Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVU Bundespolizei Trojaner (https://www.trojaner-board.de/135248-gvu-bundespolizei-trojaner.html)

hbo1611 20.05.2013 13:57
GVU Bundespolizei Trojaner
 
Hallo, ich habe mir heute Nacht den GVU Bundespolizei Trojaner eingefangen. Der Abgesicherte Modus geht nicht, dort tritt die Bildschirmsperre auch ein. Das System auf einen Zeitpunkt vor der Infizierung zurücksetzen habe ich probiert, geht auch nicht, es tritt trotzdem auf.
Habe von einem Trick in einem Kommentar eines Youtube Videos gelesen, und dieser funktioniert auch. So kann ich jetzt auf mein Notebook wieder voll zugreifen. Beim Starten sieht man kurz den Desktop und zwei Fenster mit Befehlsausführungen poppen auf. Habe dann direkt "strg alt entf" gedrückt und dann auf "abmelden". Mit dem richtigen timing danach schnell auf "abbrechen", bevor er sich wirklich abmeldet. Wenn man den richtigen Zeitpunkt erwischt hat man wieder vollen Zugriff weil sich der Trojaner wohl vorher abmeldet. So hab ich meine Daten extern gesichert und die Schritte aus der Checkliste ausgeführt. Erstaunlich ist, dass nach einer gewissen Zeit der Benutzung der Mauszeiger springt und sich Browser und manchmal auch was anderes öffnen. Das ist wohl ein Zeichen der Hintergrundaktivität des Trojaners.
Beim Starten wenn man den Desktop kurz sieht kam auch "einige Male, nicht jedes Mal" eine Fehlermeldung von OpenOffice (hab den genauen Wortlaut vergessen), vielleicht ist das ein Zeichen, dass sich dort der Trojaner verkrochen hat?
Ich hoffe mir kann jemand helfen, brauch das Notebook schnell wieder regulär für meine Bachelorarbeit :/
Vielen Dank schon einmal im Voraus.

markusg 20.05.2013 13:58
sehe es mir an

markusg 20.05.2013 14:02
Hi,
solche komischen youtubetipps oder "Nutze die Systemwiederherstellung" sollte man gleich vergessen und niemehr nutzen
1. bekämpfst du damit vllt das Symtom, weitere Malware kann aber noch aktiv sein.
2. kannst du damit der Funktionsweise anderer Programme schaden, zb avira, bei denen es dann ein Problem geben kann, da es dann nicht mehr läuft.


otl fix

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:
:OTL
O4 - HKCU..\Run: [winlogon] C:\Users\***\AppData\Roaming\winlogon\CCleanerstartup.bat ()
O4 - HKCU..\Run: [pejo] C:\Users\***\AppData\Roaming\pejo\vifier.bat ()
O4 - HKCU..\Run: [Internal Configuration Serving State] C:\Users\***\AppData\Roaming\udabja.exe (Nero AG)
O20 - HKCU Winlogon: Shell - (C:\Users\***\AppData\Roaming\skype.dat) - C:\Users\***\AppData\Roaming\skype.dat ()
:files
C:\Users\***\AppData\Roaming\winlogon
C:\Users\***\AppData\Roaming\pejo
:Commands
[emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

hbo1611 20.05.2013 15:05
Code:
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\winlogon deleted successfully.
C:\Users\***\AppData\Roaming\winlogon\CCleanerstartup.bat moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\pejo deleted successfully.
C:\Users\***\AppData\Roaming\pejo\vifier.bat moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Internal Configuration Serving State deleted successfully.
C:\Users\***\AppData\Roaming\udabja.exe moved successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\***\AppData\Roaming\skype.dat deleted successfully.
C:\Users\***\AppData\Roaming\skype.dat moved successfully.
========== FILES ==========
C:\Users\***\AppData\Roaming\winlogon folder moved successfully.
C:\Users\***\AppData\Roaming\pejo folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: ***
->Temp folder emptied: 576078121 bytes
->Temporary Internet Files folder emptied: 1070035031 bytes
->Java cache emptied: 1023136 bytes
->FireFox cache emptied: 76555312 bytes
->Google Chrome cache emptied: 347910064 bytes
->Flash cache emptied: 274008 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 480432354 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36028471 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 2.468,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 05202013_153744

Files\Folders moved on Reboot...
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Soweit hat alles funktioniert. Der Upload war auch erfolgreich.
Nach dem Neustart kam nicht mehr der weiße Bildschirm, jedoch wieder diese seltsame Nachricht von OpenOffice: Eine andere Instanz von OpenOffice.org greift auf ihre persönlichen Einstellungen zu oder hat diese nicht wieder freigegeben.
Der gleichzeitige Zugriff kann zu Inkonsistenzen in ihren persönlichen Einstellungen führen. Bevor sie fortfahren sollten sie sicher stellen, dass OpenOffice.org auf dem Host "vom Benutzer" beendet wird. Möchten sie wirklich fortfahren? (JA) (NEIN)

Ansonsten bin ich total begeistert von der schnellen Unterstützung, vielen vielen Dank.

markusg 20.05.2013 15:16
Hi
du hast dir zusätzlich noch n Backdoor geholt, also später, passwörter ändrn
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

hbo1611 20.05.2013 15:32
Code:
16:23:07.0103 1980  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
16:23:07.0342 1980  ============================================================
16:23:07.0342 1980  Current date / time: 2013/05/20 16:23:07.0342
16:23:07.0342 1980  SystemInfo:
16:23:07.0342 1980 
16:23:07.0342 1980  OS Version: 6.1.7601 ServicePack: 1.0
16:23:07.0342 1980  Product type: Workstation
16:23:07.0342 1980  ComputerName: ***-PC
16:23:07.0343 1980  UserName: ***
16:23:07.0343 1980  Windows directory: C:\Windows
16:23:07.0343 1980  System windows directory: C:\Windows
16:23:07.0343 1980  Running under WOW64
16:23:07.0343 1980  Processor architecture: Intel x64
16:23:07.0343 1980  Number of processors: 2
16:23:07.0343 1980  Page size: 0x1000
16:23:07.0343 1980  Boot type: Normal boot
16:23:07.0343 1980  ============================================================
16:23:08.0697 1980  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:23:08.0706 1980  ============================================================
16:23:08.0706 1980  \Device\Harddisk0\DR0:
16:23:08.0706 1980  MBR partitions:
16:23:08.0706 1980  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x139C5, BlocksNum 0x1D4C000
16:23:08.0706 1980  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D5F9C5, BlocksNum 0x236CE8EB
16:23:08.0706 1980  ============================================================
16:23:08.0734 1980  C: <-> \Device\Harddisk0\DR0\Partition2
16:23:08.0734 1980  ============================================================
16:23:08.0734 1980  Initialize success
16:23:08.0734 1980  ============================================================
16:23:16.0567 2096  ============================================================
16:23:16.0567 2096  Scan started
16:23:16.0567 2096  Mode: Manual; SigCheck; TDLFS;
16:23:16.0567 2096  ============================================================
16:23:18.0104 2096  ================ Scan system memory ========================
16:23:18.0104 2096  System memory - ok
16:23:18.0105 2096  ================ Scan services =============================
16:23:18.0570 2096  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
16:23:18.0715 2096  1394ohci - ok
16:23:18.0784 2096  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
16:23:18.0810 2096  ACPI - ok
16:23:18.0856 2096  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
16:23:18.0928 2096  AcpiPmi - ok
16:23:19.0082 2096  [ 3927397AC60D943DAF8808AFFED582B7 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:23:19.0112 2096  AdobeARMservice - ok
16:23:19.0191 2096  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
16:23:19.0242 2096  adp94xx - ok
16:23:19.0276 2096  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
16:23:19.0302 2096  adpahci - ok
16:23:19.0322 2096  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
16:23:19.0344 2096  adpu320 - ok
16:23:19.0383 2096  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
16:23:19.0443 2096  AeLookupSvc - ok
16:23:19.0524 2096  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
16:23:19.0611 2096  AFD - ok
16:23:19.0672 2096  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
16:23:19.0691 2096  agp440 - ok
16:23:19.0719 2096  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
16:23:19.0773 2096  ALG - ok
16:23:19.0802 2096  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
16:23:19.0822 2096  aliide - ok
16:23:19.0893 2096  [ D696F317BD465A602566F8E1DCCE15F7 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
16:23:19.0958 2096  AMD External Events Utility - ok
16:23:19.0984 2096  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
16:23:20.0002 2096  amdide - ok
16:23:20.0051 2096  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
16:23:20.0107 2096  AmdK8 - ok
16:23:20.0134 2096  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
16:23:20.0177 2096  AmdPPM - ok
16:23:20.0243 2096  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
16:23:20.0285 2096  amdsata - ok
16:23:20.0335 2096  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
16:23:20.0357 2096  amdsbs - ok
16:23:20.0378 2096  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
16:23:20.0396 2096  amdxata - ok
16:23:20.0509 2096  [ D6C8942BEA3698A2E7559BD423BFA5D7 ] AntiVirScheduler C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\sched.exe
16:23:20.0533 2096  AntiVirScheduler ( UnsignedFile.Multi.Generic ) - warning
16:23:20.0534 2096  AntiVirScheduler - detected UnsignedFile.Multi.Generic (1)
16:23:20.0584 2096  [ 335A142923FE7F97E8C8388ACD067568 ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avguard.exe
16:23:20.0622 2096  AntiVirService ( UnsignedFile.Multi.Generic ) - warning
16:23:20.0622 2096  AntiVirService - detected UnsignedFile.Multi.Generic (1)
16:23:20.0701 2096  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
16:23:20.0802 2096  AppID - ok
16:23:20.0860 2096  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
16:23:20.0956 2096  AppIDSvc - ok
16:23:21.0018 2096  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo        C:\Windows\System32\appinfo.dll
16:23:21.0071 2096  Appinfo - ok
16:23:21.0102 2096  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\DRIVERS\arc.sys
16:23:21.0122 2096  arc - ok
16:23:21.0141 2096  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
16:23:21.0161 2096  arcsas - ok
16:23:21.0224 2096  [ 0BAEFD3F648C6E7AB52990DD9565E4E2 ] aswFsBlk        C:\Windows\system32\drivers\aswFsBlk.sys
16:23:21.0258 2096  aswFsBlk - ok
16:23:21.0329 2096  [ FA562F34ED6633C66170B09182B4C049 ] aswMonFlt      C:\Windows\system32\drivers\aswMonFlt.sys
16:23:21.0347 2096  aswMonFlt - ok
16:23:21.0381 2096  [ 64E2BAB4096C13D2342BC4661C967E07 ] aswRdr          C:\Windows\System32\Drivers\aswrdr2.sys
16:23:21.0399 2096  aswRdr - ok
16:23:21.0432 2096  [ 5573AA70993A2BB81525B1C704B88763 ] aswRvrt        C:\Windows\system32\drivers\aswRvrt.sys
16:23:21.0449 2096  aswRvrt - ok
16:23:21.0504 2096  [ 10ED1CAB84AA65983C41A11F60294C9B ] aswSnx          C:\Windows\system32\drivers\aswSnx.sys
16:23:21.0541 2096  aswSnx - ok
16:23:21.0571 2096  [ 00E5253353717D3CA12A0F5A6F9991EC ] aswSP          C:\Windows\system32\drivers\aswSP.sys
16:23:21.0594 2096  aswSP - ok
16:23:21.0616 2096  [ 29DD8E458A84171202AA4979364C30C0 ] aswTdi          C:\Windows\system32\drivers\aswTdi.sys
16:23:21.0633 2096  aswTdi - ok
16:23:21.0655 2096  [ 6359B99C955DB9F40B653159A0EED261 ] aswVmm          C:\Windows\system32\drivers\aswVmm.sys
16:23:21.0676 2096  aswVmm - ok
16:23:21.0695 2096  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
16:23:21.0796 2096  AsyncMac - ok
16:23:21.0827 2096  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
16:23:21.0847 2096  atapi - ok
16:23:22.0058 2096  [ 52BD95CAA9CAE8977FE043E9AD6D2D0E ] atikmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
16:23:22.0297 2096  atikmdag - ok
16:23:22.0397 2096  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
16:23:22.0516 2096  AudioEndpointBuilder - ok
16:23:22.0528 2096  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
16:23:22.0582 2096  AudioSrv - ok
16:23:22.0714 2096  [ 28D6701C710AD7BA3CB95E75F8F1A9AA ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
16:23:22.0741 2096  avast! Antivirus - ok
16:23:22.0795 2096  [ 025A17FC8E80D3905D109E3E9900E53C ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
16:23:22.0811 2096  avgntflt - ok
16:23:22.0865 2096  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
16:23:22.0933 2096  AxInstSV - ok
16:23:23.0010 2096  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
16:23:23.0073 2096  b06bdrv - ok
16:23:23.0162 2096  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
16:23:23.0224 2096  b57nd60a - ok
16:23:23.0316 2096  [ 9E84A931DBEE0292E38ED672F6293A99 ] BCM43XX        C:\Windows\system32\DRIVERS\bcmwl664.sys
16:23:23.0416 2096  BCM43XX - ok
16:23:23.0484 2096  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
16:23:23.0541 2096  BDESVC - ok
16:23:23.0580 2096  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
16:23:23.0678 2096  Beep - ok
16:23:23.0782 2096  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
16:23:23.0862 2096  BFE - ok
16:23:23.0894 2096  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
16:23:23.0992 2096  BITS - ok
16:23:24.0032 2096  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
16:23:24.0077 2096  blbdrive - ok
16:23:24.0154 2096  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
16:23:24.0188 2096  bowser - ok
16:23:24.0216 2096  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:23:24.0266 2096  BrFiltLo - ok
16:23:24.0300 2096  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:23:24.0324 2096  BrFiltUp - ok
16:23:24.0366 2096  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
16:23:24.0390 2096  Browser - ok
16:23:24.0411 2096  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
16:23:24.0476 2096  Brserid - ok
16:23:24.0504 2096  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
16:23:24.0548 2096  BrSerWdm - ok
16:23:24.0566 2096  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
16:23:24.0641 2096  BrUsbMdm - ok
16:23:24.0659 2096  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
16:23:24.0682 2096  BrUsbSer - ok
16:23:24.0726 2096  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
16:23:24.0765 2096  BTHMODEM - ok
16:23:24.0850 2096  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
16:23:24.0939 2096  BTHPORT - ok
16:23:25.0008 2096  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
16:23:25.0098 2096  bthserv - ok
16:23:25.0119 2096  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
16:23:25.0154 2096  BTHUSB - ok
16:23:25.0188 2096  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
16:23:25.0248 2096  cdfs - ok
16:23:25.0318 2096  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\drivers\cdrom.sys
16:23:25.0357 2096  cdrom - ok
16:23:25.0417 2096  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
16:23:25.0494 2096  CertPropSvc - ok
16:23:25.0570 2096  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
16:23:25.0624 2096  circlass - ok
16:23:25.0674 2096  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
16:23:25.0700 2096  CLFS - ok
16:23:25.0809 2096  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:23:25.0838 2096  clr_optimization_v2.0.50727_32 - ok
16:23:25.0935 2096  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:23:25.0961 2096  clr_optimization_v2.0.50727_64 - ok
16:23:26.0083 2096  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:23:26.0111 2096  clr_optimization_v4.0.30319_32 - ok
16:23:26.0145 2096  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:23:26.0163 2096  clr_optimization_v4.0.30319_64 - ok
16:23:26.0218 2096  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
16:23:26.0263 2096  CmBatt - ok
16:23:26.0326 2096  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
16:23:26.0353 2096  cmdide - ok
16:23:26.0406 2096  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
16:23:26.0460 2096  CNG - ok
16:23:26.0484 2096  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
16:23:26.0502 2096  Compbatt - ok
16:23:26.0568 2096  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
16:23:26.0618 2096  CompositeBus - ok
16:23:26.0641 2096  COMSysApp - ok
16:23:26.0668 2096  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
16:23:26.0686 2096  crcdisk - ok
16:23:26.0756 2096  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
16:23:26.0802 2096  CryptSvc - ok
16:23:26.0859 2096  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
16:23:26.0968 2096  DcomLaunch - ok
16:23:27.0063 2096  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
16:23:27.0155 2096  defragsvc - ok
16:23:27.0191 2096  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
16:23:27.0256 2096  DfsC - ok
16:23:27.0331 2096  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
16:23:27.0372 2096  Dhcp - ok
16:23:27.0406 2096  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
16:23:27.0453 2096  discache - ok
16:23:27.0480 2096  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
16:23:27.0499 2096  Disk - ok
16:23:27.0546 2096  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
16:23:27.0602 2096  Dnscache - ok
16:23:27.0658 2096  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
16:23:27.0723 2096  dot3svc - ok
16:23:27.0738 2096  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
16:23:27.0804 2096  DPS - ok
16:23:27.0869 2096  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
16:23:27.0906 2096  drmkaud - ok
16:23:27.0967 2096  [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
16:23:28.0000 2096  DXGKrnl - ok
16:23:28.0066 2096  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
16:23:28.0159 2096  EapHost - ok
16:23:28.0271 2096  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
16:23:28.0456 2096  ebdrv - ok
16:23:28.0545 2096  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
16:23:28.0626 2096  EFS - ok
16:23:28.0756 2096  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
16:23:28.0836 2096  ehRecvr - ok
16:23:28.0882 2096  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
16:23:28.0919 2096  ehSched - ok
16:23:28.0974 2096  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
16:23:29.0023 2096  elxstor - ok
16:23:29.0069 2096  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
16:23:29.0113 2096  ErrDev - ok
16:23:29.0190 2096  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
16:23:29.0245 2096  EventSystem - ok
16:23:29.0267 2096  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
16:23:29.0338 2096  exfat - ok
16:23:29.0372 2096  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
16:23:29.0455 2096  fastfat - ok
16:23:29.0544 2096  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
16:23:29.0632 2096  Fax - ok
16:23:29.0656 2096  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
16:23:29.0697 2096  fdc - ok
16:23:29.0729 2096  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
16:23:29.0777 2096  fdPHost - ok
16:23:29.0793 2096  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
16:23:29.0860 2096  FDResPub - ok
16:23:29.0886 2096  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
16:23:29.0906 2096  FileInfo - ok
16:23:29.0919 2096  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
16:23:29.0987 2096  Filetrace - ok
16:23:30.0013 2096  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
16:23:30.0057 2096  flpydisk - ok
16:23:30.0123 2096  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
16:23:30.0147 2096  FltMgr - ok
16:23:30.0214 2096  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
16:23:30.0308 2096  FontCache - ok
16:23:30.0377 2096  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:23:30.0400 2096  FontCache3.0.0.0 - ok
16:23:30.0420 2096  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
16:23:30.0447 2096  FsDepends - ok
16:23:30.0527 2096  [ 8197C85348A33BCCFE80DD6E2DB53903 ] FSProFilter    C:\Windows\system32\Drivers\FSPFltd.sys
16:23:30.0553 2096  FSProFilter - ok
16:23:30.0601 2096  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
16:23:30.0632 2096  Fs_Rec - ok
16:23:30.0696 2096  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
16:23:30.0733 2096  fvevol - ok
16:23:30.0751 2096  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
16:23:30.0770 2096  gagp30kx - ok
16:23:30.0834 2096  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
16:23:30.0955 2096  gpsvc - ok
16:23:31.0071 2096  [ C1B577B2169900F4CF7190C39F085794 ] gusvc          C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
16:23:31.0102 2096  gusvc - ok
16:23:31.0128 2096  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
16:23:31.0171 2096  hcw85cir - ok
16:23:31.0252 2096  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
16:23:31.0324 2096  HdAudAddService - ok
16:23:31.0361 2096  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
16:23:31.0420 2096  HDAudBus - ok
16:23:31.0443 2096  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
16:23:31.0488 2096  HidBatt - ok
16:23:31.0516 2096  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
16:23:31.0556 2096  HidBth - ok
16:23:31.0583 2096  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
16:23:31.0630 2096  HidIr - ok
16:23:31.0675 2096  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
16:23:31.0747 2096  hidserv - ok
16:23:31.0808 2096  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
16:23:31.0830 2096  HidUsb - ok
16:23:31.0883 2096  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
16:23:31.0949 2096  hkmsvc - ok
16:23:32.0004 2096  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
16:23:32.0073 2096  HomeGroupListener - ok
16:23:32.0117 2096  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
16:23:32.0171 2096  HomeGroupProvider - ok
16:23:32.0194 2096  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
16:23:32.0214 2096  HpSAMD - ok
16:23:32.0299 2096  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
16:23:32.0412 2096  HTTP - ok
16:23:32.0476 2096  [ CDAA8E257BB625B2387219E605DDE37D ] hwdatacard      C:\Windows\system32\DRIVERS\ewusbmdm.sys
16:23:32.0512 2096  hwdatacard - ok
16:23:32.0551 2096  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
16:23:32.0577 2096  hwpolicy - ok
16:23:32.0630 2096  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
16:23:32.0654 2096  i8042prt - ok
16:23:32.0696 2096  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
16:23:32.0723 2096  iaStorV - ok
16:23:32.0805 2096  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:23:32.0867 2096  idsvc - ok
16:23:32.0905 2096  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
16:23:32.0924 2096  iirsp - ok
16:23:33.0082 2096  [ 755519F49906B73C1FE9CBBF75E347EA ] IJPLMSVC        C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
16:23:33.0107 2096  IJPLMSVC - ok
16:23:33.0171 2096  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
16:23:33.0273 2096  IKEEXT - ok
16:23:33.0296 2096  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
16:23:33.0314 2096  intelide - ok
16:23:33.0349 2096  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
16:23:33.0388 2096  intelppm - ok
16:23:33.0435 2096  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
16:23:33.0517 2096  IPBusEnum - ok
16:23:33.0560 2096  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:23:33.0621 2096  IpFilterDriver - ok
16:23:33.0670 2096  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
16:23:33.0712 2096  iphlpsvc - ok
16:23:33.0752 2096  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
16:23:33.0801 2096  IPMIDRV - ok
16:23:33.0830 2096  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
16:23:33.0894 2096  IPNAT - ok
16:23:33.0928 2096  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
16:23:33.0974 2096  IRENUM - ok
16:23:34.0016 2096  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
16:23:34.0035 2096  isapnp - ok
16:23:34.0087 2096  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
16:23:34.0122 2096  iScsiPrt - ok
16:23:34.0157 2096  [ 7DBAFE10C1B777305C80BEA42FBDA710 ] k57nd60a        C:\Windows\system32\DRIVERS\k57nd60a.sys
16:23:34.0184 2096  k57nd60a - ok
16:23:34.0199 2096  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
16:23:34.0217 2096  kbdclass - ok
16:23:34.0234 2096  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
16:23:34.0259 2096  kbdhid - ok
16:23:34.0304 2096  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
16:23:34.0344 2096  KeyIso - ok
16:23:34.0395 2096  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
16:23:34.0422 2096  KSecDD - ok
16:23:34.0476 2096  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
16:23:34.0508 2096  KSecPkg - ok
16:23:34.0552 2096  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
16:23:34.0621 2096  ksthunk - ok
16:23:34.0670 2096  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
16:23:34.0741 2096  KtmRm - ok
16:23:34.0782 2096  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
16:23:34.0870 2096  LanmanServer - ok
16:23:34.0916 2096  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
16:23:34.0988 2096  LanmanWorkstation - ok
16:23:35.0029 2096  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
16:23:35.0096 2096  lltdio - ok
16:23:35.0143 2096  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
16:23:35.0222 2096  lltdsvc - ok
16:23:35.0246 2096  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
16:23:35.0296 2096  lmhosts - ok
16:23:35.0349 2096  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
16:23:35.0380 2096  LSI_FC - ok
16:23:35.0400 2096  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
16:23:35.0420 2096  LSI_SAS - ok
16:23:35.0442 2096  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:23:35.0461 2096  LSI_SAS2 - ok
16:23:35.0489 2096  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:23:35.0509 2096  LSI_SCSI - ok
16:23:35.0544 2096  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
16:23:35.0605 2096  luafv - ok
16:23:35.0641 2096  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
16:23:35.0683 2096  Mcx2Svc - ok
16:23:35.0707 2096  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
16:23:35.0726 2096  megasas - ok
16:23:35.0749 2096  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
16:23:35.0773 2096  MegaSR - ok
16:23:35.0840 2096  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
16:23:35.0935 2096  MMCSS - ok
16:23:35.0960 2096  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
16:23:36.0006 2096  Modem - ok
16:23:36.0028 2096  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
16:23:36.0069 2096  monitor - ok
16:23:36.0100 2096  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
16:23:36.0118 2096  mouclass - ok
16:23:36.0129 2096  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
16:23:36.0171 2096  mouhid - ok
16:23:36.0216 2096  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
16:23:36.0248 2096  mountmgr - ok
16:23:36.0337 2096  [ 7EDBBB9351A38C6BB0FE98CFD44DB430 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
16:23:36.0367 2096  MozillaMaintenance - ok
16:23:36.0393 2096  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
16:23:36.0415 2096  mpio - ok
16:23:36.0433 2096  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
16:23:36.0505 2096  mpsdrv - ok
16:23:36.0566 2096  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
16:23:36.0686 2096  MpsSvc - ok
16:23:36.0717 2096  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
16:23:36.0759 2096  MRxDAV - ok
16:23:36.0806 2096  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
16:23:36.0844 2096  mrxsmb - ok
16:23:36.0896 2096  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:23:36.0922 2096  mrxsmb10 - ok
16:23:36.0973 2096  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:23:37.0032 2096  mrxsmb20 - ok
16:23:37.0073 2096  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
16:23:37.0103 2096  msahci - ok
16:23:37.0150 2096  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
16:23:37.0181 2096  msdsm - ok
16:23:37.0199 2096  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
16:23:37.0253 2096  MSDTC - ok
16:23:37.0303 2096  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
16:23:37.0357 2096  Msfs - ok
16:23:37.0367 2096  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
16:23:37.0431 2096  mshidkmdf - ok
16:23:37.0478 2096  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
16:23:37.0507 2096  msisadrv - ok
16:23:37.0573 2096  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
16:23:37.0676 2096  MSiSCSI - ok
16:23:37.0682 2096  msiserver - ok
16:23:37.0726 2096  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
16:23:37.0789 2096  MSKSSRV - ok
16:23:37.0823 2096  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
16:23:37.0883 2096  MSPCLOCK - ok
16:23:37.0910 2096  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
16:23:37.0980 2096  MSPQM - ok
16:23:38.0032 2096  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
16:23:38.0072 2096  MsRPC - ok
16:23:38.0124 2096  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
16:23:38.0143 2096  mssmbios - ok
16:23:38.0160 2096  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
16:23:38.0228 2096  MSTEE - ok
16:23:38.0252 2096  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
16:23:38.0274 2096  MTConfig - ok
16:23:38.0309 2096  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
16:23:38.0328 2096  Mup - ok
16:23:38.0384 2096  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
16:23:38.0506 2096  napagent - ok
16:23:38.0583 2096  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
16:23:38.0648 2096  NativeWifiP - ok
16:23:38.0740 2096  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
16:23:38.0808 2096  NDIS - ok
16:23:38.0833 2096  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
16:23:38.0879 2096  NdisCap - ok
16:23:38.0902 2096  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
16:23:38.0949 2096  NdisTapi - ok
16:23:39.0005 2096  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
16:23:39.0088 2096  Ndisuio - ok
16:23:39.0131 2096  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
16:23:39.0209 2096  NdisWan - ok
16:23:39.0245 2096  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
16:23:39.0324 2096  NDProxy - ok
16:23:39.0351 2096  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
16:23:39.0413 2096  NetBIOS - ok
16:23:39.0463 2096  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
16:23:39.0520 2096  NetBT - ok
16:23:39.0530 2096  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
16:23:39.0554 2096  Netlogon - ok
16:23:39.0619 2096  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
16:23:39.0720 2096  Netman - ok
16:23:39.0758 2096  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
16:23:39.0861 2096  netprofm - ok
16:23:39.0898 2096  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:23:39.0919 2096  NetTcpPortSharing - ok
16:23:39.0953 2096  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
16:23:39.0972 2096  nfrd960 - ok
16:23:40.0023 2096  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
16:23:40.0104 2096  NlaSvc - ok
16:23:40.0128 2096  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
16:23:40.0175 2096  Npfs - ok
16:23:40.0219 2096  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
16:23:40.0287 2096  nsi - ok
16:23:40.0314 2096  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
16:23:40.0384 2096  nsiproxy - ok
16:23:40.0471 2096  [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
16:23:40.0557 2096  Ntfs - ok
16:23:40.0576 2096  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
16:23:40.0621 2096  Null - ok
16:23:40.0675 2096  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
16:23:40.0696 2096  nvraid - ok
16:23:40.0716 2096  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
16:23:40.0738 2096  nvstor - ok
16:23:40.0778 2096  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
16:23:40.0799 2096  nv_agp - ok
16:23:40.0848 2096  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
16:23:40.0901 2096  ohci1394 - ok
16:23:40.0985 2096  [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:23:41.0012 2096  ose - ok
16:23:41.0090 2096  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
16:23:41.0163 2096  p2pimsvc - ok
16:23:41.0213 2096  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
16:23:41.0258 2096  p2psvc - ok
16:23:41.0307 2096  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
16:23:41.0330 2096  Parport - ok
16:23:41.0376 2096  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
16:23:41.0407 2096  partmgr - ok
16:23:41.0427 2096  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
16:23:41.0490 2096  PcaSvc - ok
16:23:41.0536 2096  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
16:23:41.0565 2096  pci - ok
16:23:41.0581 2096  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
16:23:41.0599 2096  pciide - ok
16:23:41.0628 2096  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
16:23:41.0653 2096  pcmcia - ok
16:23:41.0678 2096  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
16:23:41.0696 2096  pcw - ok
16:23:41.0729 2096  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
16:23:41.0811 2096  PEAUTH - ok
16:23:41.0919 2096  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
16:23:41.0974 2096  PerfHost - ok
16:23:42.0061 2096  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
16:23:42.0193 2096  pla - ok
16:23:42.0271 2096  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
16:23:42.0334 2096  PlugPlay - ok
16:23:42.0368 2096  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
16:23:42.0414 2096  PNRPAutoReg - ok
16:23:42.0445 2096  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
16:23:42.0475 2096  PNRPsvc - ok
16:23:42.0531 2096  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
16:23:42.0629 2096  PolicyAgent - ok
16:23:42.0680 2096  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
16:23:42.0770 2096  Power - ok
16:23:42.0847 2096  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
16:23:42.0905 2096  PptpMiniport - ok
16:23:42.0924 2096  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\DRIVERS\processr.sys
16:23:42.0968 2096  Processor - ok
16:23:43.0032 2096  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
16:23:43.0098 2096  ProfSvc - ok
16:23:43.0121 2096  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
16:23:43.0145 2096  ProtectedStorage - ok
16:23:43.0198 2096  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
16:23:43.0243 2096  Psched - ok
16:23:43.0335 2096  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
16:23:43.0427 2096  ql2300 - ok
16:23:43.0449 2096  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
16:23:43.0469 2096  ql40xx - ok
16:23:43.0536 2096  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
16:23:43.0587 2096  QWAVE - ok
16:23:43.0601 2096  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
16:23:43.0653 2096  QWAVEdrv - ok
16:23:43.0673 2096  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
16:23:43.0742 2096  RasAcd - ok
16:23:43.0803 2096  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
16:23:43.0849 2096  RasAgileVpn - ok
16:23:43.0869 2096  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
16:23:43.0946 2096  RasAuto - ok
16:23:43.0981 2096  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
16:23:44.0065 2096  Rasl2tp - ok
16:23:44.0146 2096  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
16:23:44.0268 2096  RasMan - ok
16:23:44.0309 2096  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
16:23:44.0375 2096  RasPppoe - ok
16:23:44.0413 2096  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
16:23:44.0482 2096  RasSstp - ok
16:23:44.0526 2096  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
16:23:44.0607 2096  rdbss - ok
16:23:44.0626 2096  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
16:23:44.0664 2096  rdpbus - ok
16:23:44.0687 2096  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
16:23:44.0747 2096  RDPCDD - ok
16:23:44.0783 2096  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
16:23:44.0853 2096  RDPENCDD - ok
16:23:44.0884 2096  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
16:23:44.0930 2096  RDPREFMP - ok
16:23:44.0979 2096  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
16:23:45.0038 2096  RDPWD - ok
16:23:45.0112 2096  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
16:23:45.0148 2096  rdyboost - ok
16:23:45.0198 2096  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
16:23:45.0265 2096  RemoteAccess - ok
16:23:45.0311 2096  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
16:23:45.0407 2096  RemoteRegistry - ok
16:23:45.0466 2096  [ 9C23519FC1FD331AAAEDC145AB947293 ] rimmptsk        C:\Windows\system32\DRIVERS\rimmpx64.sys
16:23:45.0517 2096  rimmptsk - ok
16:23:45.0575 2096  [ 67F50C31713106FD1B0F286F86AA2B2E ] rimsptsk        C:\Windows\system32\DRIVERS\rimspx64.sys
16:23:45.0628 2096  rimsptsk - ok
16:23:45.0653 2096  [ 2A43F9E6DBDE12BC0C104785C3B3F5DF ] rismxdp        C:\Windows\system32\DRIVERS\rixdpx64.sys
16:23:45.0674 2096  rismxdp - ok
16:23:45.0701 2096  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
16:23:45.0755 2096  RpcEptMapper - ok
16:23:45.0801 2096  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
16:23:45.0850 2096  RpcLocator - ok
16:23:45.0881 2096  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
16:23:45.0937 2096  RpcSs - ok
16:23:46.0004 2096  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
16:23:46.0098 2096  rspndr - ok
16:23:46.0123 2096  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
16:23:46.0148 2096  SamSs - ok
16:23:46.0190 2096  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
16:23:46.0210 2096  sbp2port - ok
16:23:46.0254 2096  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
16:23:46.0309 2096  SCardSvr - ok
16:23:46.0374 2096  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
16:23:46.0457 2096  scfilter - ok
16:23:46.0520 2096  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
16:23:46.0641 2096  Schedule - ok
16:23:46.0686 2096  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
16:23:46.0730 2096  SCPolicySvc - ok
16:23:46.0782 2096  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus          C:\Windows\system32\drivers\sdbus.sys
16:23:46.0846 2096  sdbus - ok
16:23:46.0890 2096  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
16:23:46.0964 2096  SDRSVC - ok
16:23:47.0027 2096  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
16:23:47.0117 2096  secdrv - ok
16:23:47.0159 2096  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
16:23:47.0236 2096  seclogon - ok
16:23:47.0274 2096  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
16:23:47.0388 2096  SENS - ok
16:23:47.0428 2096  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
16:23:47.0457 2096  SensrSvc - ok
16:23:47.0482 2096  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
16:23:47.0504 2096  Serenum - ok
16:23:47.0529 2096  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
16:23:47.0568 2096  Serial - ok
16:23:47.0606 2096  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
16:23:47.0627 2096  sermouse - ok
16:23:47.0682 2096  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
16:23:47.0750 2096  SessionEnv - ok
16:23:47.0787 2096  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
16:23:47.0832 2096  sffdisk - ok
16:23:47.0851 2096  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
16:23:47.0892 2096  sffp_mmc - ok
16:23:47.0940 2096  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
16:23:47.0966 2096  sffp_sd - ok
16:23:47.0986 2096  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
16:23:48.0028 2096  sfloppy - ok
16:23:48.0089 2096  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
16:23:48.0167 2096  SharedAccess - ok
16:23:48.0222 2096  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
16:23:48.0329 2096  ShellHWDetection - ok
16:23:48.0359 2096  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:23:48.0378 2096  SiSRaid2 - ok
16:23:48.0393 2096  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
16:23:48.0413 2096  SiSRaid4 - ok
16:23:48.0523 2096  [ 7C15061CD0372487903B07B9BB03AFAD ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
16:23:48.0552 2096  SkypeUpdate - ok
16:23:48.0578 2096  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
16:23:48.0661 2096  Smb - ok
16:23:48.0724 2096  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
16:23:48.0790 2096  SNMPTRAP - ok
16:23:48.0813 2096  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
16:23:48.0832 2096  spldr - ok
16:23:48.0889 2096  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
16:23:48.0962 2096  Spooler - ok
16:23:49.0084 2096  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
16:23:49.0273 2096  sppsvc - ok
16:23:49.0299 2096  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
16:23:49.0372 2096  sppuinotify - ok
16:23:49.0425 2096  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
16:23:49.0476 2096  srv - ok
16:23:49.0495 2096  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
16:23:49.0556 2096  srv2 - ok
16:23:49.0587 2096  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
16:23:49.0630 2096  srvnet - ok
16:23:49.0697 2096  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
16:23:49.0797 2096  SSDPSRV - ok
16:23:49.0819 2096  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
16:23:49.0873 2096  SstpSvc - ok
16:23:49.0924 2096  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
16:23:49.0944 2096  stexstor - ok
16:23:49.0984 2096  [ DECACB6921DED1A38642642685D77DAC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
16:23:50.0043 2096  StillCam - ok
16:23:50.0118 2096  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
16:23:50.0198 2096  stisvc - ok
16:23:50.0237 2096  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
16:23:50.0255 2096  swenum - ok
16:23:50.0285 2096  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
16:23:50.0372 2096  swprv - ok
16:23:50.0446 2096  [ 8F63178D1DB81BB79270AE55ECDD8321 ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
16:23:50.0474 2096  SynTP - ok
16:23:50.0561 2096  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
16:23:50.0693 2096  SysMain - ok
16:23:50.0733 2096  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
16:23:50.0805 2096  TabletInputService - ok
16:23:50.0850 2096  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
16:23:50.0964 2096  TapiSrv - ok
16:23:51.0008 2096  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
16:23:51.0089 2096  TBS - ok
16:23:51.0177 2096  [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
16:23:51.0276 2096  Tcpip - ok
16:23:51.0329 2096  [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
16:23:51.0376 2096  TCPIP6 - ok
16:23:51.0428 2096  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
16:23:51.0487 2096  tcpipreg - ok
16:23:51.0536 2096  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
16:23:51.0572 2096  TDPIPE - ok
16:23:51.0599 2096  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
16:23:51.0640 2096  TDTCP - ok
16:23:51.0701 2096  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
16:23:51.0780 2096  tdx - ok
16:23:51.0810 2096  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
16:23:51.0828 2096  TermDD - ok
16:23:51.0893 2096  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
16:23:51.0995 2096  TermService - ok
16:23:52.0033 2096  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
16:23:52.0083 2096  Themes - ok
16:23:52.0106 2096  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
16:23:52.0157 2096  THREADORDER - ok
16:23:52.0170 2096  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
16:23:52.0250 2096  TrkWks - ok
16:23:52.0352 2096  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
16:23:52.0436 2096  TrustedInstaller - ok
16:23:52.0456 2096  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
16:23:52.0501 2096  tssecsrv - ok
16:23:52.0583 2096  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
16:23:52.0633 2096  TsUsbFlt - ok
16:23:52.0702 2096  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
16:23:52.0787 2096  tunnel - ok
16:23:52.0827 2096  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
16:23:52.0846 2096  uagp35 - ok
16:23:52.0892 2096  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
16:23:52.0962 2096  udfs - ok
16:23:53.0011 2096  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
16:23:53.0054 2096  UI0Detect - ok
16:23:53.0083 2096  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
16:23:53.0104 2096  uliagpkx - ok
16:23:53.0129 2096  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\drivers\umbus.sys
16:23:53.0167 2096  umbus - ok
16:23:53.0189 2096  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
16:23:53.0234 2096  UmPass - ok
16:23:53.0262 2096  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
16:23:53.0351 2096  upnphost - ok
16:23:53.0393 2096  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
16:23:53.0433 2096  usbccgp - ok
16:23:53.0497 2096  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
16:23:53.0534 2096  usbcir - ok
16:23:53.0568 2096  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
16:23:53.0611 2096  usbehci - ok
16:23:53.0652 2096  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
16:23:53.0699 2096  usbhub - ok
16:23:53.0723 2096  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
16:23:53.0766 2096  usbohci - ok
16:23:53.0821 2096  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
16:23:53.0866 2096  usbprint - ok
16:23:53.0897 2096  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
16:23:53.0922 2096  usbscan - ok
16:23:53.0937 2096  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\drivers\USBSTOR.SYS
16:23:53.0977 2096  USBSTOR - ok
16:23:54.0002 2096  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
16:23:54.0040 2096  usbuhci - ok
16:23:54.0090 2096  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
16:23:54.0139 2096  usbvideo - ok
16:23:54.0183 2096  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
16:23:54.0271 2096  UxSms - ok
16:23:54.0294 2096  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
16:23:54.0319 2096  VaultSvc - ok
16:23:54.0366 2096  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
16:23:54.0397 2096  vdrvroot - ok
16:23:54.0455 2096  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
16:23:54.0559 2096  vds - ok
16:23:54.0594 2096  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
16:23:54.0619 2096  vga - ok
16:23:54.0658 2096  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
16:23:54.0721 2096  VgaSave - ok
16:23:54.0761 2096  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
16:23:54.0783 2096  vhdmp - ok
16:23:54.0828 2096  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
16:23:54.0847 2096  viaide - ok
16:23:54.0872 2096  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
16:23:54.0892 2096  volmgr - ok
16:23:54.0952 2096  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
16:23:54.0995 2096  volmgrx - ok
16:23:55.0015 2096  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
16:23:55.0040 2096  volsnap - ok
16:23:55.0059 2096  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
16:23:55.0082 2096  vsmraid - ok
16:23:55.0170 2096  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
16:23:55.0297 2096  VSS - ok
16:23:55.0324 2096  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
16:23:55.0367 2096  vwifibus - ok
16:23:55.0398 2096  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
16:23:55.0447 2096  vwififlt - ok
16:23:55.0495 2096  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
16:23:55.0563 2096  W32Time - ok
16:23:55.0582 2096  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
16:23:55.0620 2096  WacomPen - ok
16:23:55.0690 2096  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
16:23:55.0783 2096  WANARP - ok
16:23:55.0805 2096  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
16:23:55.0850 2096  Wanarpv6 - ok
16:23:55.0950 2096  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc    C:\Windows\system32\Wat\WatAdminSvc.exe
16:23:56.0033 2096  WatAdminSvc - ok
16:23:56.0111 2096  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
16:23:56.0193 2096  wbengine - ok
16:23:56.0243 2096  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
16:23:56.0289 2096  WbioSrvc - ok
16:23:56.0339 2096  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
16:23:56.0412 2096  wcncsvc - ok
16:23:56.0438 2096  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
16:23:56.0469 2096  WcsPlugInService - ok
16:23:56.0519 2096  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
16:23:56.0538 2096  Wd - ok
16:23:56.0607 2096  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
16:23:56.0682 2096  Wdf01000 - ok
16:23:56.0700 2096  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
16:23:56.0751 2096  WdiServiceHost - ok
16:23:56.0756 2096  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
16:23:56.0791 2096  WdiSystemHost - ok
16:23:56.0843 2096  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
16:23:56.0943 2096  WebClient - ok
16:23:56.0978 2096  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
16:23:57.0063 2096  Wecsvc - ok
16:23:57.0085 2096  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
16:23:57.0140 2096  wercplsupport - ok
16:23:57.0174 2096  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
16:23:57.0228 2096  WerSvc - ok
16:23:57.0286 2096  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
16:23:57.0352 2096  WfpLwf - ok
16:23:57.0372 2096  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
16:23:57.0392 2096  WIMMount - ok
16:23:57.0437 2096  WinDefend - ok
16:23:57.0446 2096  WinHttpAutoProxySvc - ok
16:23:57.0546 2096  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
16:23:57.0622 2096  Winmgmt - ok
16:23:57.0711 2096  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
16:23:57.0858 2096  WinRM - ok
16:23:57.0942 2096  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\drivers\WinUsb.sys
16:23:57.0998 2096  WinUsb - ok
16:23:58.0065 2096  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
16:23:58.0185 2096  Wlansvc - ok
16:23:58.0227 2096  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
16:23:58.0252 2096  WmiAcpi - ok
16:23:58.0314 2096  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
16:23:58.0371 2096  wmiApSrv - ok
16:23:58.0463 2096  WMPNetworkSvc - ok
16:23:58.0477 2096  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
16:23:58.0518 2096  WPCSvc - ok
16:23:58.0556 2096  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
16:23:58.0590 2096  WPDBusEnum - ok
16:23:58.0629 2096  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
16:23:58.0676 2096  ws2ifsl - ok
16:23:58.0686 2096  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
16:23:58.0723 2096  wscsvc - ok
16:23:58.0728 2096  WSearch - ok
16:23:58.0823 2096  [ D7E88349BE0F01E4D8D776ADB1F325BF ] WTGService      C:\Program Files (x86)\Verbindungsassistent\WTGService.exe
16:23:58.0853 2096  WTGService - ok
16:23:58.0968 2096  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
16:23:59.0088 2096  wuauserv - ok
16:23:59.0139 2096  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
16:23:59.0191 2096  WudfPf - ok
16:23:59.0256 2096  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\drivers\WUDFRd.sys
16:23:59.0297 2096  WUDFRd - ok
16:23:59.0338 2096  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
16:23:59.0395 2096  wudfsvc - ok
16:23:59.0435 2096  [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc        C:\Windows\System32\wwansvc.dll
16:23:59.0513 2096  WwanSvc - ok
16:23:59.0526 2096  ================ Scan global ===============================
16:23:59.0557 2096  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
16:23:59.0606 2096  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
16:23:59.0634 2096  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
16:23:59.0689 2096  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
16:23:59.0744 2096  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
16:23:59.0778 2096  [Global] - ok
16:23:59.0779 2096  ================ Scan MBR ==================================
16:23:59.0798 2096  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:24:00.0145 2096  \Device\Harddisk0\DR0 - ok
16:24:00.0146 2096  ================ Scan VBR ==================================
16:24:00.0151 2096  [ 9AB8B325A260168789065E6788C36802 ] \Device\Harddisk0\DR0\Partition1
16:24:00.0155 2096  \Device\Harddisk0\DR0\Partition1 - ok
16:24:00.0187 2096  [ 4C4B4042EF473BD0CDD304816D19FCC5 ] \Device\Harddisk0\DR0\Partition2
16:24:00.0189 2096  \Device\Harddisk0\DR0\Partition2 - ok
16:24:00.0190 2096  ============================================================
16:24:00.0190 2096  Scan finished
16:24:00.0190 2096  ============================================================
16:24:00.0276 2148  Detected object count: 2
16:24:00.0276 2148  Actual detected object count: 2
16:24:34.0924 2148  AntiVirScheduler ( UnsignedFile.Multi.Generic ) - skipped by user
16:24:34.0924 2148  AntiVirScheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:24:34.0927 2148  AntiVirService ( UnsignedFile.Multi.Generic ) - skipped by user
16:24:34.0927 2148  AntiVirService ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:25:10.0889 4144  Deinitialize success
Danke

markusg 20.05.2013 16:31
Hi,
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

hbo1611 20.05.2013 16:59
Code:
ComboFix 13-05-18.04 - *** 20.05.2013  17:37:00.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4061.2853 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-04-20 bis 2013-05-20  ))))))))))))))))))))))))))))))
.
.
2013-05-20 15:45 . 2013-05-20 15:45        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-05-20 15:44 . 2013-05-20 15:44        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FB8984C-5384-46F0-9C91-CAB6A509FACC}\offreg.dll
2013-05-20 13:37 . 2013-05-20 13:51        --------        d-----w-        C:\_OTL
2013-05-20 12:04 . 2013-05-09 08:59        378432        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2013-05-20 12:04 . 2013-05-09 08:59        33400        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2013-05-20 12:04 . 2013-05-09 08:59        72016        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys
2013-05-20 12:04 . 2013-05-09 08:59        64288        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2013-05-20 12:04 . 2013-05-09 08:59        189936        ----a-w-        c:\windows\system32\drivers\aswVmm.sys
2013-05-20 12:04 . 2013-05-09 08:59        1025808        ----a-w-        c:\windows\system32\drivers\aswSnx.sys
2013-05-20 12:04 . 2013-05-09 08:59        65336        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys
2013-05-20 12:04 . 2013-05-09 08:59        80816        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys
2013-05-20 12:04 . 2013-05-09 08:58        287840        ----a-w-        c:\windows\system32\aswBoot.exe
2013-05-20 12:03 . 2013-05-09 08:58        41664        ----a-w-        c:\windows\avastSS.scr
2013-05-20 12:03 . 2013-05-20 12:03        --------        d-----w-        c:\program files\AVAST Software
2013-05-20 10:11 . 2013-05-20 12:03        --------        d-----w-        c:\programdata\AVAST Software
2013-05-19 23:52 . 2013-05-03 14:15        75016696        ----a-w-        c:\windows\system32\MRT.exe
2013-05-19 22:21 . 2013-05-19 22:21        --------        d-sh--r-        c:\users\***\AppData\Roaming\narxtq
2013-05-17 08:52 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FB8984C-5384-46F0-9C91-CAB6A509FACC}\mpengine.dll
2013-05-15 22:22 . 2013-05-05 21:36        17818624        ----a-w-        c:\windows\system32\mshtml.dll
2013-05-15 22:22 . 2013-05-05 21:16        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2013-05-15 22:22 . 2013-05-05 19:12        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2013-05-15 08:17 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2013-04-24 08:47 . 2013-04-12 14:45        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-04-23 12:09 . 2013-04-23 12:09        --------        d-----w-        C:\FFOutput
2013-04-23 12:08 . 2013-04-23 12:08        --------        d-----w-        c:\program files (x86)\FreeTime
2013-04-23 08:13 . 2013-04-23 08:13        --------        d-----w-        c:\program files (x86)\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 00:06 . 2010-02-17 16:58        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-13 05:49 . 2013-05-15 08:17        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 08:17        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 08:17        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 08:17        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 08:17        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 08:17        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-04-03 10:37 . 2013-04-03 10:37        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-03 10:37 . 2013-04-03 10:37        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2013-04-03 10:37 . 2013-04-03 10:37        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2013-04-02 14:09 . 2013-04-02 14:09        4550656        ----a-w-        c:\windows\SysWow64\GPhotos.scr
2013-03-21 01:03 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2013-03-21 01:03 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2013-03-19 06:04 . 2013-04-10 08:59        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 08:59        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 08:59        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 08:59        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 08:59        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 08:59        112640        ----a-w-        c:\windows\system32\smss.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Facebook Update"="c:\users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-09-16 138096]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-3-12 29106336]
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
PDFCreator.lnk - c:\program files (x86)\PDFCreator\PDFCreator.exe [2010-2-17 2641920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2013-03-03 1255736]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 FSProFilter;FSPro File Filter;c:\windows\System32\Drivers\FSPFltd.sys [2010-07-22 54848]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 203264]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
S2 WTGService;WTGService;c:\program files (x86)\Verbindungsassistent\WTGService.exe [2009-03-03 296400]
S3 k57nd60a;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-06-10 270848]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 48715413
*NewlyCreated* - ASWRVRT
*NewlyCreated* - ASWSNX
*Deregistered* - 48715413
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243515147-3553933283-4176941337-1000Core.job
- c:\users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-16 22:12]
.
2013-05-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-243515147-3553933283-4176941337-1000UA.job
- c:\users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-09-16 22:12]
.
2013-05-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-243515147-3553933283-4176941337-1000Core.job
- c:\users\***\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-08 03:15]
.
2013-05-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-243515147-3553933283-4176941337-1000UA.job
- c:\users\***\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-08 03:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58        133840        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 2114376]
"mylbx"="c:\program files\My Lockbox\mylbx.exe" [2011-05-07 1899328]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\maruhn\AppData\Roaming\Mozilla\Firefox\Profiles\ms991bbq.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.bild.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=
FF - ExtSQL: 2013-05-20 14:03; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: !HIDDEN! 2012-12-06 21:05; {ACAA314B-EEBA-48e4-AD47-84E31C44796C}; c:\program files (x86)\Common Files\DVDVideoSoft\plugins\ff
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Free Audio CD Burner_is1 - c:\program files (x86)\DVDVideoSoft\Free Audio CD Burner\unins000.exe
AddRemove-Pulleralarm - Das Spiel zu TV total - c:\windows\IsUn0407.exe
AddRemove-Uninstall_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-05-20  17:48:34
ComboFix-quarantined-files.txt  2013-05-20 15:48
.
Vor Suchlauf: 16 Verzeichnis(se), 103.547.244.544 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 103.077.138.432 Bytes frei
.
- - End Of File - - E4EE6FFA2C0FB0EFFD79F8DF50E22954
Während des Ausführens hat sich der Trojaner wieder gezuckt und Werbung im Browser geladen bzw ist die Maus wieder ein wenig durchgedreht und hat sich bewegt. Ich habe während des Vorgangs absolut nichts getan.
Hoffe der Combofix Durchlauf hat trotzdem seine Wirkung erzielt.

markusg 20.05.2013 17:02
Hi,
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

hbo1611 20.05.2013 19:23
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.20.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
maruhn :: ***-PC [Administrator]

20.05.2013 18:13:34
mbam-log-2013-05-20 (18-13-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 515482
Laufzeit: 1 Stunde(n), 55 Minute(n), 41 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 13
C:\System Volume Information\SystemRestore\FRStaging\Users\***\AppData\Local\Temp\b34btbztdb0vavaw.exe (Trojan.VBAgent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\System Volume Information\SystemRestore\FRStaging\Users\***\AppData\Local\Temp\b34btbztdb1vavaw.exe (Trojan.FakeNero.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Roaming\narxtq\narxtq.scr (Trojan.Agent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\Desktop\Desktop\Photoshop\Photoshop CS3\Files\asneu.dll (Trojan.Agent.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\Downloads\seeed__seeed_deluxe_ver__id1573175id.exe (PUP.Adware.MediaGet) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\Downloads\XvidSetup (1).exe (Adware.HotBar.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\Downloads\XvidSetup.exe (Adware.Hotbar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles.zip (Trojan.Bitcoin) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\05202013_153744\C_Users\***\AppData\Roaming\skype.dat (Trojan.FakeAlert.RRE) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\05202013_153744\C_Users\***\AppData\Roaming\pejo\chp.exe (Trojan.Bitcoin) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\05202013_153744\C_Users\***\AppData\Roaming\pejo\scvhost.exe (Trojan.BitMiner) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\05202013_153744\C_Users\***\AppData\Roaming\winlogon\chp.exe (Trojan.Bitcoin) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\05202013_153744\C_Users\***\AppData\Roaming\winlogon\scvhost.exe (Trojan.BitMiner) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Hey,
so endlich ist es durchgelaufen und ich habe die Dateien entfernt. Ich musste einen Neustart machen und das OpenOffice Fenster ist wieder aufgepoppt, wenn das eine hilfreiche Information ist.

Dabei hab ich vergessen anzumerken, dass ständig jucheck.exe von oracle america ein JA haben möchte bei der Ausführung. Habe immer nein geklickt. Jetzt wo ich hier bin wollte ich fragen ob ich auch auf JA klicken kann, weil es wirklich nur ein Java Update Checker ist? Oder hat es was mit der andere Sache zutun? Danke.

markusg 20.05.2013 19:35
hi,
Frage, woher stammt diese Version:
Photoshop\Photoshop CS3\Files\asneu.dll

hbo1611 20.05.2013 20:08
Achso und die gleiche Frage habe ich bezüglich des Sicherheitshinweisfensters im Internet Explorer, das ständig auftaucht.

Hey, das kann ich leider nicht beantworten mit der Datei kA :/

markusg 20.05.2013 20:11
hi
welches hinweisfenster im Browser?

lade den CCleaner standard:
http://filepony.de/download-ccleaner/
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

hbo1611 20.05.2013 20:18
Über sichere und unsichere Verbindungen auf unterschiedlichen Seiten. Aber das ist wohl nur ein IE Ding, da ich ihn selten benutze.

Ich lade mir jetzt den CCleaner und poste gleich das Ergebnis

markusg 20.05.2013 20:43
aso. da müsste es doch einen haken geben, meldung nicht anzeigen oder ähnlichb.


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:19 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131