ok
21:55:37.0317 3192        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:55:37.0319 3192        MSDTC - ok
21:55:37.0335 3192        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:55:37.0335 3192        Msfs - ok
21:55:37.0344 3192        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:55:37.0345 3192        mshidkmdf - ok
21:55:37.0368 3192        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:55:37.0368 3192        msisadrv - ok
21:55:37.0398 3192        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:55:37.0400 3192        MSiSCSI - ok
21:55:37.0403 3192        msiserver - ok
21:55:37.0414 3192        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:55:37.0415 3192        MSKSSRV - ok
21:55:37.0427 3192        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:55:37.0427 3192        MSPCLOCK - ok
21:55:37.0431 3192        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:55:37.0431 3192        MSPQM - ok
21:55:37.0467 3192        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:55:37.0470 3192        MsRPC - ok
21:55:37.0485 3192        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:55:37.0486 3192        mssmbios - ok
21:55:37.0501 3192        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:55:37.0502 3192        MSTEE - ok
21:55:37.0509 3192        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:55:37.0510 3192        MTConfig - ok
21:55:37.0524 3192        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:55:37.0525 3192        Mup - ok
21:55:37.0556 3192        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:55:37.0560 3192        napagent - ok
21:55:37.0587 3192        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:55:37.0589 3192        NativeWifiP - ok
21:55:37.0669 3192        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:55:37.0674 3192        NDIS - ok
21:55:37.0693 3192        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:55:37.0694 3192        NdisCap - ok
21:55:37.0702 3192        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:55:37.0703 3192        NdisTapi - ok
21:55:37.0728 3192        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:55:37.0729 3192        Ndisuio - ok
21:55:37.0764 3192        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:55:37.0766 3192        NdisWan - ok
21:55:37.0788 3192        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:55:37.0789 3192        NDProxy - ok
21:55:37.0799 3192        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:55:37.0799 3192        NetBIOS - ok
21:55:37.0820 3192        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:55:37.0821 3192        NetBT - ok
21:55:37.0841 3192        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:37.0842 3192        Netlogon - ok
21:55:37.0892 3192        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:55:37.0894 3192        Netman - ok
21:55:37.0981 3192        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:37.0982 3192        NetMsmqActivator - ok
21:55:37.0985 3192        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:37.0986 3192        NetPipeActivator - ok
21:55:38.0017 3192        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:55:38.0021 3192        netprofm - ok
21:55:38.0024 3192        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:38.0025 3192        NetTcpActivator - ok
21:55:38.0028 3192        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:38.0029 3192        NetTcpPortSharing - ok
21:55:38.0073 3192        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:55:38.0073 3192        nfrd960 - ok
21:55:38.0096 3192        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:55:38.0099 3192        NlaSvc - ok
21:55:38.0162 3192        nlsX86cc        (b1ef4686961986dffb7fe8f18e6fcb5b) C:\Windows\SysWOW64\nlssrv32.exe
21:55:38.0163 3192        nlsX86cc - ok
21:55:38.0234 3192        NMSAccessU      (fd306fbcce7adb1077b709742e7148e9) C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
21:55:38.0235 3192        NMSAccessU - ok
21:55:38.0245 3192        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:55:38.0245 3192        Npfs - ok
21:55:38.0255 3192        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:55:38.0257 3192        nsi - ok
21:55:38.0272 3192        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:55:38.0273 3192        nsiproxy - ok
21:55:38.0366 3192        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:55:38.0376 3192        Ntfs - ok
21:55:38.0442 3192        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:55:38.0442 3192        Null - ok
21:55:38.0468 3192        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:55:38.0469 3192        nvraid - ok
21:55:38.0496 3192        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:55:38.0497 3192        nvstor - ok
21:55:38.0524 3192        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:55:38.0525 3192        nv_agp - ok
21:55:38.0540 3192        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:55:38.0541 3192        ohci1394 - ok
21:55:38.0574 3192        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:55:38.0574 3192        ose - ok
21:55:38.0857 3192        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:55:38.0879 3192        osppsvc - ok
21:55:38.0946 3192        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:55:38.0949 3192        p2pimsvc - ok
21:55:38.0991 3192        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:55:38.0995 3192        p2psvc - ok
21:55:39.0039 3192        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:55:39.0040 3192        Parport - ok
21:55:39.0071 3192        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:55:39.0071 3192        partmgr - ok
21:55:39.0092 3192        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:55:39.0095 3192        PcaSvc - ok
21:55:39.0127 3192        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:55:39.0128 3192        pci - ok
21:55:39.0140 3192        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:55:39.0140 3192        pciide - ok
21:55:39.0161 3192        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:55:39.0163 3192        pcmcia - ok
21:55:39.0172 3192        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:55:39.0173 3192        pcw - ok
21:55:39.0212 3192        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:55:39.0216 3192        PEAUTH - ok
21:55:39.0296 3192        PeerDistSvc    (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
21:55:39.0305 3192        PeerDistSvc - ok
21:55:39.0365 3192        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:55:39.0366 3192        PerfHost - ok
21:55:39.0488 3192        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:55:39.0497 3192        pla - ok
21:55:39.0532 3192        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:55:39.0536 3192        PlugPlay - ok
21:55:39.0554 3192        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:55:39.0556 3192        PNRPAutoReg - ok
21:55:39.0582 3192        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:55:39.0585 3192        PNRPsvc - ok
21:55:39.0621 3192        Point64        (33328fa8a580885ab0065be6db266e9f) C:\Windows\system32\DRIVERS\point64.sys
21:55:39.0622 3192        Point64 - ok
21:55:39.0671 3192        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:55:39.0675 3192        PolicyAgent - ok
21:55:39.0699 3192        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:55:39.0702 3192        Power - ok
21:55:39.0730 3192        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:55:39.0730 3192        PptpMiniport - ok
21:55:39.0757 3192        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:55:39.0757 3192        Processor - ok
21:55:39.0775 3192        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
21:55:39.0778 3192        ProfSvc - ok
21:55:39.0802 3192        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:39.0803 3192        ProtectedStorage - ok
21:55:39.0827 3192        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:55:39.0828 3192        Psched - ok
21:55:39.0852 3192        PSI            (fb46e9a827a8799ebd7bfa9128c91f37) C:\Windows\system32\DRIVERS\psi_mf.sys
21:55:39.0852 3192        PSI - ok
21:55:39.0883 3192        PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
21:55:39.0883 3192        PxHlpa64 - ok
21:55:39.0962 3192        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:55:39.0968 3192        ql2300 - ok
21:55:40.0045 3192        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:55:40.0046 3192        ql40xx - ok
21:55:40.0082 3192        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:55:40.0085 3192        QWAVE - ok
21:55:40.0098 3192        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:55:40.0098 3192        QWAVEdrv - ok
21:55:40.0111 3192        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:55:40.0111 3192        RasAcd - ok
21:55:40.0136 3192        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:55:40.0137 3192        RasAgileVpn - ok
21:55:40.0151 3192        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:55:40.0153 3192        RasAuto - ok
21:55:40.0175 3192        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:55:40.0176 3192        Rasl2tp - ok
21:55:40.0212 3192        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:55:40.0216 3192        RasMan - ok
21:55:40.0233 3192        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:55:40.0234 3192        RasPppoe - ok
21:55:40.0248 3192        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:55:40.0248 3192        RasSstp - ok
21:55:40.0291 3192        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:55:40.0293 3192        rdbss - ok
21:55:40.0307 3192        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:55:40.0307 3192        rdpbus - ok
21:55:40.0314 3192        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:55:40.0315 3192        RDPCDD - ok
21:55:40.0342 3192        RDPDR          (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
21:55:40.0343 3192        RDPDR - ok
21:55:40.0354 3192        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:55:40.0354 3192        RDPENCDD - ok
21:55:40.0361 3192        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:55:40.0361 3192        RDPREFMP - ok
21:55:40.0385 3192        RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
21:55:40.0385 3192        RdpVideoMiniport - ok
21:55:40.0420 3192        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
21:55:40.0422 3192        RDPWD - ok
21:55:40.0455 3192        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:55:40.0457 3192        rdyboost - ok
21:55:40.0485 3192        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:55:40.0487 3192        RemoteAccess - ok
21:55:40.0502 3192        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:55:40.0504 3192        RemoteRegistry - ok
21:55:40.0523 3192        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:55:40.0525 3192        RpcEptMapper - ok
21:55:40.0537 3192        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:55:40.0539 3192        RpcLocator - ok
21:55:40.0586 3192        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:55:40.0590 3192        RpcSs - ok
21:55:40.0603 3192        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:55:40.0604 3192        rspndr - ok
21:55:40.0647 3192        RTL8167        (fcaf9c2c9eadf8f397c3350760ef500f) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:55:40.0649 3192        RTL8167 - ok
21:55:40.0682 3192        RTL8169        (faeeed5a8949e6ba611a7b738ad28cee) C:\Windows\system32\DRIVERS\Rtlh64.sys
21:55:40.0682 3192        RTL8169 - ok
21:55:40.0702 3192        RtNdPt60        (2b38c905492f36fe42b59da52d6b4eb7) C:\Windows\system32\DRIVERS\RtNdPt60.sys
21:55:40.0703 3192        RtNdPt60 - ok
21:55:40.0711 3192        RTTEAMPT        (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:55:40.0712 3192        RTTEAMPT - ok
21:55:40.0727 3192        RTVLANPT        (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVlan60.sys
21:55:40.0728 3192        RTVLANPT - ok
21:55:40.0749 3192        s3cap          (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
21:55:40.0750 3192        s3cap - ok
21:55:40.0771 3192        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:40.0772 3192        SamSs - ok
21:55:40.0845 3192        SbieDrv        (0fe05dd9bbf0782e2bbf0977f2034616) C:\Program Files\Sandboxie\SbieDrv.sys
21:55:40.0846 3192        SbieDrv - ok
21:55:40.0869 3192        SbieSvc        (c970c7b2fd2e811525d4578d50b535f5) C:\Program Files\Sandboxie\SbieSvc.exe
21:55:40.0870 3192        SbieSvc - ok
21:55:40.0888 3192        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:55:40.0889 3192        sbp2port - ok
21:55:40.0919 3192        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:55:40.0921 3192        SCardSvr - ok
21:55:40.0942 3192        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:55:40.0942 3192        scfilter - ok
21:55:41.0012 3192        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:55:41.0020 3192        Schedule - ok
21:55:41.0051 3192        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:55:41.0052 3192        SCPolicySvc - ok
21:55:41.0079 3192        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:55:41.0082 3192        SDRSVC - ok
21:55:41.0134 3192        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:55:41.0134 3192        secdrv - ok
21:55:41.0151 3192        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:55:41.0153 3192        seclogon - ok
21:55:41.0244 3192        Secunia PSI Agent (7198bbfbe46c0070257278c536386687) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
21:55:41.0250 3192        Secunia PSI Agent - ok
21:55:41.0281 3192        Secunia Update Agent (d2fca567f9be87e29b9a9fa32ffe79ca) C:\Program Files (x86)\Secunia\PSI\sua.exe
21:55:41.0283 3192        Secunia Update Agent - ok
21:55:41.0362 3192        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:55:41.0364 3192        SENS - ok
21:55:41.0377 3192        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:55:41.0379 3192        SensrSvc - ok
21:55:41.0390 3192        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:55:41.0391 3192        Serenum - ok
21:55:41.0409 3192        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:55:41.0410 3192        Serial - ok
21:55:41.0433 3192        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:55:41.0434 3192        sermouse - ok
21:55:41.0468 3192        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:55:41.0470 3192        SessionEnv - ok
21:55:41.0495 3192        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:55:41.0496 3192        sffdisk - ok
21:55:41.0507 3192        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:55:41.0507 3192        sffp_mmc - ok
21:55:41.0511 3192        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:55:41.0511 3192        sffp_sd - ok
21:55:41.0529 3192        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:55:41.0530 3192        sfloppy - ok
21:55:41.0570 3192        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:55:41.0573 3192        SharedAccess - ok
21:55:41.0604 3192        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:55:41.0608 3192        ShellHWDetection - ok
21:55:41.0618 3192        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:55:41.0619 3192        SiSRaid2 - ok
21:55:41.0631 3192        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:55:41.0632 3192        SiSRaid4 - ok
21:55:41.0695 3192        SkypeUpdate    (17eab7852ff9f15fbaab4e95efc0b812) C:\Program Files (x86)\Skype\Updater\Updater.exe
21:55:41.0696 3192        SkypeUpdate - ok
21:55:41.0717 3192        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:55:41.0718 3192        Smb - ok
21:55:41.0739 3192        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:55:41.0741 3192        SNMPTRAP - ok
21:55:41.0752 3192        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:55:41.0753 3192        spldr - ok
21:55:41.0789 3192        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:55:41.0794 3192        Spooler - ok
21:55:41.0978 3192        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:55:41.0998 3192        sppsvc - ok
21:55:42.0067 3192        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:55:42.0069 3192        sppuinotify - ok
21:55:42.0132 3192        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:55:42.0134 3192        srv - ok
21:55:42.0171 3192        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:55:42.0173 3192        srv2 - ok
21:55:42.0189 3192        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:55:42.0190 3192        srvnet - ok
21:55:42.0212 3192        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:55:42.0214 3192        SSDPSRV - ok
21:55:42.0224 3192        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:55:42.0227 3192        SstpSvc - ok
21:55:42.0242 3192        StarOpen        (e57b778208c783d8debab320c16a1b82) C:\Windows\system32\drivers\StarOpen.sys
21:55:42.0242 3192        StarOpen - ok
21:55:42.0271 3192        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:55:42.0272 3192        stexstor - ok
21:55:42.0324 3192        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:55:42.0329 3192        stisvc - ok
21:55:42.0356 3192        storflt        (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
21:55:42.0356 3192        storflt - ok
21:55:42.0364 3192        storvsc        (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
21:55:42.0365 3192        storvsc - ok
21:55:42.0419 3192        STRATO HiDrive Service (a4533f6ee3dca68be5671c0571384e3a) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
21:55:42.0420 3192        STRATO HiDrive Service - ok
21:55:42.0443 3192        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:55:42.0443 3192        swenum - ok
21:55:42.0514 3192        SwitchBoard    (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
21:55:42.0518 3192        SwitchBoard - ok
21:55:42.0554 3192        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:55:42.0559 3192        swprv - ok
21:55:42.0564 3192        Synth3dVsc - ok
21:55:42.0666 3192        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:55:42.0677 3192        SysMain - ok
21:55:42.0755 3192        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:55:42.0757 3192        TabletInputService - ok
21:55:42.0793 3192        tap0901        (bcd6a90d6fd757ce9c29ddc850f7f231) C:\Windows\system32\DRIVERS\tap0901.sys
21:55:42.0794 3192        tap0901 - ok
21:55:42.0820 3192        taphss          (f33fdc72298df4bf9813a55d21f4eb31) C:\Windows\system32\DRIVERS\taphss.sys
21:55:42.0820 3192        taphss - ok
21:55:42.0862 3192        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:55:42.0865 3192        TapiSrv - ok
21:55:42.0888 3192        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:55:42.0891 3192        TBS - ok
21:55:43.0007 3192        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:55:43.0018 3192        Tcpip - ok
21:55:43.0119 3192        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:55:43.0130 3192        TCPIP6 - ok
21:55:43.0187 3192        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:55:43.0188 3192        tcpipreg - ok
21:55:43.0209 3192        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:55:43.0209 3192        TDPIPE - ok
21:55:43.0232 3192        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:55:43.0232 3192        TDTCP - ok
21:55:43.0262 3192        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:55:43.0263 3192        tdx - ok
21:55:43.0290 3192        TEAM            (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:55:43.0290 3192        TEAM - ok
21:55:43.0489 3192        TeamViewer7    (74fc70ae64a7b7dabec9697ce0a1f4fa) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
21:55:43.0506 3192        TeamViewer7 - ok
21:55:43.0551 3192        teamviewervpn  (f5520dbb47c60ee83024b38720abda24) C:\Windows\system32\DRIVERS\teamviewervpn.sys
21:55:43.0551 3192        teamviewervpn - ok
21:55:43.0576 3192        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:55:43.0576 3192        TermDD - ok
21:55:43.0634 3192        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:55:43.0639 3192        TermService - ok
21:55:43.0661 3192        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:55:43.0663 3192        Themes - ok
21:55:43.0692 3192        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:55:43.0693 3192        THREADORDER - ok
21:55:43.0711 3192        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:55:43.0713 3192        TrkWks - ok
21:55:43.0746 3192        truecrypt      (8de922cd4fea6f83b10805df965b9a08) C:\Windows\system32\drivers\truecrypt.sys
21:55:43.0748 3192        truecrypt - ok
21:55:43.0805 3192        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:55:43.0806 3192        TrustedInstaller - ok
21:55:43.0829 3192        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:55:43.0830 3192        tssecsrv - ok
21:55:43.0853 3192        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:55:43.0854 3192        TsUsbFlt - ok
21:55:43.0857 3192        tsusbhub - ok
21:55:43.0888 3192        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:55:43.0889 3192        tunnel - ok
21:55:43.0916 3192        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:55:43.0917 3192        uagp35 - ok
21:55:43.0955 3192        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:55:43.0957 3192        udfs - ok
21:55:43.0977 3192        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:55:43.0979 3192        UI0Detect - ok
21:55:43.0991 3192        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:55:43.0992 3192        uliagpkx - ok
21:55:44.0017 3192        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
21:55:44.0018 3192        umbus - ok
21:55:44.0030 3192        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:55:44.0030 3192        UmPass - ok
21:55:44.0069 3192        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
21:55:44.0071 3192        UmRdpService - ok
21:55:44.0166 3192        UMVPFSrv        (67a95b9d129ed5399e7965cd09cf30e7) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
21:55:44.0168 3192        UMVPFSrv - ok
21:55:44.0193 3192        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:55:44.0196 3192        upnphost - ok
21:55:44.0208 3192        USBAAPL64      (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys
21:55:44.0208 3192        USBAAPL64 - ok
21:55:44.0231 3192        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
21:55:44.0232 3192        usbaudio - ok
21:55:44.0251 3192        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:55:44.0252 3192        usbccgp - ok
21:55:44.0277 3192        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:55:44.0278 3192        usbcir - ok
21:55:44.0301 3192        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
21:55:44.0301 3192        usbehci - ok
21:55:44.0325 3192        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:55:44.0327 3192        usbhub - ok
21:55:44.0343 3192        usbohci        (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
21:55:44.0343 3192        usbohci - ok
21:55:44.0348 3192        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:55:44.0348 3192        usbprint - ok
21:55:44.0367 3192        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:55:44.0368 3192        USBSTOR - ok
21:55:44.0382 3192        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
21:55:44.0382 3192        usbuhci - ok
21:55:44.0407 3192        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:55:44.0408 3192        UxSms - ok
21:55:44.0424 3192        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:44.0425 3192        VaultSvc - ok
21:55:44.0431 3192        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:55:44.0431 3192        vdrvroot - ok
21:55:44.0478 3192        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:55:44.0481 3192        vds - ok
21:55:44.0496 3192        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:55:44.0496 3192        vga - ok
21:55:44.0510 3192        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:55:44.0511 3192        VgaSave - ok
21:55:44.0513 3192        VGPU - ok
21:55:44.0536 3192        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:55:44.0537 3192        vhdmp - ok
21:55:44.0544 3192        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:55:44.0544 3192        viaide - ok
21:55:44.0572 3192        VLAN            (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVLAN60.sys
21:55:44.0572 3192        VLAN - ok
21:55:44.0590 3192        vmbus          (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
21:55:44.0591 3192        vmbus - ok
21:55:44.0603 3192        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
21:55:44.0603 3192        VMBusHID - ok
21:55:44.0612 3192        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:55:44.0613 3192        volmgr - ok
21:55:44.0648 3192        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:55:44.0650 3192        volmgrx - ok
21:55:44.0676 3192        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:55:44.0677 3192        volsnap - ok
21:55:44.0692 3192        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:55:44.0693 3192        vsmraid - ok
21:55:44.0772 3192        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:55:44.0780 3192        VSS - ok
21:55:44.0876 3192        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
21:55:44.0876 3192        vwifibus - ok
21:55:44.0924 3192        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:55:44.0926 3192        W32Time - ok
21:55:44.0936 3192        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:55:44.0936 3192        WacomPen - ok
21:55:44.0954 3192        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:55:44.0955 3192        WANARP - ok
21:55:44.0957 3192        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:55:44.0957 3192        Wanarpv6 - ok
21:55:45.0034 3192        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:55:45.0039 3192        WatAdminSvc - ok
21:55:45.0120 3192        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:55:45.0128 3192        wbengine - ok
21:55:45.0183 3192        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:55:45.0185 3192        WbioSrvc - ok
21:55:45.0223 3192        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:55:45.0226 3192        wcncsvc - ok
21:55:45.0235 3192        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:55:45.0237 3192        WcsPlugInService - ok
21:55:45.0257 3192        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:55:45.0258 3192        Wd - ok
21:55:45.0297 3192        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:55:45.0299 3192        Wdf01000 - ok
21:55:45.0312 3192        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:55:45.0314 3192        WdiServiceHost - ok
21:55:45.0315 3192        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:55:45.0317 3192        WdiSystemHost - ok
21:55:45.0351 3192        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:55:45.0353 3192        WebClient - ok
21:55:45.0374 3192        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:55:45.0377 3192        Wecsvc - ok
21:55:45.0389 3192        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:55:45.0391 3192        wercplsupport - ok
21:55:45.0405 3192        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:55:45.0407 3192        WerSvc - ok
21:55:45.0417 3192        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:55:45.0418 3192        WfpLwf - ok
21:55:45.0432 3192        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:55:45.0432 3192        WIMMount - ok
21:55:45.0477 3192        WinDefend - ok
21:55:45.0482 3192        WinHttpAutoProxySvc - ok
21:55:45.0537 3192        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:55:45.0538 3192        Winmgmt - ok
21:55:45.0660 3192        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:55:45.0669 3192        WinRM - ok
21:55:45.0754 3192        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
21:55:45.0755 3192        WinUsb - ok
21:55:45.0824 3192        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:55:45.0830 3192        Wlansvc - ok
21:55:45.0852 3192        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:55:45.0852 3192        WmiAcpi - ok
21:55:45.0877 3192        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:55:45.0879 3192        wmiApSrv - ok
21:55:45.0925 3192        WMPNetworkSvc - ok
21:55:45.0942 3192        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:55:45.0945 3192        WPCSvc - ok
21:55:45.0978 3192        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:55:45.0981 3192        WPDBusEnum - ok
21:55:46.0002 3192        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:55:46.0002 3192        ws2ifsl - ok
21:55:46.0020 3192        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:55:46.0023 3192        wscsvc - ok
21:55:46.0026 3192        WSearch - ok
21:55:46.0153 3192        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
21:55:46.0164 3192        wuauserv - ok
21:55:46.0253 3192        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:55:46.0254 3192        WudfPf - ok
21:55:46.0274 3192        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:55:46.0276 3192        wudfsvc - ok
21:55:46.0301 3192        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:55:46.0304 3192        WwanSvc - ok
21:55:46.0328 3192        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
21:55:46.0628 3192        \Device\Harddisk0\DR0 - ok
21:55:46.0630 3192        Boot (0x1200)  (0bad36234d44da07ecd9352cabff905d) \Device\Harddisk0\DR0\Partition0
21:55:46.0635 3192        \Device\Harddisk0\DR0\Partition0 - ok
21:55:46.0647 3192        Boot (0x1200)  (777b13c19d7df68449108280f2a13010) \Device\Harddisk0\DR0\Partition1
21:55:46.0648 3192        \Device\Harddisk0\DR0\Partition1 - ok
21:55:46.0662 3192        Boot (0x1200)  (2bb9fa725471a7211fc6a271a3451b14) \Device\Harddisk0\DR0\Partition2
21:55:46.0663 3192        \Device\Harddisk0\DR0\Partition2 - ok
21:55:46.0691 3192        Boot (0x1200)  (886e4e72fb1c452c861462f8cfa669af) \Device\Harddisk0\DR0\Partition3
21:55:46.0692 3192        \Device\Harddisk0\DR0\Partition3 - ok
21:55:46.0692 3192        ============================================================
21:55:46.0692 3192        Scan finished
21:55:46.0692 3192        ============================================================
21:55:46.0700 5008        Detected object count: 1
21:55:46.0700 5008        Actual detected object count: 1
21:55:54.0884 5008        c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll - copied to quarantine
21:55:54.0885 5008        Akamai ( HiddenFile.Multi.Generic ) - User select action: Quarantine
21:56:27.0397 3308        Deinitialize success

myspam69 16.06.2012 22:08
TDSS Killer-Log:

Code:
21:53:44.0955 2600        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
21:53:45.0041 2600        ============================================================
21:53:45.0041 2600        Current date / time: 2012/06/06 21:53:45.0041
21:53:45.0041 2600        SystemInfo:
21:53:45.0041 2600       
21:53:45.0041 2600        OS Version: 6.1.7601 ServicePack: 1.0
21:53:45.0041 2600        Product type: Workstation
21:53:45.0042 2600        ComputerName: FH-PC
21:53:45.0042 2600        UserName: FH
21:53:45.0042 2600        Windows directory: C:\Windows
21:53:45.0042 2600        System windows directory: C:\Windows
21:53:45.0042 2600        Running under WOW64
21:53:45.0042 2600        Processor architecture: Intel x64
21:53:45.0042 2600        Number of processors: 2
21:53:45.0042 2600        Page size: 0x1000
21:53:45.0042 2600        Boot type: Normal boot
21:53:45.0042 2600        ============================================================
21:53:45.0294 2600        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0CADE00 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x700FC, SectorsPerTrack: 0x13, TracksPerCylinder: 0xE0, Type 'K0', Flags 0x00000040
21:53:45.0303 2600        ============================================================
21:53:45.0303 2600        \Device\Harddisk0\DR0:
21:53:45.0304 2600        MBR partitions:
21:53:45.0304 2600        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
21:53:45.0304 2600        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x124C5800
21:53:45.0304 2600        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x124F8000, BlocksNum 0x55EBD000
21:53:45.0328 2600        \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x683B5800, BlocksNum 0xC350000
21:53:45.0328 2600        ============================================================
21:53:45.0391 2600        C: <-> \Device\Harddisk0\DR0\Partition1
21:53:45.0421 2600        D: <-> \Device\Harddisk0\DR0\Partition2
21:53:45.0450 2600        Z: <-> \Device\Harddisk0\DR0\Partition3
21:53:45.0450 2600        ============================================================
21:53:45.0450 2600        Initialize success
21:53:45.0450 2600        ============================================================
21:54:06.0527 2728        ============================================================
21:54:06.0527 2728        Scan started
21:54:06.0527 2728        Mode: Manual; SigCheck; TDLFS;
21:54:06.0527 2728        ============================================================
21:54:07.0172 2728        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:54:07.0227 2728        1394ohci - ok
21:54:07.0280 2728        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:54:07.0298 2728        ACPI - ok
21:54:07.0329 2728        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:54:07.0349 2728        AcpiPmi - ok
21:54:07.0453 2728        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:54:07.0464 2728        AdobeARMservice - ok
21:54:07.0572 2728        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:54:07.0585 2728        AdobeFlashPlayerUpdateSvc - ok
21:54:07.0635 2728        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:54:07.0651 2728        adp94xx - ok
21:54:07.0682 2728        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:54:07.0694 2728        adpahci - ok
21:54:07.0708 2728        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:54:07.0718 2728        adpu320 - ok
21:54:07.0750 2728        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:54:07.0788 2728        AeLookupSvc - ok
21:54:07.0854 2728        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:54:07.0888 2728        AFD - ok
21:54:07.0929 2728        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:54:07.0942 2728        agp440 - ok
21:54:08.0181 2728        Akamai          (c775d704feb2b600a5bf7b0b088546af) c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll
21:54:08.0181 2728        Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll. md5: c775d704feb2b600a5bf7b0b088546af
21:54:08.0187 2728        Akamai ( HiddenFile.Multi.Generic ) - warning
21:54:08.0188 2728        Akamai - detected HiddenFile.Multi.Generic (1)
21:54:08.0281 2728        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:54:08.0309 2728        ALG - ok
21:54:08.0366 2728        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:54:08.0378 2728        aliide - ok
21:54:08.0431 2728        AMD External Events Utility (a359974eaac83a435497c52f62a2e590) C:\Windows\system32\atiesrxx.exe
21:54:08.0459 2728        AMD External Events Utility - ok
21:54:08.0472 2728        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:54:08.0485 2728        amdide - ok
21:54:08.0505 2728        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:54:08.0541 2728        AmdK8 - ok
21:54:08.0972 2728        amdkmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:54:09.0072 2728        amdkmdag - ok
21:54:09.0216 2728        amdkmdap        (6b4e9261b613b047a9a145f328889968) C:\Windows\system32\DRIVERS\atikmpag.sys
21:54:09.0240 2728        amdkmdap - ok
21:54:09.0262 2728        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:54:09.0277 2728        AmdPPM - ok
21:54:09.0297 2728        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:54:09.0311 2728        amdsata - ok
21:54:09.0343 2728        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:54:09.0358 2728        amdsbs - ok
21:54:09.0379 2728        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:54:09.0391 2728        amdxata - ok
21:54:09.0457 2728        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:54:09.0512 2728        AppID - ok
21:54:09.0536 2728        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:54:09.0580 2728        AppIDSvc - ok
21:54:09.0611 2728        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:54:09.0651 2728        Appinfo - ok
21:54:09.0756 2728        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:54:09.0766 2728        Apple Mobile Device - ok
21:54:09.0817 2728        AppMgmt        (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
21:54:09.0841 2728        AppMgmt - ok
21:54:09.0862 2728        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:54:09.0876 2728        arc - ok
21:54:09.0883 2728        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:54:09.0895 2728        arcsas - ok
21:54:09.0979 2728        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:54:09.0990 2728        aspnet_state - ok
21:54:10.0010 2728        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:54:10.0051 2728        AsyncMac - ok
21:54:10.0077 2728        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:54:10.0085 2728        atapi - ok
21:54:10.0513 2728        atikmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:54:10.0601 2728        atikmdag - ok
21:54:10.0731 2728        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:54:10.0780 2728        AudioEndpointBuilder - ok
21:54:10.0785 2728        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:54:10.0815 2728        AudioSrv - ok
21:54:10.0857 2728        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:54:10.0890 2728        AxInstSV - ok
21:54:10.0968 2728        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:54:10.0996 2728        b06bdrv - ok
21:54:11.0039 2728        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:54:11.0064 2728        b57nd60a - ok
21:54:11.0100 2728        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:54:11.0121 2728        BDESVC - ok
21:54:11.0139 2728        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:54:11.0185 2728        Beep - ok
21:54:11.0241 2728        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:54:11.0299 2728        BFE - ok
21:54:11.0344 2728        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:54:11.0392 2728        BITS - ok
21:54:11.0436 2728        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:54:11.0462 2728        blbdrive - ok
21:54:11.0571 2728        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
21:54:11.0586 2728        Bonjour Service - ok
21:54:11.0619 2728        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:54:11.0628 2728        bowser - ok
21:54:11.0639 2728        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:54:11.0662 2728        BrFiltLo - ok
21:54:11.0681 2728        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:54:11.0701 2728        BrFiltUp - ok
21:54:11.0734 2728        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:54:11.0784 2728        Browser - ok
21:54:11.0812 2728        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:54:11.0834 2728        Brserid - ok
21:54:11.0862 2728        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:54:11.0886 2728        BrSerWdm - ok
21:54:11.0897 2728        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:54:11.0924 2728        BrUsbMdm - ok
21:54:11.0937 2728        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:54:11.0953 2728        BrUsbSer - ok
21:54:11.0982 2728        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:54:12.0003 2728        BTHMODEM - ok
21:54:12.0040 2728        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:54:12.0066 2728        bthserv - ok
21:54:12.0084 2728        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:54:12.0121 2728        cdfs - ok
21:54:12.0163 2728        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
21:54:12.0190 2728        cdrom - ok
21:54:12.0227 2728        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:54:12.0277 2728        CertPropSvc - ok
21:54:12.0300 2728        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:54:12.0313 2728        circlass - ok
21:54:12.0353 2728        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:54:12.0371 2728        CLFS - ok
21:54:12.0422 2728        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:54:12.0429 2728        clr_optimization_v2.0.50727_32 - ok
21:54:12.0476 2728        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:54:12.0487 2728        clr_optimization_v2.0.50727_64 - ok
21:54:12.0537 2728        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:54:12.0548 2728        clr_optimization_v4.0.30319_32 - ok
21:54:12.0570 2728        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:54:12.0582 2728        clr_optimization_v4.0.30319_64 - ok
21:54:12.0588 2728        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:54:12.0615 2728        CmBatt - ok
21:54:12.0636 2728        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:54:12.0648 2728        cmdide - ok
21:54:12.0687 2728        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
21:54:12.0713 2728        CNG - ok
21:54:12.0738 2728        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:54:12.0746 2728        Compbatt - ok
21:54:12.0776 2728        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:54:12.0788 2728        CompositeBus - ok
21:54:12.0800 2728        COMSysApp - ok
21:54:12.0810 2728        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:54:12.0819 2728        crcdisk - ok
21:54:12.0854 2728        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
21:54:12.0899 2728        CryptSvc - ok
21:54:12.0943 2728        CSC            (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
21:54:12.0969 2728        CSC - ok
21:54:13.0015 2728        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
21:54:13.0037 2728        CscService - ok
21:54:13.0085 2728        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:54:13.0142 2728        DcomLaunch - ok
21:54:13.0178 2728        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:54:13.0214 2728        defragsvc - ok
21:54:13.0265 2728        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:54:13.0315 2728        DfsC - ok
21:54:13.0354 2728        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:54:13.0381 2728        Dhcp - ok
21:54:13.0405 2728        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:54:13.0445 2728        discache - ok
21:54:13.0471 2728        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:54:13.0480 2728        Disk - ok
21:54:13.0510 2728        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:54:13.0530 2728        Dnscache - ok
21:54:13.0564 2728        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:54:13.0602 2728        dot3svc - ok
21:54:13.0631 2728        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:54:13.0675 2728        DPS - ok
21:54:13.0708 2728        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:54:13.0726 2728        drmkaud - ok
21:54:13.0795 2728        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:54:13.0822 2728        DXGKrnl - ok
21:54:13.0847 2728        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:54:13.0884 2728        EapHost - ok
21:54:14.0043 2728        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:54:14.0092 2728        ebdrv - ok
21:54:14.0178 2728        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:54:14.0206 2728        EFS - ok
21:54:14.0264 2728        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:54:14.0293 2728        ehRecvr - ok
21:54:14.0324 2728        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:54:14.0339 2728        ehSched - ok
21:54:14.0403 2728        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:54:14.0423 2728        elxstor - ok
21:54:14.0448 2728        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:54:14.0466 2728        ErrDev - ok
21:54:14.0526 2728        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:54:14.0576 2728        EventSystem - ok
21:54:14.0594 2728        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:54:14.0629 2728        exfat - ok
21:54:14.0648 2728        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:54:14.0685 2728        fastfat - ok
21:54:14.0751 2728        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:54:14.0782 2728        Fax - ok
21:54:14.0796 2728        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:54:14.0823 2728        fdc - ok
21:54:14.0852 2728        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:54:14.0900 2728        fdPHost - ok
21:54:14.0916 2728        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:54:14.0950 2728        FDResPub - ok
21:54:14.0966 2728        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:54:14.0975 2728        FileInfo - ok
21:54:14.0988 2728        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:54:15.0013 2728        Filetrace - ok
21:54:15.0027 2728        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:54:15.0036 2728        flpydisk - ok
21:54:15.0064 2728        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:54:15.0075 2728        FltMgr - ok
21:54:15.0146 2728        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:54:15.0174 2728        FontCache - ok
21:54:15.0246 2728        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:54:15.0255 2728        FontCache3.0.0.0 - ok
21:54:15.0292 2728        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:54:15.0305 2728        FsDepends - ok
21:54:15.0331 2728        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:54:15.0343 2728        Fs_Rec - ok
21:54:15.0384 2728        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:54:15.0403 2728        fvevol - ok
21:54:15.0424 2728        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:54:15.0433 2728        gagp30kx - ok
21:54:15.0462 2728        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
21:54:15.0468 2728        GEARAspiWDM - ok
21:54:15.0532 2728        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:54:15.0572 2728        gpsvc - ok
21:54:15.0602 2728        grmnusb        (b9893a68032a6d9addb5b98287c630f7) C:\Windows\system32\drivers\grmnusb.sys
21:54:15.0608 2728        grmnusb - ok
21:54:15.0666 2728        gusvc          (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
21:54:15.0679 2728        gusvc - ok
21:54:15.0693 2728        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:54:15.0711 2728        hcw85cir - ok
21:54:15.0773 2728        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:54:15.0799 2728        HdAudAddService - ok
21:54:15.0849 2728        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:54:15.0876 2728        HDAudBus - ok
21:54:15.0890 2728        hdgnlava - ok
21:54:15.0902 2728        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:54:15.0927 2728        HidBatt - ok
21:54:15.0944 2728        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:54:15.0968 2728        HidBth - ok
21:54:15.0986 2728        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:54:16.0017 2728        HidIr - ok
21:54:16.0040 2728        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:54:16.0088 2728        hidserv - ok
21:54:16.0115 2728        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:54:16.0133 2728        HidUsb - ok
21:54:16.0155 2728        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:54:16.0190 2728        hkmsvc - ok
21:54:16.0214 2728        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:54:16.0225 2728        HomeGroupListener - ok
21:54:16.0250 2728        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:54:16.0274 2728        HomeGroupProvider - ok
21:54:16.0365 2728        HotspotShieldService (b2afa712b3cdf8ad04d85c56546bb174) C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
21:54:16.0372 2728        HotspotShieldService ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0372 2728        HotspotShieldService - detected UnsignedFile.Multi.Generic (1)
21:54:16.0411 2728        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:54:16.0420 2728        HpSAMD - ok
21:54:16.0441 2728        HssDrv          (a60c877e1cd3aa2e4e5ccd8af305c0f1) C:\Windows\system32\DRIVERS\HssDrv.sys
21:54:16.0476 2728        HssDrv - ok
21:54:16.0537 2728        HssSrv          (b8b90bb7011556691d432aaecaa0d26c) C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
21:54:16.0544 2728        HssSrv ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0544 2728        HssSrv - detected UnsignedFile.Multi.Generic (1)
21:54:16.0575 2728        HssTrayService  (8faab97946600e312cb3398061ad3059) C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
21:54:16.0579 2728        HssTrayService ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0579 2728        HssTrayService - detected UnsignedFile.Multi.Generic (1)
21:54:16.0585 2728        HssWd - ok
21:54:16.0648 2728        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:54:16.0686 2728        HTTP - ok
21:54:16.0707 2728        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:54:16.0716 2728        hwpolicy - ok
21:54:16.0736 2728        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:54:16.0746 2728        i8042prt - ok
21:54:16.0809 2728        IAANTMON        (549275dc1004e09f92167b98b0ce63fe) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
21:54:16.0824 2728        IAANTMON - ok
21:54:16.0871 2728        iaStor          (f27742d576f355972c94952671658dc2) C:\Windows\system32\DRIVERS\iaStor.sys
21:54:16.0886 2728        iaStor - ok
21:54:16.0917 2728        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:54:16.0935 2728        iaStorV - ok
21:54:16.0974 2728        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:54:16.0987 2728        IDriverT ( UnsignedFile.Multi.Generic ) - warning
21:54:16.0987 2728        IDriverT - detected UnsignedFile.Multi.Generic (1)
21:54:17.0077 2728        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:54:17.0096 2728        idsvc - ok
21:54:17.0187 2728        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:54:17.0200 2728        iirsp - ok
21:54:17.0263 2728        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:54:17.0321 2728        IKEEXT - ok
21:54:17.0336 2728        iktydhah - ok
21:54:17.0369 2728        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:54:17.0382 2728        intelide - ok
21:54:17.0402 2728        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:54:17.0426 2728        intelppm - ok
21:54:17.0483 2728        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:54:17.0532 2728        IPBusEnum - ok
21:54:17.0564 2728        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:54:17.0597 2728        IpFilterDriver - ok
21:54:17.0644 2728        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:54:17.0689 2728        iphlpsvc - ok
21:54:17.0705 2728        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:54:17.0725 2728        IPMIDRV - ok
21:54:17.0747 2728        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:54:17.0773 2728        IPNAT - ok
21:54:17.0897 2728        iPod Service    (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe
21:54:17.0920 2728        iPod Service - ok
21:54:17.0942 2728        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:54:17.0963 2728        IRENUM - ok
21:54:17.0980 2728        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:54:17.0989 2728        isapnp - ok
21:54:18.0010 2728        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:54:18.0021 2728        iScsiPrt - ok
21:54:18.0105 2728        ISODrive        (9c6f3f69163133fb8e56ac4a6e163452) C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys
21:54:18.0118 2728        ISODrive - ok
21:54:18.0141 2728        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
21:54:18.0154 2728        kbdclass - ok
21:54:18.0187 2728        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
21:54:18.0214 2728        kbdhid - ok
21:54:18.0237 2728        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:18.0251 2728        KeyIso - ok
21:54:18.0268 2728        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
21:54:18.0281 2728        KSecDD - ok
21:54:18.0298 2728        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
21:54:18.0313 2728        KSecPkg - ok
21:54:18.0341 2728        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:54:18.0389 2728        ksthunk - ok
21:54:18.0426 2728        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:54:18.0465 2728        KtmRm - ok
21:54:18.0513 2728        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:54:18.0557 2728        LanmanServer - ok
21:54:18.0583 2728        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:54:18.0618 2728        LanmanWorkstation - ok
21:54:18.0654 2728        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:54:18.0701 2728        lltdio - ok
21:54:18.0725 2728        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:54:18.0761 2728        lltdsvc - ok
21:54:18.0777 2728        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:54:18.0802 2728        lmhosts - ok
21:54:18.0829 2728        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:54:18.0839 2728        LSI_FC - ok
21:54:18.0847 2728        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:54:18.0856 2728        LSI_SAS - ok
21:54:18.0866 2728        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:54:18.0875 2728        LSI_SAS2 - ok
21:54:18.0890 2728        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:54:18.0899 2728        LSI_SCSI - ok
21:54:18.0924 2728        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:54:18.0959 2728        luafv - ok
21:54:18.0996 2728        LVPr2M64        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:54:19.0003 2728        LVPr2M64 - ok
21:54:19.0019 2728        LVPr2Mon        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:54:19.0026 2728        LVPr2Mon - ok
21:54:19.0060 2728        LVRS64          (0c85b2b6fb74b36a251792d45e0ef860) C:\Windows\system32\DRIVERS\lvrs64.sys
21:54:19.0072 2728        LVRS64 - ok
21:54:19.0296 2728        LVUVC64        (ff3a488924b0032b1a9ca6948c1fa9e8) C:\Windows\system32\DRIVERS\lvuvc64.sys
21:54:19.0360 2728        LVUVC64 - ok
21:54:19.0475 2728        MBAMProtector  (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
21:54:19.0489 2728        MBAMProtector - ok
21:54:19.0580 2728        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
21:54:19.0599 2728        MBAMService - ok
21:54:19.0620 2728        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:54:19.0640 2728        Mcx2Svc - ok
21:54:19.0668 2728        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:54:19.0676 2728        megasas - ok
21:54:19.0698 2728        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:54:19.0709 2728        MegaSR - ok
21:54:19.0743 2728        MEMSWEEP2      (f9ce67e9e0226079b59107b649851f96) C:\Windows\system32\2DB9.tmp
21:54:19.0755 2728        MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - warning
21:54:19.0755 2728        MEMSWEEP2 - detected UnsignedFile.Multi.Generic (1)
21:54:19.0829 2728        Microsoft SharePoint Workspace Audit Service - ok
21:54:19.0865 2728        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:54:19.0904 2728        MMCSS - ok
21:54:19.0919 2728        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:54:19.0951 2728        Modem - ok
21:54:19.0977 2728        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:54:19.0998 2728        monitor - ok
21:54:20.0032 2728        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:54:20.0045 2728        mouclass - ok
21:54:20.0062 2728        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:54:20.0080 2728        mouhid - ok
21:54:20.0100 2728        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:54:20.0109 2728        mountmgr - ok
21:54:20.0141 2728        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:54:20.0151 2728        mpio - ok
21:54:20.0169 2728        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:54:20.0195 2728        mpsdrv - ok
21:54:20.0263 2728        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:54:20.0325 2728        MpsSvc - ok
21:54:20.0353 2728        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:54:20.0377 2728        MRxDAV - ok
21:54:20.0400 2728        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:54:20.0425 2728        mrxsmb - ok
21:54:20.0460 2728        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:54:20.0489 2728        mrxsmb10 - ok
21:54:20.0521 2728        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:54:20.0535 2728        mrxsmb20 - ok
21:54:20.0547 2728        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:54:20.0560 2728        msahci - ok
21:54:20.0574 2728        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:54:20.0585 2728        msdsm - ok
21:54:20.0608 2728        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:54:20.0627 2728        MSDTC - ok
21:54:20.0660 2728        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:54:20.0685 2728        Msfs - ok
21:54:20.0694 2728        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:54:20.0732 2728        mshidkmdf - ok
21:54:20.0742 2728        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:54:20.0751 2728        msisadrv - ok
21:54:20.0789 2728        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:54:20.0843 2728        MSiSCSI - ok
21:54:20.0845 2728        msiserver - ok
21:54:20.0863 2728        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:54:20.0901 2728        MSKSSRV - ok
21:54:20.0916 2728        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:54:20.0956 2728        MSPCLOCK - ok
21:54:20.0959 2728        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:54:21.0000 2728        MSPQM - ok
21:54:21.0032 2728        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:54:21.0044 2728        MsRPC - ok
21:54:21.0058 2728        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:54:21.0067 2728        mssmbios - ok
21:54:21.0082 2728        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:54:21.0108 2728        MSTEE - ok
21:54:21.0123 2728        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:54:21.0141 2728        MTConfig - ok
21:54:21.0164 2728        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:54:21.0173 2728        Mup - ok
21:54:21.0219 2728        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:54:21.0248 2728        napagent - ok
21:54:21.0284 2728        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:54:21.0309 2728        NativeWifiP - ok
21:54:21.0370 2728        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:54:21.0397 2728        NDIS - ok
21:54:21.0422 2728        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:54:21.0456 2728        NdisCap - ok
21:54:21.0480 2728        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:54:21.0515 2728        NdisTapi - ok
21:54:21.0555 2728        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:54:21.0583 2728        Ndisuio - ok
21:54:21.0620 2728        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:54:21.0657 2728        NdisWan - ok
21:54:21.0682 2728        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:54:21.0715 2728        NDProxy - ok
21:54:21.0726 2728        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:54:21.0752 2728        NetBIOS - ok
21:54:21.0788 2728        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:54:21.0827 2728        NetBT - ok
21:54:21.0851 2728        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:21.0861 2728        Netlogon - ok
21:54:21.0908 2728        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:54:21.0948 2728        Netman - ok
21:54:22.0050 2728        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0061 2728        NetMsmqActivator - ok
21:54:22.0064 2728        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0075 2728        NetPipeActivator - ok
21:54:22.0111 2728        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:54:22.0154 2728        netprofm - ok
21:54:22.0159 2728        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0167 2728        NetTcpActivator - ok
21:54:22.0169 2728        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:54:22.0177 2728        NetTcpPortSharing - ok
21:54:22.0220 2728        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:54:22.0233 2728        nfrd960 - ok
21:54:22.0274 2728        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:54:22.0313 2728        NlaSvc - ok
21:54:22.0410 2728        nlsX86cc        (b1ef4686961986dffb7fe8f18e6fcb5b) C:\Windows\SysWOW64\nlssrv32.exe
21:54:22.0419 2728        nlsX86cc - ok
21:54:22.0492 2728        NMSAccessU      (fd306fbcce7adb1077b709742e7148e9) C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
21:54:22.0502 2728        NMSAccessU - ok
21:54:22.0510 2728        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:54:22.0542 2728        Npfs - ok
21:54:22.0553 2728        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:54:22.0589 2728        nsi - ok
21:54:22.0603 2728        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:54:22.0638 2728        nsiproxy - ok
21:54:22.0735 2728        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:54:22.0769 2728        Ntfs - ok
21:54:22.0872 2728        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:54:22.0909 2728        Null - ok
21:54:22.0940 2728        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:54:22.0950 2728        nvraid - ok
21:54:22.0977 2728        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:54:22.0987 2728        nvstor - ok
21:54:23.0013 2728        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:54:23.0023 2728        nv_agp - ok
21:54:23.0037 2728        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:54:23.0056 2728        ohci1394 - ok
21:54:23.0111 2728        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:54:23.0122 2728        ose - ok
21:54:23.0411 2728        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:54:23.0475 2728        osppsvc - ok
21:54:23.0564 2728        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:54:23.0594 2728        p2pimsvc - ok
21:54:23.0629 2728        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:54:23.0648 2728        p2psvc - ok
21:54:23.0707 2728        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:54:23.0738 2728        Parport - ok
21:54:23.0764 2728        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:54:23.0777 2728        partmgr - ok
21:54:23.0794 2728        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:54:23.0828 2728        PcaSvc - ok
21:54:23.0861 2728        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:54:23.0876 2728        pci - ok
21:54:23.0891 2728        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:54:23.0903 2728        pciide - ok
21:54:23.0921 2728        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:54:23.0936 2728        pcmcia - ok
21:54:23.0947 2728        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:54:23.0956 2728        pcw - ok
21:54:23.0994 2728        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:54:24.0032 2728        PEAUTH - ok
21:54:24.0116 2728        PeerDistSvc    (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
21:54:24.0161 2728        PeerDistSvc - ok
21:54:24.0239 2728        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:54:24.0262 2728        PerfHost - ok
21:54:24.0395 2728        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:54:24.0446 2728        pla - ok
21:54:24.0486 2728        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:54:24.0511 2728        PlugPlay - ok
21:54:24.0528 2728        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:54:24.0552 2728        PNRPAutoReg - ok
21:54:24.0580 2728        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:54:24.0592 2728        PNRPsvc - ok
21:54:24.0653 2728        Point64        (33328fa8a580885ab0065be6db266e9f) C:\Windows\system32\DRIVERS\point64.sys
21:54:24.0663 2728        Point64 - ok
21:54:24.0711 2728        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:54:24.0763 2728        PolicyAgent - ok
21:54:24.0789 2728        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:54:24.0826 2728        Power - ok
21:54:24.0868 2728        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:54:24.0920 2728        PptpMiniport - ok
21:54:24.0944 2728        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:54:24.0960 2728        Processor - ok
21:54:24.0995 2728        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
21:54:25.0034 2728        ProfSvc - ok
21:54:25.0055 2728        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:25.0064 2728        ProtectedStorage - ok
21:54:25.0088 2728        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:54:25.0114 2728        Psched - ok
21:54:25.0163 2728        PSI            (fb46e9a827a8799ebd7bfa9128c91f37) C:\Windows\system32\DRIVERS\psi_mf.sys
21:54:25.0172 2728        PSI - ok
21:54:25.0201 2728        PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
21:54:25.0212 2728        PxHlpa64 - ok
21:54:25.0287 2728        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:54:25.0320 2728        ql2300 - ok
21:54:25.0422 2728        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:54:25.0432 2728        ql40xx - ok
21:54:25.0467 2728        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:54:25.0481 2728        QWAVE - ok
21:54:25.0518 2728        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:54:25.0544 2728        QWAVEdrv - ok
21:54:25.0554 2728        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:54:25.0595 2728        RasAcd - ok
21:54:25.0629 2728        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:54:25.0655 2728        RasAgileVpn - ok
21:54:25.0671 2728        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:54:25.0698 2728        RasAuto - ok
21:54:25.0717 2728        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:54:25.0749 2728        Rasl2tp - ok
21:54:25.0793 2728        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:54:25.0830 2728        RasMan - ok
21:54:25.0848 2728        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:54:25.0889 2728        RasPppoe - ok
21:54:25.0904 2728        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:54:25.0945 2728        RasSstp - ok
21:54:25.0980 2728        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:54:26.0020 2728        rdbss - ok
21:54:26.0030 2728        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:54:26.0049 2728        rdpbus - ok
21:54:26.0062 2728        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:54:26.0088 2728        RDPCDD - ok
21:54:26.0115 2728        RDPDR          (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
21:54:26.0125 2728        RDPDR - ok
21:54:26.0143 2728        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:54:26.0182 2728        RDPENCDD - ok
21:54:26.0200 2728        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:54:26.0226 2728        RDPREFMP - ok
21:54:26.0249 2728        RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
21:54:26.0265 2728        RdpVideoMiniport - ok
21:54:26.0301 2728        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
21:54:26.0323 2728        RDPWD - ok
21:54:26.0353 2728        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:54:26.0363 2728        rdyboost - ok
21:54:26.0391 2728        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:54:26.0426 2728        RemoteAccess - ok
21:54:26.0457 2728        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:54:26.0497 2728        RemoteRegistry - ok
21:54:26.0511 2728        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:54:26.0544 2728        RpcEptMapper - ok
21:54:26.0559 2728        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:54:26.0584 2728        RpcLocator - ok
21:54:26.0635 2728        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:54:26.0664 2728        RpcSs - ok
21:54:26.0699 2728        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:54:26.0725 2728        rspndr - ok
21:54:26.0784 2728        RTL8167        (fcaf9c2c9eadf8f397c3350760ef500f) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:54:26.0794 2728        RTL8167 - ok
21:54:26.0828 2728        RTL8169        (faeeed5a8949e6ba611a7b738ad28cee) C:\Windows\system32\DRIVERS\Rtlh64.sys
21:54:26.0854 2728        RTL8169 - ok
21:54:26.0890 2728        RtNdPt60        (2b38c905492f36fe42b59da52d6b4eb7) C:\Windows\system32\DRIVERS\RtNdPt60.sys
21:54:26.0904 2728        RtNdPt60 - ok
21:54:26.0932 2728        RTTEAMPT        (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:54:26.0939 2728        RTTEAMPT - ok
21:54:26.0948 2728        RTVLANPT        (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVlan60.sys
21:54:26.0969 2728        RTVLANPT - ok
21:54:26.0986 2728        s3cap          (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
21:54:27.0004 2728        s3cap - ok
21:54:27.0025 2728        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:27.0034 2728        SamSs - ok
21:54:27.0116 2728        SbieDrv        (0fe05dd9bbf0782e2bbf0977f2034616) C:\Program Files\Sandboxie\SbieDrv.sys
21:54:27.0126 2728        SbieDrv - ok
21:54:27.0164 2728        SbieSvc        (c970c7b2fd2e811525d4578d50b535f5) C:\Program Files\Sandboxie\SbieSvc.exe
21:54:27.0172 2728        SbieSvc - ok
21:54:27.0183 2728        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:54:27.0193 2728        sbp2port - ok
21:54:27.0222 2728        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:54:27.0250 2728        SCardSvr - ok
21:54:27.0271 2728        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:54:27.0320 2728        scfilter - ok
21:54:27.0395 2728        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:54:27.0449 2728        Schedule - ok
21:54:27.0478 2728        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:54:27.0503 2728        SCPolicySvc - ok
21:54:27.0536 2728        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:54:27.0553 2728        SDRSVC - ok
21:54:27.0620 2728        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:54:27.0645 2728        secdrv - ok
21:54:27.0659 2728        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:54:27.0694 2728        seclogon - ok
21:54:27.0794 2728        Secunia PSI Agent (7198bbfbe46c0070257278c536386687) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
21:54:27.0810 2728        Secunia PSI Agent - ok
21:54:27.0846 2728        Secunia Update Agent (d2fca567f9be87e29b9a9fa32ffe79ca) C:\Program Files (x86)\Secunia\PSI\sua.exe
21:54:27.0856 2728        Secunia Update Agent - ok
21:54:27.0936 2728        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:54:27.0976 2728        SENS - ok
21:54:27.0993 2728        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:54:28.0003 2728        SensrSvc - ok
21:54:28.0031 2728        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:54:28.0048 2728        Serenum - ok
21:54:28.0067 2728        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:54:28.0084 2728        Serial - ok
21:54:28.0124 2728        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:54:28.0142 2728        sermouse - ok
21:54:28.0174 2728        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:54:28.0210 2728        SessionEnv - ok
21:54:28.0235 2728        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:54:28.0263 2728        sffdisk - ok
21:54:28.0279 2728        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:54:28.0305 2728        sffp_mmc - ok
21:54:28.0322 2728        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:54:28.0353 2728        sffp_sd - ok
21:54:28.0366 2728        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:54:28.0377 2728        sfloppy - ok
21:54:28.0414 2728        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:54:28.0442 2728        SharedAccess - ok
21:54:28.0482 2728        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:54:28.0510 2728        ShellHWDetection - ok
21:54:28.0529 2728        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:54:28.0538 2728        SiSRaid2 - ok
21:54:28.0551 2728        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:54:28.0560 2728        SiSRaid4 - ok
21:54:28.0631 2728        SkypeUpdate    (17eab7852ff9f15fbaab4e95efc0b812) C:\Program Files (x86)\Skype\Updater\Updater.exe
21:54:28.0642 2728        SkypeUpdate - ok
21:54:28.0661 2728        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:54:28.0700 2728        Smb - ok
21:54:28.0733 2728        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:54:28.0744 2728        SNMPTRAP - ok
21:54:28.0755 2728        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:54:28.0764 2728        spldr - ok
21:54:28.0816 2728        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:54:28.0859 2728        Spooler - ok
21:54:29.0043 2728        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:54:29.0120 2728        sppsvc - ok
21:54:29.0184 2728        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:54:29.0235 2728        sppuinotify - ok
21:54:29.0329 2728        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:54:29.0360 2728        srv - ok
21:54:29.0408 2728        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:54:29.0439 2728        srv2 - ok
21:54:29.0462 2728        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:54:29.0484 2728        srvnet - ok
21:54:29.0520 2728        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:54:29.0570 2728        SSDPSRV - ok
21:54:29.0588 2728        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:54:29.0615 2728        SstpSvc - ok
21:54:29.0647 2728        StarOpen        (e57b778208c783d8debab320c16a1b82) C:\Windows\system32\drivers\StarOpen.sys
21:54:29.0659 2728        StarOpen ( UnsignedFile.Multi.Generic ) - warning
21:54:29.0659 2728        StarOpen - detected UnsignedFile.Multi.Generic (1)
21:54:29.0685 2728        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:54:29.0693 2728        stexstor - ok
21:54:29.0757 2728        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:54:29.0790 2728        stisvc - ok
21:54:29.0818 2728        storflt        (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
21:54:29.0827 2728        storflt - ok
21:54:29.0833 2728        storvsc        (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
21:54:29.0842 2728        storvsc - ok
21:54:29.0921 2728        STRATO HiDrive Service (a4533f6ee3dca68be5671c0571384e3a) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
21:54:29.0924 2728        STRATO HiDrive Service ( UnsignedFile.Multi.Generic ) - warning
21:54:29.0924 2728        STRATO HiDrive Service - detected UnsignedFile.Multi.Generic (1)
21:54:29.0944 2728        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:54:29.0957 2728        swenum - ok
21:54:30.0042 2728        SwitchBoard    (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
21:54:30.0069 2728        SwitchBoard ( UnsignedFile.Multi.Generic ) - warning
21:54:30.0069 2728        SwitchBoard - detected UnsignedFile.Multi.Generic (1)
21:54:30.0119 2728        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:54:30.0161 2728        swprv - ok
21:54:30.0164 2728        Synth3dVsc - ok
21:54:30.0262 2728        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:54:30.0314 2728        SysMain - ok
21:54:30.0413 2728        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:54:30.0433 2728        TabletInputService - ok
21:54:30.0467 2728        tap0901        (bcd6a90d6fd757ce9c29ddc850f7f231) C:\Windows\system32\DRIVERS\tap0901.sys
21:54:30.0486 2728        tap0901 - ok
21:54:30.0518 2728        taphss          (f33fdc72298df4bf9813a55d21f4eb31) C:\Windows\system32\DRIVERS\taphss.sys
21:54:30.0525 2728        taphss - ok
21:54:30.0566 2728        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:54:30.0603 2728        TapiSrv - ok
21:54:30.0627 2728        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:54:30.0654 2728        TBS - ok
21:54:30.0761 2728        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:54:30.0803 2728        Tcpip - ok
21:54:30.0940 2728        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:54:30.0972 2728        TCPIP6 - ok
21:54:31.0023 2728        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:54:31.0067 2728        tcpipreg - ok
21:54:31.0086 2728        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:54:31.0106 2728        TDPIPE - ok
21:54:31.0134 2728        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:54:31.0143 2728        TDTCP - ok
21:54:31.0181 2728        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:54:31.0206 2728        tdx - ok
21:54:31.0242 2728        TEAM            (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:54:31.0249 2728        TEAM - ok
21:54:31.0448 2728        TeamViewer7    (74fc70ae64a7b7dabec9697ce0a1f4fa) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
21:54:31.0489 2728        TeamViewer7 - ok
21:54:31.0553 2728        teamviewervpn  (f5520dbb47c60ee83024b38720abda24) C:\Windows\system32\DRIVERS\teamviewervpn.sys
21:54:31.0562 2728        teamviewervpn - ok
21:54:31.0585 2728        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:54:31.0599 2728        TermDD - ok
21:54:31.0647 2728        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:54:31.0700 2728        TermService - ok
21:54:31.0738 2728        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:54:31.0760 2728        Themes - ok
21:54:31.0785 2728        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:54:31.0811 2728        THREADORDER - ok
21:54:31.0846 2728        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:54:31.0886 2728        TrkWks - ok
21:54:31.0942 2728        truecrypt      (8de922cd4fea6f83b10805df965b9a08) C:\Windows\system32\drivers\truecrypt.sys
21:54:31.0956 2728        truecrypt - ok
21:54:32.0011 2728        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:54:32.0043 2728        TrustedInstaller - ok
21:54:32.0068 2728        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:54:32.0093 2728        tssecsrv - ok
21:54:32.0117 2728        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:54:32.0134 2728        TsUsbFlt - ok
21:54:32.0138 2728        tsusbhub - ok
21:54:32.0187 2728        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:54:32.0232 2728        tunnel - ok
21:54:32.0253 2728        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:54:32.0262 2728        uagp35 - ok
21:54:32.0306 2728        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:54:32.0357 2728        udfs - ok
21:54:32.0379 2728        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:54:32.0390 2728        UI0Detect - ok
21:54:32.0410 2728        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:54:32.0419 2728        uliagpkx - ok
21:54:32.0453 2728        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
21:54:32.0476 2728        umbus - ok
21:54:32.0498 2728        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:54:32.0519 2728        UmPass - ok
21:54:32.0554 2728        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
21:54:32.0582 2728        UmRdpService - ok
21:54:32.0694 2728        UMVPFSrv        (67a95b9d129ed5399e7965cd09cf30e7) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
21:54:32.0711 2728        UMVPFSrv - ok
21:54:32.0736 2728        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:54:32.0765 2728        upnphost - ok
21:54:32.0784 2728        USBAAPL64      (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys
21:54:32.0804 2728        USBAAPL64 - ok
21:54:32.0844 2728        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
21:54:32.0864 2728        usbaudio - ok
21:54:32.0885 2728        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:54:32.0895 2728        usbccgp - ok
21:54:32.0920 2728        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:54:32.0931 2728        usbcir - ok
21:54:32.0951 2728        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
21:54:32.0960 2728        usbehci - ok
21:54:32.0985 2728        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:54:33.0009 2728        usbhub - ok
21:54:33.0026 2728        usbohci        (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
21:54:33.0036 2728        usbohci - ok
21:54:33.0048 2728        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:54:33.0069 2728        usbprint - ok
21:54:33.0084 2728        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:54:33.0108 2728        USBSTOR - ok
21:54:33.0124 2728        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
21:54:33.0145 2728        usbuhci - ok
21:54:33.0173 2728        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:54:33.0212 2728        UxSms - ok
21:54:33.0232 2728        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:54:33.0242 2728        VaultSvc - ok
21:54:33.0255 2728        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:54:33.0264 2728        vdrvroot - ok
21:54:33.0311 2728        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:54:33.0350 2728        vds - ok
21:54:33.0362 2728        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:54:33.0373 2728        vga - ok
21:54:33.0385 2728        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:54:33.0420 2728        VgaSave - ok
21:54:33.0433 2728        VGPU - ok
21:54:33.0473 2728        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:54:33.0484 2728        vhdmp - ok
21:54:33.0493 2728        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:54:33.0503 2728        viaide - ok
21:54:33.0562 2728        VLAN            (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVLAN60.sys
21:54:33.0569 2728        VLAN - ok
21:54:33.0605 2728        vmbus          (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
21:54:33.0616 2728        vmbus - ok
21:54:33.0626 2728        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
21:54:33.0643 2728        VMBusHID - ok
21:54:33.0661 2728        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:54:33.0670 2728        volmgr - ok
21:54:33.0705 2728        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:54:33.0717 2728        volmgrx - ok
21:54:33.0743 2728        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:54:33.0754 2728        volsnap - ok
21:54:33.0775 2728        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:54:33.0785 2728        vsmraid - ok
21:54:33.0896 2728        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:54:33.0946 2728        VSS - ok
21:54:34.0039 2728        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
21:54:34.0065 2728        vwifibus - ok
21:54:34.0101 2728        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:54:34.0130 2728        W32Time - ok
21:54:34.0141 2728        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:54:34.0151 2728        WacomPen - ok
21:54:34.0193 2728        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:54:34.0225 2728        WANARP - ok
21:54:34.0234 2728        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:54:34.0258 2728        Wanarpv6 - ok
21:54:34.0344 2728        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:54:34.0377 2728        WatAdminSvc - ok
21:54:34.0465 2728        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:54:34.0498 2728        wbengine - ok
21:54:34.0579 2728        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:54:34.0600 2728        WbioSrvc - ok
21:54:34.0634 2728        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:54:34.0660 2728        wcncsvc - ok
21:54:34.0679 2728        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:54:34.0699 2728        WcsPlugInService - ok
21:54:34.0734 2728        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:54:34.0743 2728        Wd - ok
21:54:34.0782 2728        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:54:34.0797 2728        Wdf01000 - ok
21:54:34.0813 2728        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:54:34.0837 2728        WdiServiceHost - ok
21:54:34.0839 2728        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:54:34.0853 2728        WdiSystemHost - ok
21:54:34.0886 2728        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:54:34.0912 2728        WebClient - ok
21:54:34.0934 2728        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:54:34.0977 2728        Wecsvc - ok
21:54:34.0991 2728        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:54:35.0026 2728        wercplsupport - ok
21:54:35.0047 2728        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:54:35.0074 2728        WerSvc - ok
21:54:35.0101 2728        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:54:35.0127 2728        WfpLwf - ok
21:54:35.0135 2728        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:54:35.0144 2728        WIMMount - ok
21:54:35.0193 2728        WinDefend - ok
21:54:35.0201 2728        WinHttpAutoProxySvc - ok
21:54:35.0262 2728        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:54:35.0301 2728        Winmgmt - ok
21:54:35.0408 2728        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:54:35.0459 2728        WinRM - ok
21:54:35.0580 2728        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
21:54:35.0608 2728        WinUsb - ok
21:54:35.0669 2728        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:54:35.0708 2728        Wlansvc - ok
21:54:35.0728 2728        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:54:35.0738 2728        WmiAcpi - ok
21:54:35.0803 2728        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:54:35.0831 2728        wmiApSrv - ok
21:54:35.0901 2728        WMPNetworkSvc - ok
21:54:35.0918 2728        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:54:35.0932 2728        WPCSvc - ok
21:54:35.0962 2728        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:54:35.0979 2728        WPDBusEnum - ok
21:54:36.0002 2728        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:54:36.0053 2728        ws2ifsl - ok
21:54:36.0065 2728        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:54:36.0092 2728        wscsvc - ok
21:54:36.0094 2728        WSearch - ok
21:54:36.0223 2728        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
21:54:36.0284 2728        wuauserv - ok
21:54:36.0386 2728        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:54:36.0428 2728        WudfPf - ok
21:54:36.0465 2728        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:54:36.0503 2728        wudfsvc - ok
21:54:36.0541 2728        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:54:36.0556 2728        WwanSvc - ok
21:54:36.0576 2728        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
21:54:36.0940 2728        \Device\Harddisk0\DR0 - ok
21:54:36.0942 2728        Boot (0x1200)  (0bad36234d44da07ecd9352cabff905d) \Device\Harddisk0\DR0\Partition0
21:54:36.0944 2728        \Device\Harddisk0\DR0\Partition0 - ok
21:54:36.0968 2728        Boot (0x1200)  (777b13c19d7df68449108280f2a13010) \Device\Harddisk0\DR0\Partition1
21:54:36.0969 2728        \Device\Harddisk0\DR0\Partition1 - ok
21:54:36.0983 2728        Boot (0x1200)  (2bb9fa725471a7211fc6a271a3451b14) \Device\Harddisk0\DR0\Partition2
21:54:36.0984 2728        \Device\Harddisk0\DR0\Partition2 - ok
21:54:37.0012 2728        Boot (0x1200)  (886e4e72fb1c452c861462f8cfa669af) \Device\Harddisk0\DR0\Partition3
21:54:37.0012 2728        \Device\Harddisk0\DR0\Partition3 - ok
21:54:37.0013 2728        ============================================================
21:54:37.0013 2728        Scan finished
21:54:37.0013 2728        ============================================================
21:54:37.0022 1088        Detected object count: 9
21:54:37.0022 1088        Actual detected object count: 9
21:55:21.0260 1088        Akamai ( HiddenFile.Multi.Generic ) - skipped by user
21:55:21.0260 1088        Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip
21:55:21.0260 1088        HotspotShieldService ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0260 1088        HotspotShieldService ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0262 1088        HssSrv ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0262 1088        HssSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0263 1088        HssTrayService ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0263 1088        HssTrayService ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0264 1088        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0264 1088        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0265 1088        MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0265 1088        MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0266 1088        StarOpen ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0266 1088        StarOpen ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0268 1088        STRATO HiDrive Service ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0268 1088        STRATO HiDrive Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:21.0269 1088        SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user
21:55:21.0269 1088        SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:55:29.0035 3192        ============================================================
21:55:29.0035 3192        Scan started
21:55:29.0035 3192        Mode: Manual;
21:55:29.0035 3192        ============================================================
21:55:29.0525 3192        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
21:55:29.0526 3192        1394ohci - ok
21:55:29.0563 3192        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:55:29.0564 3192        ACPI - ok
21:55:29.0591 3192        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:55:29.0591 3192        AcpiPmi - ok
21:55:29.0683 3192        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:55:29.0684 3192        AdobeARMservice - ok
21:55:29.0779 3192        AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:55:29.0780 3192        AdobeFlashPlayerUpdateSvc - ok
21:55:29.0824 3192        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:55:29.0827 3192        adp94xx - ok
21:55:29.0855 3192        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:55:29.0857 3192        adpahci - ok
21:55:29.0872 3192        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:55:29.0873 3192        adpu320 - ok
21:55:29.0898 3192        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:55:29.0899 3192        AeLookupSvc - ok
21:55:29.0947 3192        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:55:29.0950 3192        AFD - ok
21:55:29.0961 3192        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:55:29.0961 3192        agp440 - ok
21:55:30.0185 3192        Akamai          (c775d704feb2b600a5bf7b0b088546af) c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll
21:55:30.0185 3192        Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll. md5: c775d704feb2b600a5bf7b0b088546af
21:55:30.0191 3192        Akamai ( HiddenFile.Multi.Generic ) - warning
21:55:30.0191 3192        Akamai - detected HiddenFile.Multi.Generic (1)
21:55:30.0280 3192        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:55:30.0281 3192        ALG - ok
21:55:30.0298 3192        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:55:30.0298 3192        aliide - ok
21:55:30.0329 3192        AMD External Events Utility (a359974eaac83a435497c52f62a2e590) C:\Windows\system32\atiesrxx.exe
21:55:30.0330 3192        AMD External Events Utility - ok
21:55:30.0338 3192        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:55:30.0338 3192        amdide - ok
21:55:30.0362 3192        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:55:30.0363 3192        AmdK8 - ok
21:55:30.0832 3192        amdkmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:55:30.0872 3192        amdkmdag - ok
21:55:30.0933 3192        amdkmdap        (6b4e9261b613b047a9a145f328889968) C:\Windows\system32\DRIVERS\atikmpag.sys
21:55:30.0935 3192        amdkmdap - ok
21:55:30.0953 3192        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:55:30.0953 3192        AmdPPM - ok
21:55:30.0971 3192        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:55:30.0972 3192        amdsata - ok
21:55:30.0992 3192        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:55:30.0993 3192        amdsbs - ok
21:55:31.0012 3192        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:55:31.0012 3192        amdxata - ok
21:55:31.0040 3192        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:55:31.0040 3192        AppID - ok
21:55:31.0060 3192        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:55:31.0061 3192        AppIDSvc - ok
21:55:31.0086 3192        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:55:31.0086 3192        Appinfo - ok
21:55:31.0182 3192        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:55:31.0183 3192        Apple Mobile Device - ok
21:55:31.0218 3192        AppMgmt        (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
21:55:31.0220 3192        AppMgmt - ok
21:55:31.0236 3192        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:55:31.0237 3192        arc - ok
21:55:31.0248 3192        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:55:31.0249 3192        arcsas - ok
21:55:31.0332 3192        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:55:31.0332 3192        aspnet_state - ok
21:55:31.0346 3192        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:55:31.0346 3192        AsyncMac - ok
21:55:31.0371 3192        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:55:31.0371 3192        atapi - ok
21:55:31.0778 3192        atikmdag        (60216b0e704584de6d5a9f59e9c34c47) C:\Windows\system32\DRIVERS\atikmdag.sys
21:55:31.0817 3192        atikmdag - ok
21:55:31.0934 3192        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:55:31.0938 3192        AudioEndpointBuilder - ok
21:55:31.0945 3192        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:55:31.0949 3192        AudioSrv - ok
21:55:31.0973 3192        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:55:31.0974 3192        AxInstSV - ok
21:55:32.0031 3192        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:55:32.0034 3192        b06bdrv - ok
21:55:32.0059 3192        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:55:32.0061 3192        b57nd60a - ok
21:55:32.0087 3192        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:55:32.0088 3192        BDESVC - ok
21:55:32.0094 3192        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:55:32.0094 3192        Beep - ok
21:55:32.0145 3192        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
21:55:32.0149 3192        BFE - ok
21:55:32.0194 3192        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:55:32.0200 3192        BITS - ok
21:55:32.0217 3192        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:55:32.0217 3192        blbdrive - ok
21:55:32.0287 3192        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
21:55:32.0290 3192        Bonjour Service - ok
21:55:32.0310 3192        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:55:32.0311 3192        bowser - ok
21:55:32.0323 3192        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:55:32.0324 3192        BrFiltLo - ok
21:55:32.0332 3192        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:55:32.0332 3192        BrFiltUp - ok
21:55:32.0368 3192        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:55:32.0369 3192        Browser - ok
21:55:32.0390 3192        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:55:32.0392 3192        Brserid - ok
21:55:32.0406 3192        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:55:32.0407 3192        BrSerWdm - ok
21:55:32.0417 3192        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:55:32.0417 3192        BrUsbMdm - ok
21:55:32.0423 3192        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:55:32.0424 3192        BrUsbSer - ok
21:55:32.0436 3192        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:55:32.0436 3192        BTHMODEM - ok
21:55:32.0468 3192        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:55:32.0469 3192        bthserv - ok
21:55:32.0487 3192        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:55:32.0488 3192        cdfs - ok
21:55:32.0517 3192        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
21:55:32.0518 3192        cdrom - ok
21:55:32.0547 3192        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:55:32.0548 3192        CertPropSvc - ok
21:55:32.0563 3192        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:55:32.0563 3192        circlass - ok
21:55:32.0587 3192        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:55:32.0589 3192        CLFS - ok
21:55:32.0644 3192        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:55:32.0645 3192        clr_optimization_v2.0.50727_32 - ok
21:55:32.0703 3192        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:55:32.0704 3192        clr_optimization_v2.0.50727_64 - ok
21:55:32.0760 3192        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:55:32.0761 3192        clr_optimization_v4.0.30319_32 - ok
21:55:32.0785 3192        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:55:32.0786 3192        clr_optimization_v4.0.30319_64 - ok
21:55:32.0794 3192        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:55:32.0794 3192        CmBatt - ok
21:55:32.0817 3192        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:55:32.0817 3192        cmdide - ok
21:55:32.0859 3192        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
21:55:32.0861 3192        CNG - ok
21:55:32.0885 3192        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:55:32.0886 3192        Compbatt - ok
21:55:32.0908 3192        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:55:32.0908 3192        CompositeBus - ok
21:55:32.0911 3192        COMSysApp - ok
21:55:32.0925 3192        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:55:32.0925 3192        crcdisk - ok
21:55:32.0949 3192        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
21:55:32.0951 3192        CryptSvc - ok
21:55:32.0983 3192        CSC            (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
21:55:32.0986 3192        CSC - ok
21:55:33.0028 3192        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
21:55:33.0032 3192        CscService - ok
21:55:33.0068 3192        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:55:33.0072 3192        DcomLaunch - ok
21:55:33.0112 3192        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:55:33.0114 3192        defragsvc - ok
21:55:33.0167 3192        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:55:33.0168 3192        DfsC - ok
21:55:33.0187 3192        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:55:33.0190 3192        Dhcp - ok
21:55:33.0200 3192        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:55:33.0201 3192        discache - ok
21:55:33.0216 3192        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:55:33.0216 3192        Disk - ok
21:55:33.0240 3192        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:55:33.0241 3192        Dnscache - ok
21:55:33.0277 3192        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:55:33.0279 3192        dot3svc - ok
21:55:33.0326 3192        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:55:33.0328 3192        DPS - ok
21:55:33.0354 3192        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:55:33.0355 3192        drmkaud - ok
21:55:33.0404 3192        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:55:33.0410 3192        DXGKrnl - ok
21:55:33.0445 3192        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:55:33.0446 3192        EapHost - ok
21:55:33.0594 3192        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:55:33.0613 3192        ebdrv - ok
21:55:33.0698 3192        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:55:33.0700 3192        EFS - ok
21:55:33.0760 3192        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
21:55:33.0764 3192        ehRecvr - ok
21:55:33.0795 3192        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
21:55:33.0795 3192        ehSched - ok
21:55:33.0845 3192        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:55:33.0848 3192        elxstor - ok
21:55:33.0869 3192        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:55:33.0869 3192        ErrDev - ok
21:55:33.0909 3192        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:55:33.0912 3192        EventSystem - ok
21:55:33.0931 3192        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:55:33.0933 3192        exfat - ok
21:55:33.0952 3192        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:55:33.0954 3192        fastfat - ok
21:55:34.0006 3192        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:55:34.0010 3192        Fax - ok
21:55:34.0027 3192        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:55:34.0027 3192        fdc - ok
21:55:34.0034 3192        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:55:34.0035 3192        fdPHost - ok
21:55:34.0048 3192        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:55:34.0049 3192        FDResPub - ok
21:55:34.0057 3192        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:55:34.0057 3192        FileInfo - ok
21:55:34.0070 3192        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:55:34.0070 3192        Filetrace - ok
21:55:34.0084 3192        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:55:34.0084 3192        flpydisk - ok
21:55:34.0121 3192        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:55:34.0123 3192        FltMgr - ok
21:55:34.0192 3192        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:55:34.0199 3192        FontCache - ok
21:55:34.0280 3192        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:55:34.0281 3192        FontCache3.0.0.0 - ok
21:55:34.0318 3192        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:55:34.0318 3192        FsDepends - ok
21:55:34.0341 3192        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:55:34.0341 3192        Fs_Rec - ok
21:55:34.0377 3192        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:55:34.0378 3192        fvevol - ok
21:55:34.0392 3192        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:55:34.0393 3192        gagp30kx - ok
21:55:34.0414 3192        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
21:55:34.0415 3192        GEARAspiWDM - ok
21:55:34.0468 3192        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:55:34.0473 3192        gpsvc - ok
21:55:34.0497 3192        grmnusb        (b9893a68032a6d9addb5b98287c630f7) C:\Windows\system32\drivers\grmnusb.sys
21:55:34.0497 3192        grmnusb - ok
21:55:34.0552 3192        gusvc          (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
21:55:34.0553 3192        gusvc - ok
21:55:34.0563 3192        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:55:34.0563 3192        hcw85cir - ok
21:55:34.0601 3192        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:55:34.0603 3192        HdAudAddService - ok
21:55:34.0636 3192        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:55:34.0640 3192        HDAudBus - ok
21:55:34.0643 3192        hdgnlava - ok
21:55:34.0657 3192        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:55:34.0657 3192        HidBatt - ok
21:55:34.0674 3192        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:55:34.0674 3192        HidBth - ok
21:55:34.0682 3192        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:55:34.0683 3192        HidIr - ok
21:55:34.0711 3192        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:55:34.0712 3192        hidserv - ok
21:55:34.0721 3192        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:55:34.0722 3192        HidUsb - ok
21:55:34.0745 3192        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:55:34.0746 3192        hkmsvc - ok
21:55:34.0779 3192        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:55:34.0781 3192        HomeGroupListener - ok
21:55:34.0798 3192        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:55:34.0801 3192        HomeGroupProvider - ok
21:55:34.0854 3192        HotspotShieldService (b2afa712b3cdf8ad04d85c56546bb174) C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
21:55:34.0855 3192        HotspotShieldService - ok
21:55:34.0885 3192        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:55:34.0886 3192        HpSAMD - ok
21:55:34.0906 3192        HssDrv          (a60c877e1cd3aa2e4e5ccd8af305c0f1) C:\Windows\system32\DRIVERS\HssDrv.sys
21:55:34.0907 3192        HssDrv - ok
21:55:34.0961 3192        HssSrv          (b8b90bb7011556691d432aaecaa0d26c) C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
21:55:34.0963 3192        HssSrv - ok
21:55:34.0990 3192        HssTrayService  (8faab97946600e312cb3398061ad3059) C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
21:55:34.0991 3192        HssTrayService - ok
21:55:34.0993 3192        HssWd - ok
21:55:35.0047 3192        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:55:35.0051 3192        HTTP - ok
21:55:35.0073 3192        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:55:35.0073 3192        hwpolicy - ok
21:55:35.0085 3192        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:55:35.0086 3192        i8042prt - ok
21:55:35.0148 3192        IAANTMON        (549275dc1004e09f92167b98b0ce63fe) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
21:55:35.0150 3192        IAANTMON - ok
21:55:35.0188 3192        iaStor          (f27742d576f355972c94952671658dc2) C:\Windows\system32\DRIVERS\iaStor.sys
21:55:35.0191 3192        iaStor - ok
21:55:35.0224 3192        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:55:35.0227 3192        iaStorV - ok
21:55:35.0266 3192        IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:55:35.0267 3192        IDriverT - ok
21:55:35.0369 3192        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:55:35.0374 3192        idsvc - ok
21:55:35.0464 3192        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:55:35.0465 3192        iirsp - ok
21:55:35.0524 3192        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:55:35.0529 3192        IKEEXT - ok
21:55:35.0532 3192        iktydhah - ok
21:55:35.0563 3192        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:55:35.0564 3192        intelide - ok
21:55:35.0571 3192        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:55:35.0572 3192        intelppm - ok
21:55:35.0594 3192        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:55:35.0596 3192        IPBusEnum - ok
21:55:35.0618 3192        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:55:35.0619 3192        IpFilterDriver - ok
21:55:35.0663 3192        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
21:55:35.0667 3192        iphlpsvc - ok
21:55:35.0676 3192        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:55:35.0677 3192        IPMIDRV - ok
21:55:35.0694 3192        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:55:35.0694 3192        IPNAT - ok
21:55:35.0781 3192        iPod Service    (50d6ccc6ff5561f9f56946b3e6164fb8) C:\Program Files\iPod\bin\iPodService.exe
21:55:35.0786 3192        iPod Service - ok
21:55:35.0798 3192        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:55:35.0799 3192        IRENUM - ok
21:55:35.0811 3192        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:55:35.0811 3192        isapnp - ok
21:55:35.0832 3192        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:55:35.0833 3192        iScsiPrt - ok
21:55:35.0894 3192        ISODrive        (9c6f3f69163133fb8e56ac4a6e163452) C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys
21:55:35.0895 3192        ISODrive - ok
21:55:35.0905 3192        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
21:55:35.0905 3192        kbdclass - ok
21:55:35.0926 3192        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
21:55:35.0927 3192        kbdhid - ok
21:55:35.0943 3192        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:35.0944 3192        KeyIso - ok
21:55:35.0957 3192        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
21:55:35.0958 3192        KSecDD - ok
21:55:35.0971 3192        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
21:55:35.0972 3192        KSecPkg - ok
21:55:35.0981 3192        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:55:35.0981 3192        ksthunk - ok
21:55:36.0018 3192        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:55:36.0021 3192        KtmRm - ok
21:55:36.0055 3192        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:55:36.0058 3192        LanmanServer - ok
21:55:36.0085 3192        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:55:36.0088 3192        LanmanWorkstation - ok
21:55:36.0108 3192        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:55:36.0108 3192        lltdio - ok
21:55:36.0130 3192        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:55:36.0133 3192        lltdsvc - ok
21:55:36.0148 3192        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:55:36.0150 3192        lmhosts - ok
21:55:36.0169 3192        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:55:36.0170 3192        LSI_FC - ok
21:55:36.0182 3192        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:55:36.0182 3192        LSI_SAS - ok
21:55:36.0196 3192        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:55:36.0197 3192        LSI_SAS2 - ok
21:55:36.0212 3192        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:55:36.0213 3192        LSI_SCSI - ok
21:55:36.0229 3192        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:55:36.0230 3192        luafv - ok
21:55:36.0252 3192        LVPr2M64        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:55:36.0252 3192        LVPr2M64 - ok
21:55:36.0254 3192        LVPr2Mon        (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
21:55:36.0255 3192        LVPr2Mon - ok
21:55:36.0292 3192        LVRS64          (0c85b2b6fb74b36a251792d45e0ef860) C:\Windows\system32\DRIVERS\lvrs64.sys
21:55:36.0294 3192        LVRS64 - ok
21:55:36.0516 3192        LVUVC64        (ff3a488924b0032b1a9ca6948c1fa9e8) C:\Windows\system32\DRIVERS\lvuvc64.sys
21:55:36.0542 3192        LVUVC64 - ok
21:55:36.0658 3192        MBAMProtector  (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
21:55:36.0658 3192        MBAMProtector - ok
21:55:36.0713 3192        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
21:55:36.0717 3192        MBAMService - ok
21:55:36.0738 3192        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
21:55:36.0740 3192        Mcx2Svc - ok
21:55:36.0769 3192        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:55:36.0770 3192        megasas - ok
21:55:36.0791 3192        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:55:36.0793 3192        MegaSR - ok
21:55:36.0811 3192        MEMSWEEP2      (f9ce67e9e0226079b59107b649851f96) C:\Windows\system32\2DB9.tmp
21:55:36.0812 3192        MEMSWEEP2 - ok
21:55:36.0871 3192        Microsoft SharePoint Workspace Audit Service - ok
21:55:36.0892 3192        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:55:36.0894 3192        MMCSS - ok
21:55:36.0905 3192        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:55:36.0905 3192        Modem - ok
21:55:36.0930 3192        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:55:36.0931 3192        monitor - ok
21:55:36.0951 3192        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:55:36.0952 3192        mouclass - ok
21:55:36.0959 3192        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:55:36.0959 3192        mouhid - ok
21:55:36.0997 3192        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:55:36.0998 3192        mountmgr - ok
21:55:37.0030 3192        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:55:37.0031 3192        mpio - ok
21:55:37.0049 3192        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:55:37.0050 3192        mpsdrv - ok
21:55:37.0114 3192        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
21:55:37.0120 3192        MpsSvc - ok
21:55:37.0160 3192        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:55:37.0161 3192        MRxDAV - ok
21:55:37.0189 3192        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:55:37.0190 3192        mrxsmb - ok
21:55:37.0227 3192        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:55:37.0229 3192        mrxsmb10 - ok
21:55:37.0262 3192        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:55:37.0263 3192        mrxsmb20 - ok
21:55:37.0272 3192        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:55:37.0272 3192        msahci - ok
21:55:37.0289 3192        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:55:37.0291 3192        msdsm - ok
21:55:37.0317 3192        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:55:37.0319 3192        MSDTC - ok
21:55:37.0335 3192        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:55:37.0335 3192        Msfs - ok
21:55:37.0344 3192        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:55:37.0345 3192        mshidkmdf - ok
21:55:37.0368 3192        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:55:37.0368 3192        msisadrv - ok
21:55:37.0398 3192        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:55:37.0400 3192        MSiSCSI - ok
21:55:37.0403 3192        msiserver - ok
21:55:37.0414 3192        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:55:37.0415 3192        MSKSSRV - ok
21:55:37.0427 3192        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:55:37.0427 3192        MSPCLOCK - ok
21:55:37.0431 3192        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:55:37.0431 3192        MSPQM - ok
21:55:37.0467 3192        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:55:37.0470 3192        MsRPC - ok
21:55:37.0485 3192        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:55:37.0486 3192        mssmbios - ok
21:55:37.0501 3192        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:55:37.0502 3192        MSTEE - ok
21:55:37.0509 3192        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:55:37.0510 3192        MTConfig - ok
21:55:37.0524 3192        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:55:37.0525 3192        Mup - ok
21:55:37.0556 3192        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:55:37.0560 3192        napagent - ok
21:55:37.0587 3192        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:55:37.0589 3192        NativeWifiP - ok
21:55:37.0669 3192        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:55:37.0674 3192        NDIS - ok
21:55:37.0693 3192        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:55:37.0694 3192        NdisCap - ok
21:55:37.0702 3192        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:55:37.0703 3192        NdisTapi - ok
21:55:37.0728 3192        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:55:37.0729 3192        Ndisuio - ok
21:55:37.0764 3192        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:55:37.0766 3192        NdisWan - ok
21:55:37.0788 3192        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:55:37.0789 3192        NDProxy - ok
21:55:37.0799 3192        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:55:37.0799 3192        NetBIOS - ok
21:55:37.0820 3192        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:55:37.0821 3192        NetBT - ok
21:55:37.0841 3192        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:37.0842 3192        Netlogon - ok
21:55:37.0892 3192        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:55:37.0894 3192        Netman - ok
21:55:37.0981 3192        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:37.0982 3192        NetMsmqActivator - ok
21:55:37.0985 3192        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:37.0986 3192        NetPipeActivator - ok
21:55:38.0017 3192        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:55:38.0021 3192        netprofm - ok
21:55:38.0024 3192        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:38.0025 3192        NetTcpActivator - ok
21:55:38.0028 3192        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:55:38.0029 3192        NetTcpPortSharing - ok
21:55:38.0073 3192        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:55:38.0073 3192        nfrd960 - ok
21:55:38.0096 3192        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:55:38.0099 3192        NlaSvc - ok
21:55:38.0162 3192        nlsX86cc        (b1ef4686961986dffb7fe8f18e6fcb5b) C:\Windows\SysWOW64\nlssrv32.exe
21:55:38.0163 3192        nlsX86cc - ok
21:55:38.0234 3192        NMSAccessU      (fd306fbcce7adb1077b709742e7148e9) C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
21:55:38.0235 3192        NMSAccessU - ok
21:55:38.0245 3192        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:55:38.0245 3192        Npfs - ok
21:55:38.0255 3192        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:55:38.0257 3192        nsi - ok
21:55:38.0272 3192        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:55:38.0273 3192        nsiproxy - ok
21:55:38.0366 3192        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:55:38.0376 3192        Ntfs - ok
21:55:38.0442 3192        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:55:38.0442 3192        Null - ok
21:55:38.0468 3192        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:55:38.0469 3192        nvraid - ok
21:55:38.0496 3192        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:55:38.0497 3192        nvstor - ok
21:55:38.0524 3192        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:55:38.0525 3192        nv_agp - ok
21:55:38.0540 3192        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:55:38.0541 3192        ohci1394 - ok
21:55:38.0574 3192        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:55:38.0574 3192        ose - ok
21:55:38.0857 3192        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:55:38.0879 3192        osppsvc - ok
21:55:38.0946 3192        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:55:38.0949 3192        p2pimsvc - ok
21:55:38.0991 3192        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:55:38.0995 3192        p2psvc - ok
21:55:39.0039 3192        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:55:39.0040 3192        Parport - ok
21:55:39.0071 3192        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:55:39.0071 3192        partmgr - ok
21:55:39.0092 3192        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:55:39.0095 3192        PcaSvc - ok
21:55:39.0127 3192        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:55:39.0128 3192        pci - ok
21:55:39.0140 3192        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:55:39.0140 3192        pciide - ok
21:55:39.0161 3192        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:55:39.0163 3192        pcmcia - ok
21:55:39.0172 3192        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:55:39.0173 3192        pcw - ok
21:55:39.0212 3192        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:55:39.0216 3192        PEAUTH - ok
21:55:39.0296 3192        PeerDistSvc    (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
21:55:39.0305 3192        PeerDistSvc - ok
21:55:39.0365 3192        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:55:39.0366 3192        PerfHost - ok
21:55:39.0488 3192        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:55:39.0497 3192        pla - ok
21:55:39.0532 3192        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:55:39.0536 3192        PlugPlay - ok
21:55:39.0554 3192        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:55:39.0556 3192        PNRPAutoReg - ok
21:55:39.0582 3192        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:55:39.0585 3192        PNRPsvc - ok
21:55:39.0621 3192        Point64        (33328fa8a580885ab0065be6db266e9f) C:\Windows\system32\DRIVERS\point64.sys
21:55:39.0622 3192        Point64 - ok
21:55:39.0671 3192        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:55:39.0675 3192        PolicyAgent - ok
21:55:39.0699 3192        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:55:39.0702 3192        Power - ok
21:55:39.0730 3192        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:55:39.0730 3192        PptpMiniport - ok
21:55:39.0757 3192        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:55:39.0757 3192        Processor - ok
21:55:39.0775 3192        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
21:55:39.0778 3192        ProfSvc - ok
21:55:39.0802 3192        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:39.0803 3192        ProtectedStorage - ok
21:55:39.0827 3192        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:55:39.0828 3192        Psched - ok
21:55:39.0852 3192        PSI            (fb46e9a827a8799ebd7bfa9128c91f37) C:\Windows\system32\DRIVERS\psi_mf.sys
21:55:39.0852 3192        PSI - ok
21:55:39.0883 3192        PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
21:55:39.0883 3192        PxHlpa64 - ok
21:55:39.0962 3192        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:55:39.0968 3192        ql2300 - ok
21:55:40.0045 3192        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:55:40.0046 3192        ql40xx - ok
21:55:40.0082 3192        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:55:40.0085 3192        QWAVE - ok
21:55:40.0098 3192        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:55:40.0098 3192        QWAVEdrv - ok
21:55:40.0111 3192        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:55:40.0111 3192        RasAcd - ok
21:55:40.0136 3192        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:55:40.0137 3192        RasAgileVpn - ok
21:55:40.0151 3192        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:55:40.0153 3192        RasAuto - ok
21:55:40.0175 3192        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:55:40.0176 3192        Rasl2tp - ok
21:55:40.0212 3192        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:55:40.0216 3192        RasMan - ok
21:55:40.0233 3192        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:55:40.0234 3192        RasPppoe - ok
21:55:40.0248 3192        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:55:40.0248 3192        RasSstp - ok
21:55:40.0291 3192        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:55:40.0293 3192        rdbss - ok
21:55:40.0307 3192        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:55:40.0307 3192        rdpbus - ok
21:55:40.0314 3192        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:55:40.0315 3192        RDPCDD - ok
21:55:40.0342 3192        RDPDR          (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
21:55:40.0343 3192        RDPDR - ok
21:55:40.0354 3192        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:55:40.0354 3192        RDPENCDD - ok
21:55:40.0361 3192        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:55:40.0361 3192        RDPREFMP - ok
21:55:40.0385 3192        RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
21:55:40.0385 3192        RdpVideoMiniport - ok
21:55:40.0420 3192        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
21:55:40.0422 3192        RDPWD - ok
21:55:40.0455 3192        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:55:40.0457 3192        rdyboost - ok
21:55:40.0485 3192        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:55:40.0487 3192        RemoteAccess - ok
21:55:40.0502 3192        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:55:40.0504 3192        RemoteRegistry - ok
21:55:40.0523 3192        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:55:40.0525 3192        RpcEptMapper - ok
21:55:40.0537 3192        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:55:40.0539 3192        RpcLocator - ok
21:55:40.0586 3192        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:55:40.0590 3192        RpcSs - ok
21:55:40.0603 3192        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:55:40.0604 3192        rspndr - ok
21:55:40.0647 3192        RTL8167        (fcaf9c2c9eadf8f397c3350760ef500f) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:55:40.0649 3192        RTL8167 - ok
21:55:40.0682 3192        RTL8169        (faeeed5a8949e6ba611a7b738ad28cee) C:\Windows\system32\DRIVERS\Rtlh64.sys
21:55:40.0682 3192        RTL8169 - ok
21:55:40.0702 3192        RtNdPt60        (2b38c905492f36fe42b59da52d6b4eb7) C:\Windows\system32\DRIVERS\RtNdPt60.sys
21:55:40.0703 3192        RtNdPt60 - ok
21:55:40.0711 3192        RTTEAMPT        (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:55:40.0712 3192        RTTEAMPT - ok
21:55:40.0727 3192        RTVLANPT        (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVlan60.sys
21:55:40.0728 3192        RTVLANPT - ok
21:55:40.0749 3192        s3cap          (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
21:55:40.0750 3192        s3cap - ok
21:55:40.0771 3192        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:40.0772 3192        SamSs - ok
21:55:40.0845 3192        SbieDrv        (0fe05dd9bbf0782e2bbf0977f2034616) C:\Program Files\Sandboxie\SbieDrv.sys
21:55:40.0846 3192        SbieDrv - ok
21:55:40.0869 3192        SbieSvc        (c970c7b2fd2e811525d4578d50b535f5) C:\Program Files\Sandboxie\SbieSvc.exe
21:55:40.0870 3192        SbieSvc - ok
21:55:40.0888 3192        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:55:40.0889 3192        sbp2port - ok
21:55:40.0919 3192        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:55:40.0921 3192        SCardSvr - ok
21:55:40.0942 3192        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:55:40.0942 3192        scfilter - ok
21:55:41.0012 3192        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:55:41.0020 3192        Schedule - ok
21:55:41.0051 3192        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:55:41.0052 3192        SCPolicySvc - ok
21:55:41.0079 3192        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:55:41.0082 3192        SDRSVC - ok
21:55:41.0134 3192        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:55:41.0134 3192        secdrv - ok
21:55:41.0151 3192        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:55:41.0153 3192        seclogon - ok
21:55:41.0244 3192        Secunia PSI Agent (7198bbfbe46c0070257278c536386687) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
21:55:41.0250 3192        Secunia PSI Agent - ok
21:55:41.0281 3192        Secunia Update Agent (d2fca567f9be87e29b9a9fa32ffe79ca) C:\Program Files (x86)\Secunia\PSI\sua.exe
21:55:41.0283 3192        Secunia Update Agent - ok
21:55:41.0362 3192        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:55:41.0364 3192        SENS - ok
21:55:41.0377 3192        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:55:41.0379 3192        SensrSvc - ok
21:55:41.0390 3192        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:55:41.0391 3192        Serenum - ok
21:55:41.0409 3192        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:55:41.0410 3192        Serial - ok
21:55:41.0433 3192        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:55:41.0434 3192        sermouse - ok
21:55:41.0468 3192        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:55:41.0470 3192        SessionEnv - ok
21:55:41.0495 3192        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:55:41.0496 3192        sffdisk - ok
21:55:41.0507 3192        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:55:41.0507 3192        sffp_mmc - ok
21:55:41.0511 3192        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:55:41.0511 3192        sffp_sd - ok
21:55:41.0529 3192        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:55:41.0530 3192        sfloppy - ok
21:55:41.0570 3192        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
21:55:41.0573 3192        SharedAccess - ok
21:55:41.0604 3192        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:55:41.0608 3192        ShellHWDetection - ok
21:55:41.0618 3192        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:55:41.0619 3192        SiSRaid2 - ok
21:55:41.0631 3192        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:55:41.0632 3192        SiSRaid4 - ok
21:55:41.0695 3192        SkypeUpdate    (17eab7852ff9f15fbaab4e95efc0b812) C:\Program Files (x86)\Skype\Updater\Updater.exe
21:55:41.0696 3192        SkypeUpdate - ok
21:55:41.0717 3192        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:55:41.0718 3192        Smb - ok
21:55:41.0739 3192        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:55:41.0741 3192        SNMPTRAP - ok
21:55:41.0752 3192        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:55:41.0753 3192        spldr - ok
21:55:41.0789 3192        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:55:41.0794 3192        Spooler - ok
21:55:41.0978 3192        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:55:41.0998 3192        sppsvc - ok
21:55:42.0067 3192        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:55:42.0069 3192        sppuinotify - ok
21:55:42.0132 3192        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:55:42.0134 3192        srv - ok
21:55:42.0171 3192        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:55:42.0173 3192        srv2 - ok
21:55:42.0189 3192        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:55:42.0190 3192        srvnet - ok
21:55:42.0212 3192        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:55:42.0214 3192        SSDPSRV - ok
21:55:42.0224 3192        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:55:42.0227 3192        SstpSvc - ok
21:55:42.0242 3192        StarOpen        (e57b778208c783d8debab320c16a1b82) C:\Windows\system32\drivers\StarOpen.sys
21:55:42.0242 3192        StarOpen - ok
21:55:42.0271 3192        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:55:42.0272 3192        stexstor - ok
21:55:42.0324 3192        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:55:42.0329 3192        stisvc - ok
21:55:42.0356 3192        storflt        (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
21:55:42.0356 3192        storflt - ok
21:55:42.0364 3192        storvsc        (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
21:55:42.0365 3192        storvsc - ok
21:55:42.0419 3192        STRATO HiDrive Service (a4533f6ee3dca68be5671c0571384e3a) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
21:55:42.0420 3192        STRATO HiDrive Service - ok
21:55:42.0443 3192        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:55:42.0443 3192        swenum - ok
21:55:42.0514 3192        SwitchBoard    (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
21:55:42.0518 3192        SwitchBoard - ok
21:55:42.0554 3192        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:55:42.0559 3192        swprv - ok
21:55:42.0564 3192        Synth3dVsc - ok
21:55:42.0666 3192        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:55:42.0677 3192        SysMain - ok
21:55:42.0755 3192        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:55:42.0757 3192        TabletInputService - ok
21:55:42.0793 3192        tap0901        (bcd6a90d6fd757ce9c29ddc850f7f231) C:\Windows\system32\DRIVERS\tap0901.sys
21:55:42.0794 3192        tap0901 - ok
21:55:42.0820 3192        taphss          (f33fdc72298df4bf9813a55d21f4eb31) C:\Windows\system32\DRIVERS\taphss.sys
21:55:42.0820 3192        taphss - ok
21:55:42.0862 3192        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:55:42.0865 3192        TapiSrv - ok
21:55:42.0888 3192        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:55:42.0891 3192        TBS - ok
21:55:43.0007 3192        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:55:43.0018 3192        Tcpip - ok
21:55:43.0119 3192        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:55:43.0130 3192        TCPIP6 - ok
21:55:43.0187 3192        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:55:43.0188 3192        tcpipreg - ok
21:55:43.0209 3192        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:55:43.0209 3192        TDPIPE - ok
21:55:43.0232 3192        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:55:43.0232 3192        TDTCP - ok
21:55:43.0262 3192        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:55:43.0263 3192        tdx - ok
21:55:43.0290 3192        TEAM            (8df706a5a12a4832a3291a1ff26a7cc1) C:\Windows\system32\DRIVERS\RtTeam60.sys
21:55:43.0290 3192        TEAM - ok
21:55:43.0489 3192        TeamViewer7    (74fc70ae64a7b7dabec9697ce0a1f4fa) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
21:55:43.0506 3192        TeamViewer7 - ok
21:55:43.0551 3192        teamviewervpn  (f5520dbb47c60ee83024b38720abda24) C:\Windows\system32\DRIVERS\teamviewervpn.sys
21:55:43.0551 3192        teamviewervpn - ok
21:55:43.0576 3192        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:55:43.0576 3192        TermDD - ok
21:55:43.0634 3192        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:55:43.0639 3192        TermService - ok
21:55:43.0661 3192        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:55:43.0663 3192        Themes - ok
21:55:43.0692 3192        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:55:43.0693 3192        THREADORDER - ok
21:55:43.0711 3192        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:55:43.0713 3192        TrkWks - ok
21:55:43.0746 3192        truecrypt      (8de922cd4fea6f83b10805df965b9a08) C:\Windows\system32\drivers\truecrypt.sys
21:55:43.0748 3192        truecrypt - ok
21:55:43.0805 3192        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:55:43.0806 3192        TrustedInstaller - ok
21:55:43.0829 3192        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:55:43.0830 3192        tssecsrv - ok
21:55:43.0853 3192        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:55:43.0854 3192        TsUsbFlt - ok
21:55:43.0857 3192        tsusbhub - ok
21:55:43.0888 3192        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:55:43.0889 3192        tunnel - ok
21:55:43.0916 3192        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:55:43.0917 3192        uagp35 - ok
21:55:43.0955 3192        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:55:43.0957 3192        udfs - ok
21:55:43.0977 3192        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:55:43.0979 3192        UI0Detect - ok
21:55:43.0991 3192        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:55:43.0992 3192        uliagpkx - ok
21:55:44.0017 3192        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
21:55:44.0018 3192        umbus - ok
21:55:44.0030 3192        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:55:44.0030 3192        UmPass - ok
21:55:44.0069 3192        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
21:55:44.0071 3192        UmRdpService - ok
21:55:44.0166 3192        UMVPFSrv        (67a95b9d129ed5399e7965cd09cf30e7) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
21:55:44.0168 3192        UMVPFSrv - ok
21:55:44.0193 3192        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:55:44.0196 3192        upnphost - ok
21:55:44.0208 3192        USBAAPL64      (fb251567f41bc61988b26731dec19e4b) C:\Windows\system32\Drivers\usbaapl64.sys
21:55:44.0208 3192        USBAAPL64 - ok
21:55:44.0231 3192        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
21:55:44.0232 3192        usbaudio - ok
21:55:44.0251 3192        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:55:44.0252 3192        usbccgp - ok
21:55:44.0277 3192        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:55:44.0278 3192        usbcir - ok
21:55:44.0301 3192        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
21:55:44.0301 3192        usbehci - ok
21:55:44.0325 3192        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:55:44.0327 3192        usbhub - ok
21:55:44.0343 3192        usbohci        (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
21:55:44.0343 3192        usbohci - ok
21:55:44.0348 3192        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:55:44.0348 3192        usbprint - ok
21:55:44.0367 3192        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:55:44.0368 3192        USBSTOR - ok
21:55:44.0382 3192        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
21:55:44.0382 3192        usbuhci - ok
21:55:44.0407 3192        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:55:44.0408 3192        UxSms - ok
21:55:44.0424 3192        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:55:44.0425 3192        VaultSvc - ok
21:55:44.0431 3192        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:55:44.0431 3192        vdrvroot - ok
21:55:44.0478 3192        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:55:44.0481 3192        vds - ok
21:55:44.0496 3192        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:55:44.0496 3192        vga - ok
21:55:44.0510 3192        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:55:44.0511 3192        VgaSave - ok
21:55:44.0513 3192        VGPU - ok
21:55:44.0536 3192        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:55:44.0537 3192        vhdmp - ok
21:55:44.0544 3192        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:55:44.0544 3192        viaide - ok
21:55:44.0572 3192        VLAN            (8b6b42d782202363a562f82b0e13b1c0) C:\Windows\system32\DRIVERS\RtVLAN60.sys
21:55:44.0572 3192        VLAN - ok
21:55:44.0590 3192        vmbus          (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
21:55:44.0591 3192        vmbus - ok
21:55:44.0603 3192        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
21:55:44.0603 3192        VMBusHID - ok
21:55:44.0612 3192        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:55:44.0613 3192        volmgr - ok
21:55:44.0648 3192        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:55:44.0650 3192        volmgrx - ok
21:55:44.0676 3192        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:55:44.0677 3192        volsnap - ok
21:55:44.0692 3192        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:55:44.0693 3192        vsmraid - ok
21:55:44.0772 3192        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:55:44.0780 3192        VSS - ok
21:55:44.0876 3192        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
21:55:44.0876 3192        vwifibus - ok
21:55:44.0924 3192        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:55:44.0926 3192        W32Time - ok
21:55:44.0936 3192        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:55:44.0936 3192        WacomPen - ok
21:55:44.0954 3192        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:55:44.0955 3192        WANARP - ok
21:55:44.0957 3192        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:55:44.0957 3192        Wanarpv6 - ok
21:55:45.0034 3192        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:55:45.0039 3192        WatAdminSvc - ok
21:55:45.0120 3192        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:55:45.0128 3192        wbengine - ok
21:55:45.0183 3192        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:55:45.0185 3192        WbioSrvc - ok
21:55:45.0223 3192        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:55:45.0226 3192        wcncsvc - ok
21:55:45.0235 3192        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:55:45.0237 3192        WcsPlugInService - ok
21:55:45.0257 3192        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:55:45.0258 3192        Wd - ok
21:55:45.0297 3192        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:55:45.0299 3192        Wdf01000 - ok
21:55:45.0312 3192        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:55:45.0314 3192        WdiServiceHost - ok
21:55:45.0315 3192        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:55:45.0317 3192        WdiSystemHost - ok
21:55:45.0351 3192        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:55:45.0353 3192        WebClient - ok
21:55:45.0374 3192        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:55:45.0377 3192        Wecsvc - ok
21:55:45.0389 3192        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:55:45.0391 3192        wercplsupport - ok
21:55:45.0405 3192        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:55:45.0407 3192        WerSvc - ok
21:55:45.0417 3192        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:55:45.0418 3192        WfpLwf - ok
21:55:45.0432 3192        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:55:45.0432 3192        WIMMount - ok
21:55:45.0477 3192        WinDefend - ok
21:55:45.0482 3192        WinHttpAutoProxySvc - ok
21:55:45.0537 3192        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:55:45.0538 3192        Winmgmt - ok
21:55:45.0660 3192        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:55:45.0669 3192        WinRM - ok
21:55:45.0754 3192        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
21:55:45.0755 3192        WinUsb - ok
21:55:45.0824 3192        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:55:45.0830 3192        Wlansvc - ok
21:55:45.0852 3192        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:55:45.0852 3192        WmiAcpi - ok
21:55:45.0877 3192        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:55:45.0879 3192        wmiApSrv - ok
21:55:45.0925 3192        WMPNetworkSvc - ok
21:55:45.0942 3192        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:55:45.0945 3192        WPCSvc - ok
21:55:45.0978 3192        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:55:45.0981 3192        WPDBusEnum - ok
21:55:46.0002 3192        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:55:46.0002 3192        ws2ifsl - ok
21:55:46.0020 3192        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
21:55:46.0023 3192        wscsvc - ok
21:55:46.0026 3192        WSearch - ok
21:55:46.0153 3192        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
21:55:46.0164 3192        wuauserv - ok
21:55:46.0253 3192        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:55:46.0254 3192        WudfPf - ok
21:55:46.0274 3192        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:55:46.0276 3192        wudfsvc - ok
21:55:46.0301 3192        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
21:55:46.0304 3192        WwanSvc - ok
21:55:46.0328 3192        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
21:55:46.0628 3192        \Device\Harddisk0\DR0 - ok
21:55:46.0630 3192        Boot (0x1200)  (0bad36234d44da07ecd9352cabff905d) \Device\Harddisk0\DR0\Partition0
21:55:46.0635 3192        \Device\Harddisk0\DR0\Partition0 - ok
21:55:46.0647 3192        Boot (0x1200)  (777b13c19d7df68449108280f2a13010) \Device\Harddisk0\DR0\Partition1
21:55:46.0648 3192        \Device\Harddisk0\DR0\Partition1 - ok
21:55:46.0662 3192        Boot (0x1200)  (2bb9fa725471a7211fc6a271a3451b14) \Device\Harddisk0\DR0\Partition2
21:55:46.0663 3192        \Device\Harddisk0\DR0\Partition2 - ok
21:55:46.0691 3192        Boot (0x1200)  (886e4e72fb1c452c861462f8cfa669af) \Device\Harddisk0\DR0\Partition3
21:55:46.0692 3192        \Device\Harddisk0\DR0\Partition3 - ok
21:55:46.0692 3192        ============================================================
21:55:46.0692 3192        Scan finished
21:55:46.0692 3192        ============================================================
21:55:46.0700 5008        Detected object count: 1
21:55:46.0700 5008        Actual detected object count: 1
21:55:54.0884 5008        c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll - copied to quarantine
21:55:54.0885 5008        Akamai ( HiddenFile.Multi.Generic ) - User select action: Quarantine
21:56:27.0397 3308        Deinitialize success

cosinus 18.06.2012 08:22
Code:
c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll - copied to quarantine
Da hast du nochmal Glück gehabt. Außer diesem Akamai-Geraffel wurde nichts systemrelevantes aufgelistet, so dass du auch nichts wichtiges löschen konntest :pfeiff:

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

myspam69 18.06.2012 19:31
Combofix Log:

[CODE]
Combofix Logfile:
Code:
ComboFix 12-06-16.02 - FH 18.06.2012  19:29:26.1.2 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1033.18.8190.6494 [GMT 2:00]
ausgeführt von:: c:\users\FH\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\avisynth.dll
c:\windows\SysWow64\devil.dll
c:\windows\SysWow64\odbcad32.exe
c:\windows\SysWow64\xa2930853.exe
c:\windows\SysWow64\xa2931055.exe
c:\windows\SysWow64\xa4960223.exe
c:\windows\SysWow64\xa4960410.exe
.
Infizierte Kopie von c:\windows\ehome\McxTask.exe wurde gefunden und desinfiziert
Kopie von - c:\combofix\HarddiskVolumeShadowCopy9_!Windows!ehome!McxTask.exe wurde wiederhergestellt
.
Infizierte Kopie von c:\windows\ehome\CreateDisc\SBEServer.exe wurde gefunden und desinfiziert
Kopie von - c:\combofix\HarddiskVolumeShadowCopy8_!Windows!ehome!CreateDisc!SBEServer.exe wurde wiederhergestellt
.
Infizierte Kopie von c:\windows\System32\dccw.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_6.1.7600.16385_none_76e39d87a834545e\dccw.exe wurde wiederhergestellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-18 bis 2012-06-18  ))))))))))))))))))))))))))))))
.
.
2012-06-18 17:38 . 2012-06-18 17:38        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-16 06:29 . 2012-06-16 06:29        --------        d-----w-        c:\windows\system32\%LOCALAPPDATA%
2012-06-16 06:23 . 2012-05-14 23:41        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{FBB06A9C-B12D-4A2E-8DDC-1106B46F94E0}\mpengine.dll
2012-06-14 18:15 . 2012-06-14 18:15        --------        d-----w-        C:\_OTL
2012-06-14 05:36 . 2012-04-26 05:41        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-06-14 05:36 . 2012-04-26 05:41        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-06-14 05:36 . 2012-04-26 05:34        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-06-10 18:54 . 2012-06-10 18:54        --------        d-----w-        c:\program files (x86)\ESET
2012-06-10 10:25 . 2012-06-14 22:08        --------        d-----w-        c:\users\FH\AppData\Roaming\vlc
2012-06-10 08:40 . 2012-06-10 08:40        --------        d-----w-        c:\users\FH\AppData\Local\Macromedia
2012-06-07 19:08 . 2012-06-07 19:08        --------        d-----w-        c:\users\FH\Doctor Web
2012-06-06 19:55 . 2012-06-06 19:55        --------        d-----w-        C:\TDSSKiller_Quarantine
2012-06-06 16:12 . 2012-06-06 16:12        --------        d-----w-        c:\users\FH\AppData\Roaming\bluejeans
2012-06-04 18:52 . 2012-06-04 19:11        --------        d-----w-        c:\users\FH\DoctorWeb
2012-06-04 17:27 . 2012-06-17 10:17        --------        d-----w-        c:\program files (x86)\Sophos
2012-06-03 18:40 . 2012-06-03 18:40        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-03 18:40 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-05-27 16:22 . 2012-05-28 08:03        --------        d-----w-        c:\users\FH.FH-PC
2012-05-24 21:18 . 2012-05-24 21:18        4472832        ----a-w-        c:\windows\SysWow64\GPhotos.scr
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-10 08:37 . 2012-04-03 07:52        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-10 08:37 . 2011-05-15 16:42        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-09 16:42 . 2012-04-03 14:42        8769696        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-18 18:56 . 2012-04-18 18:56        94208        ----a-w-        c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-18 18:56 . 2012-04-18 18:56        69632        ----a-w-        c:\windows\SysWow64\QuickTime.qts
2012-04-18 13:05 . 2012-04-18 13:05        19304        ----a-w-        c:\windows\system32\drivers\grmnusb.sys
2012-04-18 13:05 . 2012-04-18 13:05        30568        ----a-w-        c:\windows\system32\drivers\grmngen.sys
2012-04-11 18:40 . 2012-04-11 18:40        61440        ----a-r-        c:\users\FH\AppData\Roaming\Microsoft\Installer\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}\ARPPRODUCTICON.exe
2012-04-11 18:39 . 2003-03-18 18:05        106496        ----a-w-        c:\windows\SysWow64\ATL71.DLL
2012-03-30 11:35 . 2012-05-08 17:50        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2006-05-03 10:06        163328        --sha-r-        c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47        31232        --sha-r-        c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30        216064        --sha-r-        c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        94208        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        94208        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        94208        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"Akamai NetSession Interface"="c:\users\FH\AppData\Local\Akamai\netsession_win.exe" [2012-05-07 3331872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-1-10 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 hdgnlava;hdgnlava;c:\windows\system32\drivers\hdgnlava.sys [x]
R1 iktydhah;iktydhah;c:\windows\system32\drivers\iktydhah.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-10 257224]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\2DB9.tmp [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub; [x]
R4 nlsX86cc;This service enables products that use the Nalpeiron Licensing System.;c:\windows\SysWOW64\nlssrv32.exe [2011-09-22 66560]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-01-10 993848]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-01-10 399416]
S2 STRATO HiDrive Service;STRATO HiDrive Service;c:\program files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [2011-07-05 32768]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-02-23 2886528]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - aswFsBlk
*Deregistered* - aswMonFlt
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai        REG_MULTI_SZ          Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 08:37]
.
2012-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000Core.job
- c:\users\FH\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-05 16:08]
.
2012-06-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000UA.job
- c:\users\FH\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-05 16:08]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-04-10 186904]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: add to &BOM - c:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab
FF - ProfilePath - c:\users\FH\AppData\Roaming\Mozilla\Firefox\Profiles\ax7ky0ja.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\2DB9.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-18  19:59:20 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-18 17:59
.
Vor Suchlauf: 13 Verzeichnis(se), 66.555.785.216 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 65.881.513.984 Bytes frei
.
- - End Of File - - 0D5F2CB5FE0D341B9F48E17E815092B2
--- --- ---

cosinus 18.06.2012 21:33
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
File::
c:\windows\system32\drivers\hdgnlava.sys
c:\windows\system32\drivers\iktydhah.sys

Driver::
hdgnlava
iktydhah

Dirlook::
c:\windows\system32\%LOCALAPPDATA%
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

myspam69 19.06.2012 19:50
[CODE]

Combofix Logfile:
Code:
ComboFix 12-06-16.02 - FH 19.06.2012  8:06.2.2 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1033.18.8190.6537 [GMT 2:00]
ausgeführt von:: c:\users\FH\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\FH\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
FILE ::
"c:\windows\system32\drivers\hdgnlava.sys"
"c:\windows\system32\drivers\iktydhah.sys"
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_hdgnlava
-------\Service_iktydhah
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-19 bis 2012-06-19  ))))))))))))))))))))))))))))))
.
.
2012-06-19 06:13 . 2012-06-19 06:13        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-18 18:20 . 2012-05-14 23:41        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F09439C9-E78D-4A14-8769-188D556B447F}\mpengine.dll
2012-06-16 06:29 . 2012-06-16 06:29        --------        d-----w-        c:\windows\system32\%LOCALAPPDATA%
2012-06-14 18:15 . 2012-06-14 18:15        --------        d-----w-        C:\_OTL
2012-06-14 05:36 . 2012-04-26 05:41        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-06-14 05:36 . 2012-04-26 05:41        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-06-14 05:36 . 2012-04-26 05:34        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-06-10 18:54 . 2012-06-10 18:54        --------        d-----w-        c:\program files (x86)\ESET
2012-06-10 10:25 . 2012-06-14 22:08        --------        d-----w-        c:\users\FH\AppData\Roaming\vlc
2012-06-10 08:40 . 2012-06-10 08:40        --------        d-----w-        c:\users\FH\AppData\Local\Macromedia
2012-06-07 19:08 . 2012-06-07 19:08        --------        d-----w-        c:\users\FH\Doctor Web
2012-06-06 19:55 . 2012-06-06 19:55        --------        d-----w-        C:\TDSSKiller_Quarantine
2012-06-06 16:12 . 2012-06-06 16:12        --------        d-----w-        c:\users\FH\AppData\Roaming\bluejeans
2012-06-04 18:52 . 2012-06-04 19:11        --------        d-----w-        c:\users\FH\DoctorWeb
2012-06-04 17:27 . 2012-06-17 10:17        --------        d-----w-        c:\program files (x86)\Sophos
2012-06-03 18:40 . 2012-06-03 18:40        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-03 18:40 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-05-27 16:22 . 2012-05-28 08:03        --------        d-----w-        c:\users\FH.FH-PC
2012-05-24 21:18 . 2012-05-24 21:18        4472832        ----a-w-        c:\windows\SysWow64\GPhotos.scr
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-10 08:37 . 2012-04-03 07:52        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-10 08:37 . 2011-05-15 16:42        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-09 16:42 . 2012-04-03 14:42        8769696        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-18 18:56 . 2012-04-18 18:56        94208        ----a-w-        c:\windows\SysWow64\QuickTimeVR.qtx
2012-04-18 18:56 . 2012-04-18 18:56        69632        ----a-w-        c:\windows\SysWow64\QuickTime.qts
2012-04-18 13:05 . 2012-04-18 13:05        19304        ----a-w-        c:\windows\system32\drivers\grmnusb.sys
2012-04-18 13:05 . 2012-04-18 13:05        30568        ----a-w-        c:\windows\system32\drivers\grmngen.sys
2012-04-11 18:40 . 2012-04-11 18:40        61440        ----a-r-        c:\users\FH\AppData\Roaming\Microsoft\Installer\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}\ARPPRODUCTICON.exe
2012-04-11 18:39 . 2003-03-18 18:05        106496        ----a-w-        c:\windows\SysWow64\ATL71.DLL
2012-03-30 11:35 . 2012-05-08 17:50        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2006-05-03 10:06        163328        --sha-r-        c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47        31232        --sha-r-        c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30        216064        --sha-r-        c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((((((((((  Look  )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\system32\%LOCALAPPDATA% ----
.
1601-01-01 00:00 . 1601-01-01 00:00        0        ----a-w-        c:\windows\system32\%LOCALAPPDATA%\CrashDumps\lsass.exe.612.dmp
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-20 . A6F09E5669D9A19035F6D942CAA15882 . 119808 . . [6.1.7601.17514] .. c:\windows\erdnt\cache86\imm32.dll
[-] 2010-11-20 . D65AA9B3EFDD5B4125F7187F896D941A . 119808 . . [6.1.7601.17514] .. c:\windows\SysWOW64\imm32.dll
[-] 2010-11-20 . D65AA9B3EFDD5B4125F7187F896D941A . 119808 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-imm32_31bf3856ad364e35_6.1.7601.17514_none_c4d0cdd7c56b493e\imm32.dll
.
(((((((((((((((((((((((((((((  SnapShot@2012-06-18_17.56.59  )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-06-19 06:14        32768              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-06-18 17:40        32768              c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-06-19 06:14        49152              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-06-18 17:40        49152              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-06-18 17:40        16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-06-19 06:14        16384              c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-11-05 21:22 . 2012-06-19 06:01        83566              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2012-06-18 17:25        52342              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-06-19 06:01        52342              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-11-05 21:08 . 2012-06-19 06:01        35472              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3505417148-2086896735-3607467643-1000_UserData.bin
+ 2011-04-09 08:47 . 2012-06-19 17:56        90024              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2009-07-13 23:37 . 2009-07-14 01:28        7680              c:\windows\system32\KBDIBO.DLL
- 2012-06-18 17:40 . 2012-06-18 17:40        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-06-19 06:14 . 2012-06-19 06:14        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-06-18 17:40 . 2012-06-18 17:40        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-06-19 06:14 . 2012-06-19 06:14        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2012-06-19 06:19        655054              c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-06-18 17:44        655054              c:\windows\system32\perfh009.dat
- 2009-06-24 16:40 . 2012-06-18 17:44        698738              c:\windows\system32\perfh007.dat
+ 2009-06-24 16:40 . 2012-06-19 06:19        698738              c:\windows\system32\perfh007.dat
+ 2009-07-14 02:36 . 2012-06-19 06:19        121926              c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-06-18 17:44        121926              c:\windows\system32\perfc009.dat
- 2009-06-24 16:40 . 2012-06-18 17:44        148818              c:\windows\system32\perfc007.dat
+ 2009-06-24 16:40 . 2012-06-19 06:19        148818              c:\windows\system32\perfc007.dat
+ 2009-07-14 05:01 . 2012-06-19 06:13        577964              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-06-18 17:38        577964              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-06-18 17:22 . 2012-06-19 05:59        4812496              c:\windows\system32\FNTCACHE.DAT
- 2011-03-19 18:59 . 2012-06-18 17:38        37544776              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3505417148-2086896735-3607467643-1000-8192.dat
+ 2011-03-19 18:59 . 2012-06-19 06:13        37544776              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3505417148-2086896735-3607467643-1000-8192.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        94208        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        94208        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        94208        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"Akamai NetSession Interface"="c:\users\FH\AppData\Local\Akamai\netsession_win.exe" [2012-05-07 3331872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-1-10 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-10 257224]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\2DB9.tmp [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [x]
R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub; [x]
R4 nlsX86cc;This service enables products that use the Nalpeiron Licensing System.;c:\windows\SysWOW64\nlssrv32.exe [2011-09-22 66560]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-01-10 993848]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-01-10 399416]
S2 STRATO HiDrive Service;STRATO HiDrive Service;c:\program files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [2011-07-05 32768]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-02-23 2886528]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - aswFsBlk
*Deregistered* - aswMonFlt
*Deregistered* - aswRdr
*Deregistered* - aswSP
*Deregistered* - aswTdi
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai        REG_MULTI_SZ          Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 08:37]
.
2012-06-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000Core.job
- c:\users\FH\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-05 16:08]
.
2012-06-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000UA.job
- c:\users\FH\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-05 16:08]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36        97792        ----a-w-        c:\users\FH\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-04-10 186904]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"combofix"="c:\combofix\CF23024.3XE" [2010-11-20 345088]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: add to &BOM - c:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab
FF - ProfilePath - c:\users\FH\AppData\Roaming\Mozilla\Firefox\Profiles\ax7ky0ja.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_80c2ffa.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\2DB9.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-19  19:58:51 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-19 17:58
ComboFix2.txt  2012-06-18 17:59
.
Vor Suchlauf: 16 Verzeichnis(se), 65.997.205.504 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 61.757.706.240 Bytes frei
.
- - End Of File - - 9C1C2F51FEE772D621D72B7321C3126A
--- --- ---

cosinus 20.06.2012 10:25
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

myspam69 20.06.2012 18:47
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-20 18:22:05
Windows 6.1.7601 Service Pack 1
Running: e29snc01.exe


---- Registry - GMER 1.0.15 ----

Reg  HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\FH\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- EOF - GMER 1.0.15 ----
--- --- ---


OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 18:29:06 on 20.06.2012

OS: Windows 7 Ultimate Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 13.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000Core.job" - "Google Inc." - C:\Users\FH\AppData\Local\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-3505417148-2086896735-3607467643-1000UA.job" - "Google Inc." - C:\Users\FH\AppData\Local\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%SystemRoot%\system32\drivers\tsusbhub.sys,-1" (tsusbhub) - ? - C:\Windows\System32\drivers\tsusbhub.sys  (File not found)
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"elxstor" (elxstor) - "Emulex" - C:\Windows\system32\DRIVERS\elxstor.sys  (Data mismatch, rootkit activity)
"ISO DVD/CD-ROM Device Driver" (ISODrive) - "EZB Systems, Inc." - C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"MEMSWEEP2" (MEMSWEEP2) - ? - C:\Windows\system32\2DB9.tmp  (File not found)
"PSI" (PSI) - "Secunia" - C:\Windows\System32\DRIVERS\psi_mf.sys
"PxHlpa64" (PxHlpa64) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHlpa64.sys
"SbieDrv" (SbieDrv) - "SANDBOXIE L.T.D" - C:\Program Files\Sandboxie\SbieDrv.sys
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
"Synth3dVsc" (Synth3dVsc) - ? - C:\Windows\System32\drivers\synth3dvsc.sys  (File not found)
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\Windows\System32\drivers\truecrypt.sys
"VGPU" (VGPU) - ? - C:\Windows\System32\drivers\rdvgkmd.sys  (File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{4B4F4C4F-5220-4798-ABF3-EC03F7C8A498} "AutopanoShell.ShellContextMenu Class by Kolor" - ? -  (File not found | COM-object registry key not found)
{4B4F4C4F-5220-4798-ABF3-EC03F7C8A494} "AutopanoShell.ShellExtractImage Class by Kolor" - ? -  (File not found | COM-object registry key not found)
{4B4F4C4F-5220-4798-ABF3-EC03F7C8A499} "AutopanoShell.ShellPropertySystem Class by Kolor" - ? -  (File not found | COM-object registry key not found)
{4B4F4C4F-5220-4798-ABF3-EC03F7C8A495} "AutopanoShell.ShellQueryInfo Class by Kolor" - ? -  (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\MLSHEXT.DLL
{0006F045-0000-0000-C000-000000000046} "Microsoft Outlook Custom Icon Handler" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{4871A87A-BFDD-4106-8153-FFDE2BAC2967} "DLM Control" - "Akamai Technologies, Inc." - C:\Windows\DOWNLO~1\DOWNLO~1.OCX / hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.1.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} "JordanUploader Class" - "IPLabs GmbH" - C:\Windows\Downloaded Program Files\JordanApplet.dll / hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_2_202_235.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{644E432F-49D3-41A1-8DD5-E099162EEEC5} "Symantec RuFSI Utility Class" - "Symantec Corporation" - C:\Windows\Downloaded Program Files\rufsi.dll / hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\FH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Secunia PSI Tray.lnk" - "Secunia" - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Akamai NetSession Interface" - "Akamai Technologies, Inc" - "C:\Users\FH\AppData\Local\Akamai\netsession_win.exe"
"MobileDocuments" - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe  (Data mismatch, rootkit activity)
"APSDaemon" - "Apple Inc." - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"iTunesHelper" - "Apple Inc." - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"QuickTime Task" - "Apple Inc." - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDF-XChange4" - "Tracker Software Products Ltd." - C:\Windows\system32\pxc40pm.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"@%systemroot%\system32\cscsvc.dll,-200" (CscService) - "Microsoft Corporation" - C:\Windows\System32\cscsvc.dll  (Data mismatch, rootkit activity)
"@%systemroot%\system32\fxsresm.dll,-118" (Fax) - "Microsoft Corporation" - C:\Windows\system32\fxssvc.exe  (Data mismatch, rootkit activity)
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"Akamai NetSession Interface" (Akamai) - ? - c:\program files (x86)\common files\akamai\netsession_win_80c2ffa.dll  (Data mismatch, rootkit activity | File found, but it contains no detailed information)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Google Updater Service" (gusvc) - "Google" - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Secunia PSI Agent" (Secunia PSI Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\PSIA.exe
"Secunia Update Agent" (Secunia Update Agent) - "Secunia" - C:\Program Files (x86)\Secunia\PSI\sua.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"STRATO HiDrive Service" (STRATO HiDrive Service) - "STRATO" - C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
"TeamViewer 7" (TeamViewer7) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
[/CODE]

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-20 19:44:15
-----------------------------
19:44:15.173    OS Version: Windows x64 6.1.7601 Service Pack 1
19:44:15.173    Number of processors: 2 586 0x170A
19:44:15.173    ComputerName: FH-PC  UserName: FH
19:44:15.750    Initialize success
19:44:18.792    AVAST engine defs: 12062001
19:44:29.135    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:44:29.135    Disk 0 Vendor: SAMSUNG_ 1AA0 Size: 953868MB BusType: 3
19:44:29.151    Disk 0 MBR read successfully
19:44:29.151    Disk 0 MBR scan
19:44:29.151    Disk 0 Windows 7 default MBR code
19:44:29.166    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
19:44:29.166    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      149899 MB offset 206848
19:44:29.182    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      703866 MB offset 307200000
19:44:29.182    Disk 0 Partition - 00    0F Extended LBA            100001 MB offset 1748717568
19:44:29.213    Disk 0 Partition 4 00    07    HPFS/NTFS            100000 MB offset 1748719616
19:44:29.244    Disk 0 scanning C:\Windows\system32\drivers
19:44:36.140    Service scanning
19:44:52.176    Modules scanning
19:44:52.176    Disk 0 trace - called modules:
19:44:52.192    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys
19:44:52.192    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800855d3b0]
19:44:52.192    3 CLASSPNP.SYS[fffff88001baa43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007508050]
19:44:52.208    Scan finished successfully
19:45:10.148    Disk 0 MBR has been saved successfully to "C:\Users\FH\Desktop\MBR.dat"
19:45:10.148    The log file has been saved successfully to "C:\Users\FH\Desktop\aswMBR.txt"

cosinus 21.06.2012 10:06
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

myspam69 21.06.2012 19:28
Code:
Malwarebytes Anti-Malware (PRO) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.21.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
FH :: FH-PC [Administrator]

Schutz: Aktiviert

21.06.2012 19:24:18
mbam-log-2012-06-21 (19-24-18).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 499752
Laufzeit: 47 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 21.06.2012 19:53
Zitat:
(PRO) 1.61.0.1400
Hast du dir MBAM gekauft? :wtf:

myspam69 22.06.2012 06:26
Code:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/21/2012 at 10:57 PM

Application Version : 5.1.1002

Core Rules Database Version : 8774
Trace Rules Database Version: 6586

Scan type      : Complete Scan
Total Scan Time : 02:20:15

Operating System Information
Windows 7 Ultimate 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 570
Memory threats detected  : 0
Registry items scanned    : 66124
Registry threats detected : 0
File items scanned        : 225394
File threats detected    : 70

Trojan.Agent/Gen-Sisproc
        D:\SOFTWARE\MOTHERBOARD_BIOS_GA-EP45-DS3_F9.EXE

Adware.Tracking Cookie
        .doubleclick.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .apmebf.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tracking.quisma.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .invitemedia.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        stats.bmw.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .serving-sys.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .atdmt.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        adx.chip.de [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .imrworldwide.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad.yieldmanager.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad4.adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        track.adform.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adform.net [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad2.adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .mediaplex.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        ad1.adfarm1.adition.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .tradedoubler.com [ C:\USERS\FH\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

cosinus 22.06.2012 10:31
Code:
Trojan.Agent/Gen-Sisproc
        D:\SOFTWARE\MOTHERBOARD_BIOS_GA-EP45-DS3_F9.EXE
Ist ein Fehlalarm

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

myspam69 22.06.2012 12:35
Ob das System in Ordnung ist, kann ich noch nicht sagen. Ich würde - wenn für Dich i.O. - wieder Norton Antivirus 2012 neu installieren und beobachten, ob alles stabil läuft (also Definitions-Update-Prozess, Browser etc.).

Was denkst Du?

cosinus 22.06.2012 13:01
Zitat:
wieder Norton Antivirus 2012 neu installieren
Wieso denn Norton AV?`:wtf:
Für einen vernünftigen Virenscanner muss man als Privatperson kein Geld ausgeben!

myspam69 22.06.2012 13:08
Mit welchen habt ihr denn gute Erfahrungen?

cosinus 22.06.2012 13:31
Im Prinzip ist das egal. Nimm sowas wie MSE oder Avast
Meistens poste ich meinen Standardtext noch, wenn mal wieder die Frage nach dem Virenscanner kommt:

Die Frage - welcher Virenscanner oder ob der installierte reicht - taucht ständig auf.
Der Virenscanner - egal welcher - kann und wird niemals 100% Schutz bieten können. Neue/unbekannte Schädlinge können immer durch die Lappen gehen. Geld ausgeben muss man nicht für einen Scanner, sowas wie Avast oder Microsoft Security Essentials sind für die privaten Gebrauch völlig ausreichend.
Abgesehen davon nutzen verschiedene Virenscanner unterschiedliche Signaturen und Techniken, das führt dazu, dass zB Scanner1 Schädling X entdeckt, aber Schädling Y übersieht. Scanner2 erkennt Schädling Y, dafür aber Schädling X nicht...
Wichtiger ist, dass du dich an Regeln hälst. Der beste Virenscanner bringt nichts, wenn du dich falsch verhälst und fahrlässig/unvorsichtig bist. Airbag und Sicherheitsgurt im Auto sind ja auch keine Gründe dafür auf die Verkehrsregeln zu pfeifen.

Halte Dich am besten grob an diese Regeln:
  1. Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
  2. Halte Windows und alle verwendeten Programme immer aktuell - unterstützen kann dich dabei Secunia PSI
  3. Führe regelmäßig Backups auf externe Medien durch
  4. Arbeite mit eingeschränkten Rechten
  5. Nutze sicherere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen
  6. automatische Wiedergabe von allen Laufwerken komplett deaktivieren, denn das ist ein unnötiges Sicherheitsrisiko
  7. Bei der Installation von Software möglichst darauf achten, dass die Setups aus offiziellen Quellen stammen und du bei der Installation nach Möglichkeit die benutzerdefinierte Methode wählst - dann hast du die Möglichkeit etwaigen Schrott (wie Toolbars oder sowas wie RegistryBooster) abzuwählen, welcher sonst einfach mitinstalliert wird.
  8. Bösartige bzw. ungewollte Sites von vornherein blockieren lassen mit Hilfe der MVPS Hosts File => Blocking Unwanted Parasites with a Hosts File
  9. Finger weg von: TuneUp, Registry-Cleanern aller Art, Softonic sowie illegalen Cracks/Keygens oder anderen "Tools" um ein kommerzielles Programm ohne Lizenz nutzen zu können
  10. dubiose Seiten bzw. Kinofilm-Streaming-Portale ebenfalls sein lassen, erstens handelt man sich dort schnell Malware ein oder kann in Abofallen geraten und zweitens bewegen sich diese Seiten in einer rechtlichen Grauzone.


Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?

myspam69 22.06.2012 13:38
Vielen Dank erstmal! Dann werde ich also am Wochenende einen Virenscanner neu installieren und dann melde ich mich nochmal!

Vielen Dank schon jetzt!

cosinus 22.06.2012 13:45
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:38 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19