Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Snap.do Trojaner lässt sich nicht auf herkömmliche Weise entfernen (https://www.trojaner-board.de/138031-snap-do-trojaner-laesst-herkoemmliche-weise-entfernen.html)

fräuleindoof 10.07.2013 21:56
Snap.do Trojaner lässt sich nicht auf herkömmliche Weise entfernen
 
Hallo liebe Trojaner-Profis, :)

nachdem ich dank eurer Hilfe meinen PC wieder gesund pflegen konnte, hat sich nun auch der PC meiner Mitbewohnerin infiziert mit einem laut Google Trojaner namens snap.do. Dies ist irgendeine komische Suchmaschine, die nun von Chrome anstelle von Google genutzt wird. Es ist zwar machbar, die Suchmaschine wieder auf Google zu ändern, dennoch lässt sich das Programm snap.do nicht vom Computer entfernen. Außerdem kam gleichzeitig mit diesem komischen snap.do auch noch etwas namens delta search auf den PC. Meine Mitbewohnerin hat momentan viel um die Ohren, deswegen kümmere ich mich darum, aber kann das nun natürlich nicht ganz so detailreich schildern. Ich hoffe, dass diese Infos zunächst ausreichen. Anbei sende ich noch die Logfiles von defogger, OTL & gmer, allerdings hat OTL keine EXTRA.txt erstellt. Ich weiß auch nicht, warum. Außerdem gab es bei dem ersten Scandurchlauf von gmer das Problem, dass der PC ne Meldung abgegeben hat, (der ganze Bildschirm war blau und da stand was von wegen der PC ist gefährdet und musste "gestoppt" werden oder so. Den genauen Wortlaut konnte ich mir leider nicht einprägen, denn) ich hab es nicht mal geschafft, alles zu lesen, da ist der PC auch schon ausgegangen und hat einen Neustart gemacht)... Habe das Programm dann nochmal durchlaufen lassen, aber seit dem Neustart kann ich den Cursor nur noch im Schneckentempo bewegen...nicht so toll.
Außerdem sollte ich noch erwähnen, dass meine Mitbewohnerin, direkt nachdem sie den Trojaner drauf hatte, den PC jemandem mitgegeben hat, der das eigentlich beseitigen wollte, aber offensichtlich doch nicht so viel Ahnung hatte wie er vorgab...:kloppen:
Leider wissen wir auch nicht, was er bisher angestellt hat...:confused:

Ich hoffe mal wieder auf liebe Hilfe und danke schon mal im Voraus! :crazy:

fräuleindoof...:Boogie:

markusg 10.07.2013 21:59
Hi,
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

fräuleindoof 10.07.2013 22:13
"no threads found" :/

markusg 10.07.2013 22:26
Und was steht in der Anleitung
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

:-)
Hoffe, Programm konfiguriert nach Anleitung.

fräuleindoof 10.07.2013 22:33
Hab die Anleitung befolgt, dachte nur, da da stand, dass nichts befallenes gefunden wurde, dass es auch keine Datei erstellt hat.^^
Hier nun also der/die/das logfile^^
Code:
23:10:31.0934 1448  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
23:10:32.0236 1448  ============================================================
23:10:32.0237 1448  Current date / time: 2013/07/10 23:10:32.0236
23:10:32.0237 1448  SystemInfo:
23:10:32.0237 1448 
23:10:32.0237 1448  OS Version: 6.1.7601 ServicePack: 1.0
23:10:32.0237 1448  Product type: Workstation
23:10:32.0237 1448  ComputerName: EDDIE
23:10:32.0237 1448  UserName: Sophie
23:10:32.0237 1448  Windows directory: C:\windows
23:10:32.0237 1448  System windows directory: C:\windows
23:10:32.0237 1448  Running under WOW64
23:10:32.0237 1448  Processor architecture: Intel x64
23:10:32.0237 1448  Number of processors: 4
23:10:32.0237 1448  Page size: 0x1000
23:10:32.0237 1448  Boot type: Normal boot
23:10:32.0237 1448  ============================================================
23:10:34.0277 1448  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:10:34.0278 1448  Drive \Device\Harddisk1\DR1 - Size: 0x5976F6000 (22.37 Gb), SectorSize: 0x200, Cylinders: 0xB67, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:10:34.0406 1448  ============================================================
23:10:34.0406 1448  \Device\Harddisk0\DR0:
23:10:34.0494 1448  MBR partitions:
23:10:34.0494 1448  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
23:10:34.0494 1448  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x37642800
23:10:34.0494 1448  \Device\Harddisk1\DR1:
23:10:34.0572 1448  MBR partitions:
23:10:34.0572 1448  ============================================================
23:10:34.0836 1448  C: <-> \Device\Harddisk0\DR0\Partition2
23:10:34.0836 1448  ============================================================
23:10:34.0836 1448  Initialize success
23:10:34.0836 1448  ============================================================
23:11:38.0170 3320  ============================================================
23:11:38.0170 3320  Scan started
23:11:38.0170 3320  Mode: Manual; SigCheck; TDLFS;
23:11:38.0170 3320  ============================================================
23:11:38.0607 3320  ================ Scan system memory ========================
23:11:38.0607 3320  System memory - ok
23:11:38.0607 3320  ================ Scan services =============================
23:11:38.0841 3320  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\windows\system32\drivers\1394ohci.sys
23:11:39.0012 3320  1394ohci - ok
23:11:39.0043 3320  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\windows\system32\drivers\ACPI.sys
23:11:39.0090 3320  ACPI - ok
23:11:39.0106 3320  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\windows\system32\drivers\acpipmi.sys
23:11:39.0153 3320  AcpiPmi - ok
23:11:39.0231 3320  [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
23:11:39.0277 3320  AdobeARMservice - ok
23:11:39.0402 3320  [ 9915504F602D277EE47FD843A677FD15 ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
23:11:39.0433 3320  AdobeFlashPlayerUpdateSvc - ok
23:11:39.0480 3320  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\windows\system32\drivers\adp94xx.sys
23:11:39.0543 3320  adp94xx - ok
23:11:39.0558 3320  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\windows\system32\drivers\adpahci.sys
23:11:39.0605 3320  adpahci - ok
23:11:39.0652 3320  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\windows\system32\drivers\adpu320.sys
23:11:39.0699 3320  adpu320 - ok
23:11:39.0730 3320  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\windows\System32\aelupsvc.dll
23:11:39.0823 3320  AeLookupSvc - ok
23:11:39.0870 3320  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\windows\system32\drivers\afd.sys
23:11:39.0933 3320  AFD - ok
23:11:39.0964 3320  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\windows\system32\drivers\agp440.sys
23:11:39.0995 3320  agp440 - ok
23:11:40.0026 3320  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\windows\System32\alg.exe
23:11:40.0073 3320  ALG - ok
23:11:40.0089 3320  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\windows\system32\drivers\aliide.sys
23:11:40.0120 3320  aliide - ok
23:11:40.0135 3320  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\windows\system32\drivers\amdide.sys
23:11:40.0167 3320  amdide - ok
23:11:40.0198 3320  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\windows\system32\drivers\amdk8.sys
23:11:40.0245 3320  AmdK8 - ok
23:11:40.0260 3320  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\windows\system32\drivers\amdppm.sys
23:11:40.0291 3320  AmdPPM - ok
23:11:40.0338 3320  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\windows\system32\drivers\amdsata.sys
23:11:40.0369 3320  amdsata - ok
23:11:40.0385 3320  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\windows\system32\drivers\amdsbs.sys
23:11:40.0432 3320  amdsbs - ok
23:11:40.0447 3320  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\windows\system32\drivers\amdxata.sys
23:11:40.0494 3320  amdxata - ok
23:11:40.0510 3320  [ 449D90F1FB6402773C2F1ECCEAE15F74 ] AMPPAL          C:\windows\system32\DRIVERS\AMPPAL.sys
23:11:40.0557 3320  AMPPAL - ok
23:11:40.0572 3320  [ 449D90F1FB6402773C2F1ECCEAE15F74 ] AMPPALP        C:\windows\system32\DRIVERS\amppal.sys
23:11:40.0619 3320  AMPPALP - ok
23:11:40.0713 3320  [ AB6E5B9333101E414D8F04BC570064F1 ] AMPPALR3        C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
23:11:40.0791 3320  AMPPALR3 - ok
23:11:40.0822 3320  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\windows\system32\drivers\appid.sys
23:11:40.0915 3320  AppID - ok
23:11:40.0947 3320  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\windows\System32\appidsvc.dll
23:11:41.0040 3320  AppIDSvc - ok
23:11:41.0071 3320  [ 9D2A2369AB4B08A4905FE72DB104498F ] Appinfo        C:\windows\System32\appinfo.dll
23:11:41.0103 3320  Appinfo - ok
23:11:41.0165 3320  [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
23:11:41.0196 3320  Apple Mobile Device - ok
23:11:41.0227 3320  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\windows\system32\drivers\arc.sys
23:11:41.0259 3320  arc - ok
23:11:41.0274 3320  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\windows\system32\drivers\arcsas.sys
23:11:41.0305 3320  arcsas - ok
23:11:41.0352 3320  [ 0BAEFD3F648C6E7AB52990DD9565E4E2 ] aswFsBlk        C:\windows\system32\drivers\aswFsBlk.sys
23:11:41.0383 3320  aswFsBlk - ok
23:11:41.0446 3320  [ FA562F34ED6633C66170B09182B4C049 ] aswMonFlt      C:\windows\system32\drivers\aswMonFlt.sys
23:11:41.0477 3320  aswMonFlt - ok
23:11:41.0493 3320  [ 64E2BAB4096C13D2342BC4661C967E07 ] aswRdr          C:\windows\System32\Drivers\aswrdr2.sys
23:11:41.0524 3320  aswRdr - ok
23:11:41.0555 3320  [ 5573AA70993A2BB81525B1C704B88763 ] aswRvrt        C:\windows\system32\drivers\aswRvrt.sys
23:11:41.0586 3320  aswRvrt - ok
23:11:41.0664 3320  [ 8C0800CDB501CFC1164B286A0478DC10 ] aswSnx          C:\windows\system32\drivers\aswSnx.sys
23:11:41.0742 3320  aswSnx - ok
23:11:41.0789 3320  [ 3815DB16CDA62190F5C0A65118F3D714 ] aswSP          C:\windows\system32\drivers\aswSP.sys
23:11:41.0836 3320  aswSP - ok
23:11:41.0836 3320  [ 29DD8E458A84171202AA4979364C30C0 ] aswTdi          C:\windows\system32\drivers\aswTdi.sys
23:11:41.0883 3320  aswTdi - ok
23:11:41.0898 3320  [ 22F521108881DC59837F6FC614E0568F ] aswVmm          C:\windows\system32\drivers\aswVmm.sys
23:11:41.0945 3320  aswVmm - ok
23:11:41.0976 3320  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\windows\system32\DRIVERS\asyncmac.sys
23:11:42.0070 3320  AsyncMac - ok
23:11:42.0101 3320  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\windows\system32\drivers\atapi.sys
23:11:42.0132 3320  atapi - ok
23:11:42.0179 3320  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
23:11:42.0304 3320  AudioEndpointBuilder - ok
23:11:42.0319 3320  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\windows\System32\Audiosrv.dll
23:11:42.0429 3320  AudioSrv - ok
23:11:42.0507 3320  [ 28D6701C710AD7BA3CB95E75F8F1A9AA ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
23:11:42.0538 3320  avast! Antivirus - ok
23:11:42.0569 3320  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\windows\System32\AxInstSV.dll
23:11:42.0616 3320  AxInstSV - ok
23:11:42.0663 3320  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\windows\system32\drivers\bxvbda.sys
23:11:42.0709 3320  b06bdrv - ok
23:11:42.0741 3320  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\windows\system32\DRIVERS\b57nd60a.sys
23:11:42.0787 3320  b57nd60a - ok
23:11:42.0865 3320  [ F48FEB7DA35821DA15E0B006DCB9A169 ] BBSvc          C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe
23:11:42.0912 3320  BBSvc - ok
23:11:42.0943 3320  [ 8E16F7A85441986FD2B9CE6C879524E4 ] BBUpdate        C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe
23:11:42.0975 3320  BBUpdate - ok
23:11:43.0006 3320  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\windows\System32\bdesvc.dll
23:11:43.0053 3320  BDESVC - ok
23:11:43.0068 3320  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\windows\system32\drivers\Beep.sys
23:11:43.0177 3320  Beep - ok
23:11:43.0209 3320  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\windows\System32\bfe.dll
23:11:43.0333 3320  BFE - ok
23:11:43.0365 3320  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\windows\System32\qmgr.dll
23:11:43.0489 3320  BITS - ok
23:11:43.0521 3320  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\windows\system32\DRIVERS\blbdrive.sys
23:11:43.0552 3320  blbdrive - ok
23:11:43.0645 3320  [ A52EA1D8C2900055323C93DDB252A3DA ] Bluetooth Device Monitor C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
23:11:43.0708 3320  Bluetooth Device Monitor - ok
23:11:43.0770 3320  [ 091210450CA7CED08F360D9D7FEC5D11 ] Bluetooth Media Service C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
23:11:43.0848 3320  Bluetooth Media Service - ok
23:11:43.0911 3320  [ 392450754E17FF778CBC5B9D20583AD1 ] Bluetooth OBEX Service C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
23:11:43.0989 3320  Bluetooth OBEX Service - ok
23:11:44.0051 3320  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
23:11:44.0098 3320  Bonjour Service - ok
23:11:44.0145 3320  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\windows\system32\DRIVERS\bowser.sys
23:11:44.0176 3320  bowser - ok
23:11:44.0207 3320  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\windows\system32\drivers\BrFiltLo.sys
23:11:44.0254 3320  BrFiltLo - ok
23:11:44.0269 3320  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\windows\system32\drivers\BrFiltUp.sys
23:11:44.0316 3320  BrFiltUp - ok
23:11:44.0363 3320  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\windows\System32\browser.dll
23:11:44.0410 3320  Browser - ok
23:11:44.0441 3320  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\windows\System32\Drivers\Brserid.sys
23:11:44.0488 3320  Brserid - ok
23:11:44.0503 3320  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\windows\System32\Drivers\BrSerWdm.sys
23:11:44.0566 3320  BrSerWdm - ok
23:11:44.0581 3320  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\windows\System32\Drivers\BrUsbMdm.sys
23:11:44.0628 3320  BrUsbMdm - ok
23:11:44.0644 3320  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\windows\System32\Drivers\BrUsbSer.sys
23:11:44.0675 3320  BrUsbSer - ok
23:11:44.0722 3320  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum        C:\windows\system32\drivers\BthEnum.sys
23:11:44.0769 3320  BthEnum - ok
23:11:44.0784 3320  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\windows\system32\drivers\bthmodem.sys
23:11:44.0831 3320  BTHMODEM - ok
23:11:44.0862 3320  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\windows\system32\DRIVERS\bthpan.sys
23:11:44.0909 3320  BthPan - ok
23:11:44.0940 3320  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT        C:\windows\System32\Drivers\BTHport.sys
23:11:45.0003 3320  BTHPORT - ok
23:11:45.0034 3320  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\windows\system32\bthserv.dll
23:11:45.0127 3320  bthserv - ok
23:11:45.0159 3320  [ 588762F716C2B7A2054AFBC3D58E5C21 ] BTHSSecurityMgr C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
23:11:45.0190 3320  BTHSSecurityMgr - ok
23:11:45.0205 3320  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\windows\System32\Drivers\BTHUSB.sys
23:11:45.0252 3320  BTHUSB - ok
23:11:45.0268 3320  [ 988CC6CC49303665D3B2435C51505C3F ] btmaux          C:\windows\system32\DRIVERS\btmaux.sys
23:11:45.0315 3320  btmaux - ok
23:11:45.0361 3320  [ 2B4B508AFAC2A563931AF1FE875A5B16 ] btmhsf          C:\windows\system32\DRIVERS\btmhsf.sys
23:11:45.0424 3320  btmhsf - ok
23:11:45.0455 3320  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\windows\system32\DRIVERS\cdfs.sys
23:11:45.0549 3320  cdfs - ok
23:11:45.0564 3320  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\windows\system32\DRIVERS\cdrom.sys
23:11:45.0611 3320  cdrom - ok
23:11:45.0642 3320  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\windows\System32\certprop.dll
23:11:45.0736 3320  CertPropSvc - ok
23:11:45.0767 3320  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\windows\system32\drivers\circlass.sys
23:11:45.0814 3320  circlass - ok
23:11:45.0829 3320  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\windows\system32\CLFS.sys
23:11:45.0892 3320  CLFS - ok
23:11:45.0954 3320  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:11:45.0985 3320  clr_optimization_v2.0.50727_32 - ok
23:11:46.0017 3320  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
23:11:46.0048 3320  clr_optimization_v2.0.50727_64 - ok
23:11:46.0126 3320  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:11:46.0157 3320  clr_optimization_v4.0.30319_32 - ok
23:11:46.0219 3320  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
23:11:46.0251 3320  clr_optimization_v4.0.30319_64 - ok
23:11:46.0282 3320  [ E13A438F9E51DD034730678E33B73290 ] clwvd          C:\windows\system32\DRIVERS\clwvd.sys
23:11:46.0313 3320  clwvd - ok
23:11:46.0329 3320  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\windows\system32\DRIVERS\CmBatt.sys
23:11:46.0375 3320  CmBatt - ok
23:11:46.0407 3320  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\windows\system32\drivers\cmdide.sys
23:11:46.0438 3320  cmdide - ok
23:11:46.0485 3320  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\windows\system32\Drivers\cng.sys
23:11:46.0563 3320  CNG - ok
23:11:46.0578 3320  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\windows\system32\DRIVERS\compbatt.sys
23:11:46.0609 3320  Compbatt - ok
23:11:46.0625 3320  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\windows\system32\DRIVERS\CompositeBus.sys
23:11:46.0672 3320  CompositeBus - ok
23:11:46.0672 3320  COMSysApp - ok
23:11:46.0734 3320  [ 96E2C85CE6B55855E2A2324F716BEA99 ] cphs            C:\windows\SysWow64\IntelCpHeciSvc.exe
23:11:46.0765 3320  cphs - ok
23:11:46.0797 3320  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\windows\system32\drivers\crcdisk.sys
23:11:46.0828 3320  crcdisk - ok
23:11:46.0875 3320  [ D8129C49798CBBFB2E4351D4B7B8EF9C ] CryptSvc        C:\windows\system32\cryptsvc.dll
23:11:46.0921 3320  CryptSvc - ok
23:11:46.0968 3320  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\windows\system32\rpcss.dll
23:11:47.0077 3320  DcomLaunch - ok
23:11:47.0124 3320  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\windows\System32\defragsvc.dll
23:11:47.0233 3320  defragsvc - ok
23:11:47.0249 3320  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\windows\system32\Drivers\dfsc.sys
23:11:47.0358 3320  DfsC - ok
23:11:47.0374 3320  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\windows\system32\dhcpcore.dll
23:11:47.0421 3320  Dhcp - ok
23:11:47.0436 3320  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\windows\system32\drivers\discache.sys
23:11:47.0545 3320  discache - ok
23:11:47.0545 3320  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\windows\system32\drivers\disk.sys
23:11:47.0577 3320  Disk - ok
23:11:47.0608 3320  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\windows\System32\dnsrslvr.dll
23:11:47.0655 3320  Dnscache - ok
23:11:47.0686 3320  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\windows\System32\dot3svc.dll
23:11:47.0795 3320  dot3svc - ok
23:11:47.0795 3320  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\windows\system32\dps.dll
23:11:47.0904 3320  DPS - ok
23:11:47.0936 3320  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\windows\system32\drivers\drmkaud.sys
23:11:47.0982 3320  drmkaud - ok
23:11:48.0029 3320  [ 46571ED73AE84469DCA53081D33CF3C8 ] dtsoftbus01    C:\windows\system32\DRIVERS\dtsoftbus01.sys
23:11:48.0060 3320  dtsoftbus01 - ok
23:11:48.0123 3320  [ AF2E16242AA723F68F461B6EAE2EAD3D ] DXGKrnl        C:\windows\System32\drivers\dxgkrnl.sys
23:11:48.0201 3320  DXGKrnl - ok
23:11:48.0248 3320  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\windows\System32\eapsvc.dll
23:11:48.0341 3320  EapHost - ok
23:11:48.0450 3320  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\windows\system32\drivers\evbda.sys
23:11:48.0591 3320  ebdrv - ok
23:11:48.0622 3320  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\windows\System32\lsass.exe
23:11:48.0653 3320  EFS - ok
23:11:48.0731 3320  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\windows\ehome\ehRecvr.exe
23:11:48.0794 3320  ehRecvr - ok
23:11:48.0809 3320  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\windows\ehome\ehsched.exe
23:11:48.0856 3320  ehSched - ok
23:11:48.0903 3320  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\windows\system32\drivers\elxstor.sys
23:11:48.0950 3320  elxstor - ok
23:11:48.0965 3320  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\windows\system32\drivers\errdev.sys
23:11:49.0012 3320  ErrDev - ok
23:11:49.0059 3320  [ A1C18DA0723BF4B2DCDFE3D1B706A521 ] ETD            C:\windows\system32\DRIVERS\ETD.sys
23:11:49.0106 3320  ETD - ok
23:11:49.0137 3320  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\windows\system32\es.dll
23:11:49.0246 3320  EventSystem - ok
23:11:49.0293 3320  [ 64D25284A4E9D11CA0722AF3F30FD970 ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
23:11:49.0355 3320  EvtEng - ok
23:11:49.0386 3320  [ D2EAA04AF43154B62FA85B08BAD0A7CA ] excfs          C:\windows\system32\DRIVERS\excfs.sys
23:11:49.0418 3320  excfs - ok
23:11:49.0418 3320  [ E6082A6C109238A725D83184724C4A36 ] excsd          C:\windows\system32\DRIVERS\excsd.sys
23:11:49.0464 3320  excsd - ok
23:11:49.0480 3320  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\windows\system32\drivers\exfat.sys
23:11:49.0589 3320  exfat - ok
23:11:49.0620 3320  [ 68030FF4B7669E15916910885E2E6160 ] ExpressCache    C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
23:11:49.0652 3320  ExpressCache - ok
23:11:49.0683 3320  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\windows\system32\drivers\fastfat.sys
23:11:49.0776 3320  fastfat - ok
23:11:49.0823 3320  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\windows\system32\fxssvc.exe
23:11:49.0886 3320  Fax - ok
23:11:49.0901 3320  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\windows\system32\drivers\fdc.sys
23:11:49.0948 3320  fdc - ok
23:11:49.0964 3320  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\windows\system32\fdPHost.dll
23:11:50.0073 3320  fdPHost - ok
23:11:50.0073 3320  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\windows\system32\fdrespub.dll
23:11:50.0182 3320  FDResPub - ok
23:11:50.0198 3320  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\windows\system32\drivers\fileinfo.sys
23:11:50.0229 3320  FileInfo - ok
23:11:50.0260 3320  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\windows\system32\drivers\filetrace.sys
23:11:50.0354 3320  Filetrace - ok
23:11:50.0369 3320  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\windows\system32\drivers\flpydisk.sys
23:11:50.0416 3320  flpydisk - ok
23:11:50.0432 3320  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\windows\system32\drivers\fltmgr.sys
23:11:50.0478 3320  FltMgr - ok
23:11:50.0556 3320  [ C4C183E6551084039EC862DA1C945E3D ] FontCache      C:\windows\system32\FntCache.dll
23:11:50.0634 3320  FontCache - ok
23:11:50.0681 3320  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
23:11:50.0712 3320  FontCache3.0.0.0 - ok
23:11:50.0712 3320  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\windows\system32\drivers\FsDepends.sys
23:11:50.0759 3320  FsDepends - ok
23:11:50.0775 3320  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\windows\system32\drivers\Fs_Rec.sys
23:11:50.0822 3320  Fs_Rec - ok
23:11:50.0853 3320  [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol          C:\windows\system32\DRIVERS\fvevol.sys
23:11:50.0900 3320  fvevol - ok
23:11:50.0931 3320  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\windows\system32\drivers\gagp30kx.sys
23:11:50.0962 3320  gagp30kx - ok
23:11:51.0040 3320  [ 521A469CAF61F00E1DE081CC2099C1D6 ] GameConsoleService C:\Program Files (x86)\WildGames\Game Console - WildGames\GameConsoleService.exe
23:11:51.0071 3320  GameConsoleService - ok
23:11:51.0102 3320  [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM    C:\windows\system32\DRIVERS\GEARAspiWDM.sys
23:11:51.0134 3320  GEARAspiWDM - ok
23:11:51.0196 3320  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\windows\System32\gpsvc.dll
23:11:51.0305 3320  gpsvc - ok
23:11:51.0336 3320  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:11:51.0368 3320  gupdate - ok
23:11:51.0383 3320  [ 506708142BC63DABA64F2D3AD1DCD5BF ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
23:11:51.0414 3320  gupdatem - ok
23:11:51.0430 3320  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\windows\system32\drivers\hcw85cir.sys
23:11:51.0477 3320  hcw85cir - ok
23:11:51.0492 3320  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
23:11:51.0555 3320  HdAudAddService - ok
23:11:51.0586 3320  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\windows\system32\DRIVERS\HDAudBus.sys
23:11:51.0633 3320  HDAudBus - ok
23:11:51.0664 3320  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\windows\system32\drivers\HidBatt.sys
23:11:51.0695 3320  HidBatt - ok
23:11:51.0726 3320  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\windows\system32\drivers\hidbth.sys
23:11:51.0773 3320  HidBth - ok
23:11:51.0789 3320  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\windows\system32\drivers\hidir.sys
23:11:51.0836 3320  HidIr - ok
23:11:51.0867 3320  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\windows\system32\hidserv.dll
23:11:51.0960 3320  hidserv - ok
23:11:51.0992 3320  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\windows\system32\DRIVERS\hidusb.sys
23:11:52.0038 3320  HidUsb - ok
23:11:52.0038 3320  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\windows\system32\kmsvc.dll
23:11:52.0148 3320  hkmsvc - ok
23:11:52.0148 3320  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\windows\system32\ListSvc.dll
23:11:52.0194 3320  HomeGroupListener - ok
23:11:52.0226 3320  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\windows\system32\provsvc.dll
23:11:52.0272 3320  HomeGroupProvider - ok
23:11:52.0288 3320  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\windows\system32\drivers\HpSAMD.sys
23:11:52.0319 3320  HpSAMD - ok
23:11:52.0366 3320  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\windows\system32\drivers\HTTP.sys
23:11:52.0491 3320  HTTP - ok
23:11:52.0522 3320  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\windows\system32\drivers\hwpolicy.sys
23:11:52.0553 3320  hwpolicy - ok
23:11:52.0569 3320  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\windows\system32\DRIVERS\i8042prt.sys
23:11:52.0616 3320  i8042prt - ok
23:11:52.0662 3320  [ C224331A54571C8C9162F7714400BBBD ] iaStor          C:\windows\system32\DRIVERS\iaStor.sys
23:11:52.0709 3320  iaStor - ok
23:11:52.0756 3320  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\windows\system32\drivers\iaStorV.sys
23:11:52.0803 3320  iaStorV - ok
23:11:52.0818 3320  [ 60CC7AE9AEDB4D1E7923BD053B176D97 ] ibtfltcoex      C:\windows\system32\DRIVERS\iBtFltCoex.sys
23:11:52.0850 3320  ibtfltcoex - ok
23:11:52.0928 3320  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
23:11:52.0990 3320  idsvc - ok
23:11:53.0411 3320  [ 54E37A4E66B2CA1C38E9728FAD5F9822 ] igfx            C:\windows\system32\DRIVERS\igdkmd64.sys
23:11:53.0942 3320  igfx - ok
23:11:53.0988 3320  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\windows\system32\drivers\iirsp.sys
23:11:54.0020 3320  iirsp - ok
23:11:54.0066 3320  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\windows\System32\ikeext.dll
23:11:54.0207 3320  IKEEXT - ok
23:11:54.0238 3320  [ CADDF0927DAC63EDAE48F5C35A61D87D ] intaud_WaveExtensible C:\windows\system32\drivers\intelaud.sys
23:11:54.0269 3320  intaud_WaveExtensible - ok
23:11:54.0410 3320  [ 02674201AD9FE19AC3376705077882C6 ] IntcAzAudAddService C:\windows\system32\drivers\RTKVHD64.sys
23:11:54.0612 3320  IntcAzAudAddService - ok
23:11:54.0628 3320  [ 6C9FFFECA9FED31347D211C5D1FFBD2D ] IntcDAud        C:\windows\system32\DRIVERS\IntcDAud.sys
23:11:54.0675 3320  IntcDAud - ok
23:11:54.0737 3320  [ 832CE330DD987227B7DEA8C03F22AEFA ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
23:11:54.0784 3320  Intel(R) Capability Licensing Service Interface - ok
23:11:54.0831 3320  [ 9571D8BDB56EBC52280E8020574508E6 ] Intel(R) ME Service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
23:11:54.0878 3320  Intel(R) ME Service - ok
23:11:54.0893 3320  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\windows\system32\drivers\intelide.sys
23:11:54.0924 3320  intelide - ok
23:11:54.0956 3320  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\windows\system32\DRIVERS\intelppm.sys
23:11:55.0002 3320  intelppm - ok
23:11:55.0034 3320  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\windows\system32\ipbusenum.dll
23:11:55.0143 3320  IPBusEnum - ok
23:11:55.0158 3320  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\windows\system32\DRIVERS\ipfltdrv.sys
23:11:55.0252 3320  IpFilterDriver - ok
23:11:55.0283 3320  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\windows\System32\iphlpsvc.dll
23:11:55.0346 3320  iphlpsvc - ok
23:11:55.0361 3320  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\windows\system32\drivers\IPMIDrv.sys
23:11:55.0392 3320  IPMIDRV - ok
23:11:55.0424 3320  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\windows\system32\drivers\ipnat.sys
23:11:55.0517 3320  IPNAT - ok
23:11:55.0564 3320  [ 4EFFC8FF6D349E971E94B1C670C0C66A ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
23:11:55.0611 3320  iPod Service - ok
23:11:55.0626 3320  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\windows\system32\drivers\irenum.sys
23:11:55.0673 3320  IRENUM - ok
23:11:55.0704 3320  [ 6DC22BDAA595BE00F19696E72F2F3312 ] irstrtdv        C:\windows\system32\DRIVERS\irstrtdv.sys
23:11:55.0736 3320  irstrtdv - ok
23:11:55.0767 3320  [ 205FD80EF4B9832F9763B9A187957260 ] irstrtsv        C:\windows\SysWOW64\irstrtsv.exe
23:11:55.0798 3320  irstrtsv - ok
23:11:55.0829 3320  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\windows\system32\drivers\isapnp.sys
23:11:55.0860 3320  isapnp - ok
23:11:55.0892 3320  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\windows\system32\drivers\msiscsi.sys
23:11:55.0938 3320  iScsiPrt - ok
23:11:55.0970 3320  [ 8E4577C6E0D3114170509159DE658907 ] iusb3hcs        C:\windows\system32\DRIVERS\iusb3hcs.sys
23:11:56.0001 3320  iusb3hcs - ok
23:11:56.0016 3320  [ FE76346E9B57DA575BD1B3BD0CCAD7FF ] iusb3hub        C:\windows\system32\DRIVERS\iusb3hub.sys
23:11:56.0063 3320  iusb3hub - ok
23:11:56.0094 3320  [ 1008CD90DA2198FFD250298DEB9DF160 ] iusb3xhc        C:\windows\system32\DRIVERS\iusb3xhc.sys
23:11:56.0157 3320  iusb3xhc - ok
23:11:56.0188 3320  [ 716F66336F10885D935B08174DC54242 ] iwdbus          C:\windows\system32\DRIVERS\iwdbus.sys
23:11:56.0204 3320  iwdbus - ok
23:11:56.0250 3320  [ DBD76BC1D498FE368F2C8CB76C3E00A4 ] jhi_service    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
23:11:56.0282 3320  jhi_service - ok
23:11:56.0297 3320  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\windows\system32\DRIVERS\kbdclass.sys
23:11:56.0344 3320  kbdclass - ok
23:11:56.0375 3320  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\windows\system32\drivers\kbdhid.sys
23:11:56.0406 3320  kbdhid - ok
23:11:56.0422 3320  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\windows\system32\lsass.exe
23:11:56.0469 3320  KeyIso - ok
23:11:56.0500 3320  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\windows\system32\Drivers\ksecdd.sys
23:11:56.0531 3320  KSecDD - ok
23:11:56.0547 3320  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\windows\system32\Drivers\ksecpkg.sys
23:11:56.0594 3320  KSecPkg - ok
23:11:56.0625 3320  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\windows\system32\drivers\ksthunk.sys
23:11:56.0718 3320  ksthunk - ok
23:11:56.0765 3320  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\windows\system32\msdtckrm.dll
23:11:56.0874 3320  KtmRm - ok
23:11:56.0906 3320  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\windows\system32\srvsvc.dll
23:11:57.0015 3320  LanmanServer - ok
23:11:57.0030 3320  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\windows\System32\wkssvc.dll
23:11:57.0140 3320  LanmanWorkstation - ok
23:11:57.0171 3320  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\windows\system32\DRIVERS\lltdio.sys
23:11:57.0264 3320  lltdio - ok
23:11:57.0296 3320  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\windows\System32\lltdsvc.dll
23:11:57.0420 3320  lltdsvc - ok
23:11:57.0420 3320  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\windows\System32\lmhsvc.dll
23:11:57.0530 3320  lmhosts - ok
23:11:57.0576 3320  [ 86E4CC39C953D11EF57CF54C4DC78238 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
23:11:57.0608 3320  LMS - ok
23:11:57.0639 3320  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\windows\system32\drivers\lsi_fc.sys
23:11:57.0670 3320  LSI_FC - ok
23:11:57.0717 3320  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\windows\system32\drivers\lsi_sas.sys
23:11:57.0748 3320  LSI_SAS - ok
23:11:57.0764 3320  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\windows\system32\drivers\lsi_sas2.sys
23:11:57.0795 3320  LSI_SAS2 - ok
23:11:57.0826 3320  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\windows\system32\drivers\lsi_scsi.sys
23:11:57.0857 3320  LSI_SCSI - ok
23:11:57.0888 3320  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\windows\system32\drivers\luafv.sys
23:11:57.0982 3320  luafv - ok
23:11:58.0013 3320  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\windows\system32\Mcx2Svc.dll
23:11:58.0060 3320  Mcx2Svc - ok
23:11:58.0091 3320  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\windows\system32\drivers\megasas.sys
23:11:58.0122 3320  megasas - ok
23:11:58.0138 3320  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\windows\system32\drivers\MegaSR.sys
23:11:58.0185 3320  MegaSR - ok
23:11:58.0216 3320  [ 6B01B7414A105B9E51652089A03027CF ] MEIx64          C:\windows\system32\DRIVERS\HECIx64.sys
23:11:58.0247 3320  MEIx64 - ok
23:11:58.0263 3320  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\windows\system32\mmcss.dll
23:11:58.0372 3320  MMCSS - ok
23:11:58.0388 3320  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\windows\system32\drivers\modem.sys
23:11:58.0497 3320  Modem - ok
23:11:58.0512 3320  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\windows\system32\DRIVERS\monitor.sys
23:11:58.0559 3320  monitor - ok
23:11:58.0590 3320  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\windows\system32\DRIVERS\mouclass.sys
23:11:58.0622 3320  mouclass - ok
23:11:58.0653 3320  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\windows\system32\DRIVERS\mouhid.sys
23:11:58.0684 3320  mouhid - ok
23:11:58.0715 3320  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\windows\system32\drivers\mountmgr.sys
23:11:58.0746 3320  mountmgr - ok
23:11:58.0778 3320  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\windows\system32\drivers\mpio.sys
23:11:58.0809 3320  mpio - ok
23:11:58.0840 3320  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\windows\system32\drivers\mpsdrv.sys
23:11:58.0934 3320  mpsdrv - ok
23:11:58.0980 3320  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\windows\system32\mpssvc.dll
23:11:59.0105 3320  MpsSvc - ok
23:11:59.0136 3320  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\windows\system32\drivers\mrxdav.sys
23:11:59.0199 3320  MRxDAV - ok
23:11:59.0230 3320  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\windows\system32\DRIVERS\mrxsmb.sys
23:11:59.0277 3320  mrxsmb - ok
23:11:59.0292 3320  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\windows\system32\DRIVERS\mrxsmb10.sys
23:11:59.0339 3320  mrxsmb10 - ok
23:11:59.0370 3320  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\windows\system32\DRIVERS\mrxsmb20.sys
23:11:59.0417 3320  mrxsmb20 - ok
23:11:59.0448 3320  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\windows\system32\drivers\msahci.sys
23:11:59.0480 3320  msahci - ok
23:11:59.0495 3320  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\windows\system32\drivers\msdsm.sys
23:11:59.0542 3320  msdsm - ok
23:11:59.0558 3320  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\windows\System32\msdtc.exe
23:11:59.0604 3320  MSDTC - ok
23:11:59.0636 3320  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\windows\system32\drivers\Msfs.sys
23:11:59.0729 3320  Msfs - ok
23:11:59.0745 3320  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\windows\System32\drivers\mshidkmdf.sys
23:11:59.0838 3320  mshidkmdf - ok
23:11:59.0854 3320  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\windows\system32\drivers\msisadrv.sys
23:11:59.0885 3320  msisadrv - ok
23:11:59.0901 3320  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\windows\system32\iscsiexe.dll
23:12:00.0010 3320  MSiSCSI - ok
23:12:00.0026 3320  msiserver - ok
23:12:00.0072 3320  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\windows\system32\drivers\MSKSSRV.sys
23:12:00.0166 3320  MSKSSRV - ok
23:12:00.0197 3320  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\windows\system32\drivers\MSPCLOCK.sys
23:12:00.0291 3320  MSPCLOCK - ok
23:12:00.0322 3320  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\windows\system32\drivers\MSPQM.sys
23:12:00.0416 3320  MSPQM - ok
23:12:00.0447 3320  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\windows\system32\drivers\MsRPC.sys
23:12:00.0494 3320  MsRPC - ok
23:12:00.0509 3320  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\windows\system32\DRIVERS\mssmbios.sys
23:12:00.0540 3320  mssmbios - ok
23:12:00.0572 3320  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\windows\system32\drivers\MSTEE.sys
23:12:00.0665 3320  MSTEE - ok
23:12:00.0696 3320  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\windows\system32\drivers\MTConfig.sys
23:12:00.0743 3320  MTConfig - ok
23:12:00.0759 3320  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\windows\system32\Drivers\mup.sys
23:12:00.0806 3320  Mup - ok
23:12:00.0837 3320  [ E3B58E3011B207C5289D11173B30E298 ] MyWiFiDHCPDNS  C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
23:12:00.0868 3320  MyWiFiDHCPDNS - ok
23:12:00.0915 3320  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\windows\system32\qagentRT.dll
23:12:01.0024 3320  napagent - ok
23:12:01.0055 3320  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\windows\system32\DRIVERS\nwifi.sys
23:12:01.0118 3320  NativeWifiP - ok
23:12:01.0164 3320  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\windows\system32\drivers\ndis.sys
23:12:01.0242 3320  NDIS - ok
23:12:01.0274 3320  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\windows\system32\DRIVERS\ndiscap.sys
23:12:01.0367 3320  NdisCap - ok
23:12:01.0398 3320  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\windows\system32\DRIVERS\ndistapi.sys
23:12:01.0492 3320  NdisTapi - ok
23:12:01.0523 3320  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\windows\system32\DRIVERS\ndisuio.sys
23:12:01.0617 3320  Ndisuio - ok
23:12:01.0617 3320  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\windows\system32\DRIVERS\ndiswan.sys
23:12:01.0726 3320  NdisWan - ok
23:12:01.0742 3320  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\windows\system32\drivers\NDProxy.sys
23:12:01.0851 3320  NDProxy - ok
23:12:01.0866 3320  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\windows\system32\DRIVERS\netbios.sys
23:12:01.0960 3320  NetBIOS - ok
23:12:01.0991 3320  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\windows\system32\DRIVERS\netbt.sys
23:12:02.0100 3320  NetBT - ok
23:12:02.0116 3320  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\windows\system32\lsass.exe
23:12:02.0163 3320  Netlogon - ok
23:12:02.0210 3320  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\windows\System32\netman.dll
23:12:02.0334 3320  Netman - ok
23:12:02.0350 3320  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\windows\System32\netprofm.dll
23:12:02.0459 3320  netprofm - ok
23:12:02.0490 3320  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
23:12:02.0522 3320  NetTcpPortSharing - ok
23:12:02.0834 3320  [ B51E9AD4F4E4F8DBE0AB882756BC5DAB ] NETwNs64        C:\windows\system32\DRIVERS\NETwNs64.sys
23:12:03.0239 3320  NETwNs64 - ok
23:12:03.0348 3320  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\windows\system32\drivers\nfrd960.sys
23:12:03.0380 3320  nfrd960 - ok
23:12:03.0426 3320  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\windows\System32\nlasvc.dll
23:12:03.0473 3320  NlaSvc - ok
23:12:03.0504 3320  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\windows\system32\drivers\Npfs.sys
23:12:03.0598 3320  Npfs - ok
23:12:03.0629 3320  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\windows\system32\nsisvc.dll
23:12:03.0738 3320  nsi - ok
23:12:03.0754 3320  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\windows\system32\drivers\nsiproxy.sys
23:12:03.0863 3320  nsiproxy - ok
23:12:03.0941 3320  [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs            C:\windows\system32\drivers\Ntfs.sys
23:12:04.0050 3320  Ntfs - ok
23:12:04.0082 3320  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\windows\system32\drivers\Null.sys
23:12:04.0175 3320  Null - ok
23:12:04.0206 3320  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\windows\system32\drivers\nvraid.sys
23:12:04.0253 3320  nvraid - ok
23:12:04.0269 3320  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\windows\system32\drivers\nvstor.sys
23:12:04.0300 3320  nvstor - ok
23:12:04.0316 3320  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\windows\system32\drivers\nv_agp.sys
23:12:04.0362 3320  nv_agp - ok
23:12:04.0378 3320  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\windows\system32\drivers\ohci1394.sys
23:12:04.0425 3320  ohci1394 - ok
23:12:04.0487 3320  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\windows\system32\pnrpsvc.dll
23:12:04.0534 3320  p2pimsvc - ok
23:12:04.0550 3320  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\windows\system32\p2psvc.dll
23:12:04.0612 3320  p2psvc - ok
23:12:04.0643 3320  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\windows\system32\drivers\parport.sys
23:12:04.0690 3320  Parport - ok
23:12:04.0721 3320  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\windows\system32\drivers\partmgr.sys
23:12:04.0752 3320  partmgr - ok
23:12:04.0784 3320  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\windows\System32\pcasvc.dll
23:12:04.0846 3320  PcaSvc - ok
23:12:04.0877 3320  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\windows\system32\drivers\pci.sys
23:12:04.0924 3320  pci - ok
23:12:04.0940 3320  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\windows\system32\drivers\pciide.sys
23:12:04.0971 3320  pciide - ok
23:12:05.0002 3320  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\windows\system32\drivers\pcmcia.sys
23:12:05.0049 3320  pcmcia - ok
23:12:05.0049 3320  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\windows\system32\drivers\pcw.sys
23:12:05.0096 3320  pcw - ok
23:12:05.0127 3320  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\windows\system32\drivers\peauth.sys
23:12:05.0236 3320  PEAUTH - ok
23:12:05.0283 3320  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\windows\SysWow64\perfhost.exe
23:12:05.0330 3320  PerfHost - ok
23:12:05.0423 3320  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\windows\system32\pla.dll
23:12:05.0564 3320  pla - ok
23:12:05.0595 3320  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\windows\system32\umpnpmgr.dll
23:12:05.0657 3320  PlugPlay - ok
23:12:05.0673 3320  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\windows\system32\pnrpauto.dll
23:12:05.0720 3320  PNRPAutoReg - ok
23:12:05.0735 3320  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\windows\system32\pnrpsvc.dll
23:12:05.0782 3320  PNRPsvc - ok
23:12:05.0829 3320  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\windows\System32\ipsecsvc.dll
23:12:05.0938 3320  PolicyAgent - ok
23:12:05.0985 3320  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\windows\system32\umpo.dll
23:12:06.0094 3320  Power - ok
23:12:06.0110 3320  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\windows\system32\DRIVERS\raspptp.sys
23:12:06.0219 3320  PptpMiniport - ok
23:12:06.0234 3320  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\windows\system32\drivers\processr.sys
23:12:06.0266 3320  Processor - ok
23:12:06.0312 3320  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\windows\system32\profsvc.dll
23:12:06.0359 3320  ProfSvc - ok
23:12:06.0375 3320  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\windows\system32\lsass.exe
23:12:06.0406 3320  ProtectedStorage - ok
23:12:06.0437 3320  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\windows\system32\DRIVERS\pacer.sys
23:12:06.0531 3320  Psched - ok
23:12:06.0609 3320  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\windows\system32\drivers\ql2300.sys
23:12:06.0718 3320  ql2300 - ok
23:12:06.0749 3320  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\windows\system32\drivers\ql40xx.sys
23:12:06.0780 3320  ql40xx - ok
23:12:06.0827 3320  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\windows\system32\qwave.dll
23:12:06.0890 3320  QWAVE - ok
23:12:06.0921 3320  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\windows\system32\drivers\qwavedrv.sys
23:12:06.0968 3320  QWAVEdrv - ok
23:12:06.0983 3320  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\windows\system32\DRIVERS\rasacd.sys
23:12:07.0077 3320  RasAcd - ok
23:12:07.0108 3320  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\windows\system32\DRIVERS\AgileVpn.sys
23:12:07.0202 3320  RasAgileVpn - ok
23:12:07.0248 3320  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\windows\System32\rasauto.dll
23:12:07.0342 3320  RasAuto - ok
23:12:07.0389 3320  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\windows\system32\DRIVERS\rasl2tp.sys
23:12:07.0482 3320  Rasl2tp - ok
23:12:07.0498 3320  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\windows\System32\rasmans.dll
23:12:07.0623 3320  RasMan - ok
23:12:07.0623 3320  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\windows\system32\DRIVERS\raspppoe.sys
23:12:07.0732 3320  RasPppoe - ok
23:12:07.0732 3320  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\windows\system32\DRIVERS\rassstp.sys
23:12:07.0841 3320  RasSstp - ok
23:12:07.0857 3320  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\windows\system32\DRIVERS\rdbss.sys
23:12:07.0966 3320  rdbss - ok
23:12:07.0982 3320  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\windows\system32\drivers\rdpbus.sys
23:12:08.0028 3320  rdpbus - ok
23:12:08.0028 3320  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\windows\system32\DRIVERS\RDPCDD.sys
23:12:08.0122 3320  RDPCDD - ok
23:12:08.0138 3320  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\windows\system32\drivers\rdpencdd.sys
23:12:08.0216 3320  RDPENCDD - ok
23:12:08.0231 3320  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\windows\system32\drivers\rdprefmp.sys
23:12:08.0325 3320  RDPREFMP - ok
23:12:08.0356 3320  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\windows\system32\drivers\RDPWD.sys
23:12:08.0403 3320  RDPWD - ok
23:12:08.0418 3320  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\windows\system32\drivers\rdyboost.sys
23:12:08.0450 3320  rdyboost - ok
23:12:08.0512 3320  [ F3AF2B43F35DBB3A0EB9FEEEC7D62217 ] RegSrvc        C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
23:12:08.0543 3320  RegSrvc - ok
23:12:08.0574 3320  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\windows\System32\mprdim.dll
23:12:08.0684 3320  RemoteAccess - ok
23:12:08.0715 3320  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\windows\system32\regsvc.dll
23:12:08.0824 3320  RemoteRegistry - ok
23:12:08.0840 3320  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\windows\system32\DRIVERS\rfcomm.sys
23:12:08.0902 3320  RFCOMM - ok
23:12:08.0918 3320  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\windows\System32\RpcEpMap.dll
23:12:09.0027 3320  RpcEptMapper - ok
23:12:09.0042 3320  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\windows\system32\locator.exe
23:12:09.0089 3320  RpcLocator - ok
23:12:09.0120 3320  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\windows\system32\rpcss.dll
23:12:09.0230 3320  RpcSs - ok
23:12:09.0261 3320  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\windows\system32\DRIVERS\rspndr.sys
23:12:09.0370 3320  rspndr - ok
23:12:09.0401 3320  [ 6CF9DB101A75360E98659F823852E540 ] RTL8167        C:\windows\system32\DRIVERS\Rt64win7.sys
23:12:09.0464 3320  RTL8167 - ok
23:12:09.0495 3320  [ 62DB6CC4B0818F1B5F3441241B098F12 ] SABI            C:\windows\system32\Drivers\SABI.sys
23:12:09.0526 3320  SABI - ok
23:12:09.0542 3320  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\windows\system32\lsass.exe
23:12:09.0573 3320  SamSs - ok
23:12:09.0620 3320  [ 5E66ABD041D76C46CBF55AEF910FCA56 ] SamsungDeviceConfigurationWinService C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe
23:12:09.0635 3320  SamsungDeviceConfigurationWinService - ok
23:12:09.0682 3320  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\windows\system32\drivers\sbp2port.sys
23:12:09.0713 3320  sbp2port - ok
23:12:09.0760 3320  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\windows\System32\SCardSvr.dll
23:12:09.0869 3320  SCardSvr - ok
23:12:09.0869 3320  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\windows\system32\DRIVERS\scfilter.sys
23:12:09.0963 3320  scfilter - ok
23:12:09.0994 3320  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\windows\system32\schedsvc.dll
23:12:10.0134 3320  Schedule - ok
23:12:10.0166 3320  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\windows\System32\certprop.dll
23:12:10.0275 3320  SCPolicySvc - ok
23:12:10.0306 3320  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\windows\System32\SDRSVC.dll
23:12:10.0353 3320  SDRSVC - ok
23:12:10.0384 3320  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\windows\system32\drivers\secdrv.sys
23:12:10.0493 3320  secdrv - ok
23:12:10.0524 3320  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\windows\system32\seclogon.dll
23:12:10.0634 3320  seclogon - ok
23:12:10.0649 3320  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\windows\System32\sens.dll
23:12:10.0758 3320  SENS - ok
23:12:10.0758 3320  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\windows\system32\sensrsvc.dll
23:12:10.0805 3320  SensrSvc - ok
23:12:10.0836 3320  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\windows\system32\drivers\serenum.sys
23:12:10.0868 3320  Serenum - ok
23:12:10.0899 3320  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\windows\system32\drivers\serial.sys
23:12:10.0946 3320  Serial - ok
23:12:10.0961 3320  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\windows\system32\drivers\sermouse.sys
23:12:11.0008 3320  sermouse - ok
23:12:11.0055 3320  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\windows\system32\sessenv.dll
23:12:11.0164 3320  SessionEnv - ok
23:12:11.0180 3320  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\windows\system32\drivers\sffdisk.sys
23:12:11.0226 3320  sffdisk - ok
23:12:11.0258 3320  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\windows\system32\drivers\sffp_mmc.sys
23:12:11.0304 3320  sffp_mmc - ok
23:12:11.0336 3320  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\windows\system32\drivers\sffp_sd.sys
23:12:11.0382 3320  sffp_sd - ok
23:12:11.0398 3320  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\windows\system32\drivers\sfloppy.sys
23:12:11.0445 3320  sfloppy - ok
23:12:11.0492 3320  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\windows\System32\ipnathlp.dll
23:12:11.0601 3320  SharedAccess - ok
23:12:11.0632 3320  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\windows\System32\shsvcs.dll
23:12:11.0741 3320  ShellHWDetection - ok
23:12:11.0772 3320  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\windows\system32\drivers\SiSRaid2.sys
23:12:11.0804 3320  SiSRaid2 - ok
23:12:11.0835 3320  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\windows\system32\drivers\sisraid4.sys
23:12:11.0882 3320  SiSRaid4 - ok
23:12:11.0928 3320  [ 7C15061CD0372487903B07B9BB03AFAD ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
23:12:11.0960 3320  SkypeUpdate - ok
23:12:11.0975 3320  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\windows\system32\DRIVERS\smb.sys
23:12:12.0084 3320  Smb - ok
23:12:12.0116 3320  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\windows\System32\snmptrap.exe
23:12:12.0162 3320  SNMPTRAP - ok
23:12:12.0194 3320  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\windows\system32\drivers\spldr.sys
23:12:12.0225 3320  spldr - ok
23:12:12.0272 3320  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\windows\System32\spoolsv.exe
23:12:12.0334 3320  Spooler - ok
23:12:12.0459 3320  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\windows\system32\sppsvc.exe
23:12:12.0677 3320  sppsvc - ok
23:12:12.0693 3320  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\windows\system32\sppuinotify.dll
23:12:12.0802 3320  sppuinotify - ok
23:12:12.0833 3320  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\windows\system32\DRIVERS\srv.sys
23:12:12.0896 3320  srv - ok
23:12:12.0911 3320  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\windows\system32\DRIVERS\srv2.sys
23:12:12.0958 3320  srv2 - ok
23:12:12.0974 3320  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\windows\system32\DRIVERS\srvnet.sys
23:12:13.0020 3320  srvnet - ok
23:12:13.0052 3320  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\windows\System32\ssdpsrv.dll
23:12:13.0161 3320  SSDPSRV - ok
23:12:13.0176 3320  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\windows\system32\sstpsvc.dll
23:12:13.0286 3320  SstpSvc - ok
23:12:13.0317 3320  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\windows\system32\drivers\stexstor.sys
23:12:13.0348 3320  stexstor - ok
23:12:13.0410 3320  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\windows\System32\wiaservc.dll
23:12:13.0488 3320  stisvc - ok
23:12:13.0520 3320  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\windows\system32\DRIVERS\swenum.sys
23:12:13.0551 3320  swenum - ok
23:12:13.0582 3320  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\windows\System32\swprv.dll
23:12:13.0707 3320  swprv - ok
23:12:13.0754 3320  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\windows\system32\sysmain.dll
23:12:13.0878 3320  SysMain - ok
23:12:13.0894 3320  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\windows\System32\TabSvc.dll
23:12:13.0956 3320  TabletInputService - ok
23:12:13.0972 3320  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\windows\System32\tapisrv.dll
23:12:14.0097 3320  TapiSrv - ok
23:12:14.0097 3320  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\windows\System32\tbssvc.dll
23:12:14.0206 3320  TBS - ok
23:12:14.0300 3320  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] Tcpip          C:\windows\system32\drivers\tcpip.sys
23:12:14.0409 3320  Tcpip - ok
23:12:14.0456 3320  [ 9849EA3843A2ADBDD1497E97A85D8CAE ] TCPIP6          C:\windows\system32\DRIVERS\tcpip.sys
23:12:14.0580 3320  TCPIP6 - ok
23:12:14.0612 3320  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\windows\system32\drivers\tcpipreg.sys
23:12:14.0643 3320  tcpipreg - ok
23:12:14.0690 3320  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\windows\system32\drivers\tdpipe.sys
23:12:14.0721 3320  TDPIPE - ok
23:12:14.0768 3320  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\windows\system32\drivers\tdtcp.sys
23:12:14.0799 3320  TDTCP - ok
23:12:14.0830 3320  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\windows\system32\DRIVERS\tdx.sys
23:12:14.0924 3320  tdx - ok
23:12:14.0939 3320  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\windows\system32\DRIVERS\termdd.sys
23:12:14.0986 3320  TermDD - ok
23:12:15.0033 3320  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\windows\System32\termsrv.dll
23:12:15.0158 3320  TermService - ok
23:12:15.0158 3320  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\windows\system32\themeservice.dll
23:12:15.0220 3320  Themes - ok
23:12:15.0236 3320  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\windows\system32\mmcss.dll
23:12:15.0345 3320  THREADORDER - ok
23:12:15.0376 3320  [ DBCC20C02E8A3E43B03C304A4E40A84F ] TPM            C:\windows\system32\drivers\tpm.sys
23:12:15.0407 3320  TPM - ok
23:12:15.0454 3320  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\windows\System32\trkwks.dll
23:12:15.0563 3320  TrkWks - ok
23:12:15.0594 3320  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
23:12:15.0704 3320  TrustedInstaller - ok
23:12:15.0719 3320  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\windows\system32\DRIVERS\tssecsrv.sys
23:12:15.0813 3320  tssecsrv - ok
23:12:15.0828 3320  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\windows\system32\drivers\tsusbflt.sys
23:12:15.0875 3320  TsUsbFlt - ok
23:12:15.0906 3320  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD        C:\windows\system32\drivers\TsUsbGD.sys
23:12:15.0938 3320  TsUsbGD - ok
23:12:15.0969 3320  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\windows\system32\DRIVERS\tunnel.sys
23:12:16.0062 3320  tunnel - ok
23:12:16.0078 3320  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\windows\system32\drivers\uagp35.sys
23:12:16.0109 3320  uagp35 - ok
23:12:16.0140 3320  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\windows\system32\DRIVERS\udfs.sys
23:12:16.0250 3320  udfs - ok
23:12:16.0296 3320  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\windows\system32\UI0Detect.exe
23:12:16.0343 3320  UI0Detect - ok
23:12:16.0359 3320  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\windows\system32\drivers\uliagpkx.sys
23:12:16.0390 3320  uliagpkx - ok
23:12:16.0421 3320  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\windows\system32\DRIVERS\umbus.sys
23:12:16.0452 3320  umbus - ok
23:12:16.0484 3320  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\windows\system32\drivers\umpass.sys
23:12:16.0530 3320  UmPass - ok
23:12:16.0562 3320  [ D80B1075B69B57A3AB78F750CE463ECE ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
23:12:16.0608 3320  UNS - ok
23:12:16.0624 3320  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\windows\System32\upnphost.dll
23:12:16.0733 3320  upnphost - ok
23:12:16.0780 3320  [ C9E9D59C0099A9FF51697E9306A44240 ] USBAAPL64      C:\windows\system32\Drivers\usbaapl64.sys
23:12:16.0811 3320  USBAAPL64 - ok
23:12:16.0842 3320  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\windows\system32\DRIVERS\usbccgp.sys
23:12:16.0889 3320  usbccgp - ok
23:12:16.0905 3320  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\windows\system32\drivers\usbcir.sys
23:12:16.0952 3320  usbcir - ok
23:12:16.0983 3320  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\windows\system32\drivers\usbehci.sys
23:12:17.0014 3320  usbehci - ok
23:12:17.0030 3320  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\windows\system32\DRIVERS\usbhub.sys
23:12:17.0092 3320  usbhub - ok
23:12:17.0108 3320  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\windows\system32\drivers\usbohci.sys
23:12:17.0154 3320  usbohci - ok
23:12:17.0186 3320  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\windows\system32\DRIVERS\usbprint.sys
23:12:17.0232 3320  usbprint - ok
23:12:17.0264 3320  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\windows\system32\DRIVERS\usbscan.sys
23:12:17.0310 3320  usbscan - ok
23:12:17.0342 3320  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\windows\system32\DRIVERS\USBSTOR.SYS
23:12:17.0388 3320  USBSTOR - ok
23:12:17.0404 3320  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\windows\system32\drivers\usbuhci.sys
23:12:17.0451 3320  usbuhci - ok
23:12:17.0466 3320  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\windows\system32\Drivers\usbvideo.sys
23:12:17.0513 3320  usbvideo - ok
23:12:17.0544 3320  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\windows\System32\uxsms.dll
23:12:17.0654 3320  UxSms - ok
23:12:17.0669 3320  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\windows\system32\lsass.exe
23:12:17.0700 3320  VaultSvc - ok
23:12:17.0732 3320  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\windows\system32\drivers\vdrvroot.sys
23:12:17.0763 3320  vdrvroot - ok
23:12:17.0794 3320  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\windows\System32\vds.exe
23:12:17.0919 3320  vds - ok
23:12:17.0934 3320  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\windows\system32\DRIVERS\vgapnp.sys
23:12:17.0981 3320  vga - ok
23:12:18.0012 3320  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\windows\System32\drivers\vga.sys
23:12:18.0106 3320  VgaSave - ok
23:12:18.0137 3320  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\windows\system32\drivers\vhdmp.sys
23:12:18.0184 3320  vhdmp - ok
23:12:18.0200 3320  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\windows\system32\drivers\viaide.sys
23:12:18.0231 3320  viaide - ok
23:12:18.0262 3320  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\windows\system32\drivers\volmgr.sys
23:12:18.0293 3320  volmgr - ok
23:12:18.0309 3320  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\windows\system32\drivers\volmgrx.sys
23:12:18.0356 3320  volmgrx - ok
23:12:18.0387 3320  [ DF8126BD41180351A093A3AD2FC8903B ] volsnap        C:\windows\system32\drivers\volsnap.sys
23:12:18.0434 3320  volsnap - ok
23:12:18.0449 3320  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\windows\system32\drivers\vsmraid.sys
23:12:18.0496 3320  vsmraid - ok
23:12:18.0574 3320  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\windows\system32\vssvc.exe
23:12:18.0714 3320  VSS - ok
23:12:18.0746 3320  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\windows\system32\DRIVERS\vwifibus.sys
23:12:18.0777 3320  vwifibus - ok
23:12:18.0808 3320  [ 13A0DECD1794DE60A8427862C8669D27 ] VWiFiFlt        C:\windows\system32\DRIVERS\vwififlt.sys
23:12:18.0855 3320  VWiFiFlt - ok
23:12:18.0870 3320  [ 49003B357D101CDC474937437ECF5ABC ] vwifimp        C:\windows\system32\DRIVERS\vwifimp.sys
23:12:18.0902 3320  vwifimp - ok
23:12:18.0948 3320  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\windows\system32\w32time.dll
23:12:19.0073 3320  W32Time - ok
23:12:19.0104 3320  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\windows\system32\drivers\wacompen.sys
23:12:19.0151 3320  WacomPen - ok
23:12:19.0167 3320  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\windows\system32\DRIVERS\wanarp.sys
23:12:19.0260 3320  WANARP - ok
23:12:19.0276 3320  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\windows\system32\DRIVERS\wanarp.sys
23:12:19.0370 3320  Wanarpv6 - ok
23:12:19.0448 3320  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\windows\system32\wbengine.exe
23:12:19.0541 3320  wbengine - ok
23:12:19.0557 3320  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\windows\System32\wbiosrvc.dll
23:12:19.0619 3320  WbioSrvc - ok
23:12:19.0635 3320  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\windows\System32\wcncsvc.dll
23:12:19.0713 3320  wcncsvc - ok
23:12:19.0728 3320  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
23:12:19.0775 3320  WcsPlugInService - ok
23:12:19.0806 3320  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\windows\system32\drivers\wd.sys
23:12:19.0838 3320  Wd - ok
23:12:19.0884 3320  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\windows\system32\drivers\Wdf01000.sys
23:12:19.0962 3320  Wdf01000 - ok
23:12:19.0994 3320  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\windows\system32\wdi.dll
23:12:20.0056 3320  WdiServiceHost - ok
23:12:20.0072 3320  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\windows\system32\wdi.dll
23:12:20.0134 3320  WdiSystemHost - ok
23:12:20.0150 3320  [ 63CE387483E74A0BD79EE4E5EBA1FD2E ] wdkmd          C:\windows\system32\DRIVERS\WDKMD.sys
23:12:20.0181 3320  wdkmd - ok
23:12:20.0196 3320  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\windows\System32\webclnt.dll
23:12:20.0274 3320  WebClient - ok
23:12:20.0306 3320  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\windows\system32\wecsvc.dll
23:12:20.0430 3320  Wecsvc - ok
23:12:20.0430 3320  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\windows\System32\wercplsupport.dll
23:12:20.0540 3320  wercplsupport - ok
23:12:20.0555 3320  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\windows\System32\WerSvc.dll
23:12:20.0664 3320  WerSvc - ok
23:12:20.0680 3320  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\windows\system32\DRIVERS\wfplwf.sys
23:12:20.0774 3320  WfpLwf - ok
23:12:20.0805 3320  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\windows\system32\drivers\wimmount.sys
23:12:20.0836 3320  WIMMount - ok
23:12:20.0867 3320  WinDefend - ok
23:12:20.0883 3320  WinHttpAutoProxySvc - ok
23:12:20.0945 3320  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\windows\system32\wbem\WMIsvc.dll
23:12:21.0054 3320  Winmgmt - ok
23:12:21.0117 3320  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\windows\system32\WsmSvc.dll
23:12:21.0288 3320  WinRM - ok
23:12:21.0351 3320  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\windows\system32\DRIVERS\WinUsb.sys
23:12:21.0398 3320  WinUsb - ok
23:12:21.0460 3320  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\windows\System32\wlansvc.dll
23:12:21.0554 3320  Wlansvc - ok
23:12:21.0600 3320  [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
23:12:21.0632 3320  wlcrasvc - ok
23:12:21.0741 3320  [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
23:12:21.0866 3320  wlidsvc - ok
23:12:21.0881 3320  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\windows\system32\DRIVERS\wmiacpi.sys
23:12:21.0928 3320  WmiAcpi - ok
23:12:21.0959 3320  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\windows\system32\wbem\WmiApSrv.exe
23:12:22.0006 3320  wmiApSrv - ok
23:12:22.0037 3320  WMPNetworkSvc - ok
23:12:22.0053 3320  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\windows\System32\wpcsvc.dll
23:12:22.0100 3320  WPCSvc - ok
23:12:22.0115 3320  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\windows\system32\wpdbusenum.dll
23:12:22.0162 3320  WPDBusEnum - ok
23:12:22.0178 3320  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\windows\system32\drivers\ws2ifsl.sys
23:12:22.0287 3320  ws2ifsl - ok
23:12:22.0287 3320  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\windows\System32\wscsvc.dll
23:12:22.0349 3320  wscsvc - ok
23:12:22.0365 3320  WSearch - ok
23:12:22.0474 3320  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\windows\system32\wuaueng.dll
23:12:22.0630 3320  wuauserv - ok
23:12:22.0646 3320  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\windows\system32\drivers\WudfPf.sys
23:12:22.0692 3320  WudfPf - ok
23:12:22.0708 3320  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\windows\system32\DRIVERS\WUDFRd.sys
23:12:22.0755 3320  WUDFRd - ok
23:12:22.0770 3320  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\windows\System32\WUDFSvc.dll
23:12:22.0833 3320  wudfsvc - ok
23:12:22.0848 3320  [ FE90B750AB808FB9DD8FBB428B5FF83B ] WwanSvc        C:\windows\System32\wwansvc.dll
23:12:22.0911 3320  WwanSvc - ok
23:12:22.0973 3320  [ 74713CB32792F9C7632DAA7DA22CA974 ] ZeroConfigService C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
23:12:23.0020 3320  ZeroConfigService - ok
23:12:23.0051 3320  ================ Scan global ===============================
23:12:23.0082 3320  [ BA0CD8C393E8C9F83354106093832C7B ] C:\windows\system32\basesrv.dll
23:12:23.0098 3320  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
23:12:23.0114 3320  [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\windows\system32\winsrv.dll
23:12:23.0160 3320  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\windows\system32\sxssrv.dll
23:12:23.0192 3320  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\windows\system32\services.exe
23:12:23.0207 3320  [Global] - ok
23:12:23.0207 3320  ================ Scan MBR ==================================
23:12:23.0223 3320  [ 2E5DEBB2116B3417023E0D6562D7ED07 ] \Device\Harddisk0\DR0
23:12:23.0956 3320  \Device\Harddisk0\DR0 - ok
23:12:23.0956 3320  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR1
23:12:24.0081 3320  \Device\Harddisk1\DR1 - ok
23:12:24.0096 3320  ================ Scan VBR ==================================
23:12:24.0096 3320  [ 38E2A56FD10D08026184104A958F9E39 ] \Device\Harddisk0\DR0\Partition1
23:12:24.0096 3320  \Device\Harddisk0\DR0\Partition1 - ok
23:12:24.0128 3320  [ EF125E1AC987379B7E67C758BE5D8771 ] \Device\Harddisk0\DR0\Partition2
23:12:24.0128 3320  \Device\Harddisk0\DR0\Partition2 - ok
23:12:24.0143 3320  ============================================================
23:12:24.0143 3320  Scan finished
23:12:24.0143 3320  ============================================================
23:12:24.0159 5732  Detected object count: 0
23:12:24.0159 5732  Actual detected object count: 0
23:13:48.0316 4536  Deinitialize success

markusg 10.07.2013 22:41
Hiho,
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

fräuleindoof 10.07.2013 23:06
Da isses. :)

Code:
ComboFix 13-07-09.01 - Sophie 10.07.2013  23:48:57.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3876.1228 [GMT 2:00]
ausgeführt von:: c:\users\Sophie\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-06-10 bis 2013-07-10  ))))))))))))))))))))))))))))))
.
.
2013-07-10 21:59 . 2013-07-10 21:59        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-07-10 18:15 . 2013-07-10 21:55        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{73A76046-1102-47CA-A4AB-5861F4DD92CA}\offreg.dll
2013-07-10 13:33 . 2013-07-10 13:33        98        ----a-w-        c:\windows\DeleteOnReboot.bat
2013-07-10 12:10 . 2013-07-10 12:25        378944        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2013-07-10 12:10 . 2013-05-09 08:59        33400        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2013-07-10 12:10 . 2013-05-09 08:59        72016        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys
2013-07-10 12:10 . 2013-05-09 08:59        64288        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2013-07-10 12:10 . 2013-07-10 12:25        1030952        ----a-w-        c:\windows\system32\drivers\aswSnx.sys
2013-07-10 12:10 . 2013-07-10 12:25        189936        ----a-w-        c:\windows\system32\drivers\aswVmm.sys
2013-07-10 12:10 . 2013-05-09 08:59        65336        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys
2013-07-10 12:10 . 2013-05-09 08:59        80816        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys
2013-07-10 12:10 . 2013-05-09 08:58        287840        ----a-w-        c:\windows\system32\aswBoot.exe
2013-07-10 12:08 . 2013-05-09 08:58        41664        ----a-w-        c:\windows\avastSS.scr
2013-07-10 12:08 . 2013-06-12 03:08        9552976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{73A76046-1102-47CA-A4AB-5861F4DD92CA}\mpengine.dll
2013-07-10 12:08 . 2013-07-10 12:08        --------        d-----w-        c:\program files\AVAST Software
2013-07-10 12:07 . 2013-05-27 05:50        1011712        ----a-w-        c:\program files\Windows Defender\MpSvc.dll
2013-07-10 12:07 . 2013-05-27 05:50        571904        ----a-w-        c:\program files\Windows Defender\MpClient.dll
2013-07-10 12:07 . 2013-05-27 05:50        314880        ----a-w-        c:\program files\Windows Defender\MpCommu.dll
2013-07-10 12:07 . 2013-05-27 04:57        4608        ----a-w-        c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-10 12:07 . 2013-05-27 04:57        54784        ----a-w-        c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-10 12:07 . 2013-05-27 04:57        392704        ----a-w-        c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-10 12:07 . 2013-05-27 03:15        9216        ----a-w-        c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-10 12:07 . 2013-06-04 06:00        624128        ----a-w-        c:\windows\system32\qedit.dll
2013-07-10 12:07 . 2013-06-04 04:53        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
2013-07-10 12:07 . 2013-05-06 06:03        1887744        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2013-07-10 12:07 . 2013-05-06 04:56        1620480        ----a-w-        c:\windows\SysWow64\WMVDECOD.DLL
2013-07-10 12:07 . 2013-06-05 03:34        3153920        ----a-w-        c:\windows\system32\win32k.sys
2013-07-10 12:06 . 2013-04-10 05:48        1732608        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2013-07-10 12:06 . 2013-04-10 05:46        1402880        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2013-07-10 12:06 . 2013-04-10 05:46        1393152        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2013-07-10 12:06 . 2013-04-10 05:46        1367040        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 12:06 . 2013-04-10 05:03        936448        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 12:06 . 2013-07-10 12:08        --------        d-----w-        c:\programdata\AVAST Software
2013-07-10 12:06 . 2013-04-02 22:51        1643520        ----a-w-        c:\windows\system32\DWrite.dll
2013-07-10 12:06 . 2013-04-09 23:34        1247744        ----a-w-        c:\windows\SysWow64\DWrite.dll
2013-07-04 10:06 . 2013-07-04 10:06        --------        d-----w-        c:\users\Sophie\AppData\Roaming\TuneUp Software
2013-07-04 10:06 . 2013-07-04 10:06        --------        d-----w-        c:\programdata\TuneUp Software
2013-07-04 10:05 . 2013-07-04 10:05        --------        d-sh--w-        c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-07-04 10:05 . 2013-07-04 10:05        --------        d--h--w-        c:\programdata\Common Files
2013-07-04 10:05 . 2013-07-04 10:05        --------        d-----w-        c:\program files (x86)\DVDVideoSoft
2013-07-04 10:00 . 2013-07-04 10:00        --------        d-----w-        c:\windows\SysWow64\Extensions
2013-07-04 10:00 . 2013-07-04 10:00        --------        d-----w-        c:\windows\SysWow64\searchplugins
2013-07-04 10:00 . 2013-07-04 10:00        --------        d-----w-        c:\programdata\BrowserDefender
2013-07-04 09:59 . 2013-07-04 10:05        --------        d-----w-        c:\program files (x86)\Common Files\DVDVideoSoft
2013-07-04 09:59 . 2013-07-04 10:06        --------        d-----w-        c:\users\Sophie\AppData\Roaming\DVDVideoSoft
2013-06-12 08:18 . 2013-05-08 06:39        1910632        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2013-06-12 08:18 . 2013-04-17 07:02        1230336        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll
2013-06-12 08:18 . 2013-04-17 06:24        1424384        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2013-06-12 08:18 . 2013-05-10 05:49        30720        ----a-w-        c:\windows\system32\cryptdlg.dll
2013-06-12 08:18 . 2013-05-10 03:20        24576        ----a-w-        c:\windows\SysWow64\cryptdlg.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-11 23:51 . 2013-03-16 09:49        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-11 23:51 . 2013-03-16 09:49        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-14 15:43 . 2011-03-28 09:36        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-02 00:06 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-13 05:49 . 2013-05-15 06:02        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 06:02        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 06:02        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 06:02        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 06:02        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 06:02        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 12:10        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Spotify Web Helper"="c:\users\Sophie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-07-10 1104384]
"Spotify"="c:\users\Sophie\AppData\Roaming\Spotify\Spotify.exe" [2013-07-10 4640768]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-04 291608]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
.
c:\users\Sophie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"DelayedDesktopSwitchTimeout"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~3\BROWSE~1\261339~1.144\{C16C1~1\BrowserDefender.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 excsd;ExpressCache Storage Filter Driver;c:\windows\system32\DRIVERS\excsd.sys;c:\windows\SYSNATIVE\DRIVERS\excsd.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 excfs;ExpressCache File System Filter Driver;c:\windows\system32\DRIVERS\excfs.sys;c:\windows\SYSNATIVE\DRIVERS\excfs.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 ExpressCache;ExpressCache;c:\program files\Diskeeper Corporation\ExpressCache\ExpressCache.exe;c:\program files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 irstrtsv;Intel(R) Rapid Start Technology Service;c:\windows\SysWOW64\irstrtsv.exe;c:\windows\SysWOW64\irstrtsv.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 SamsungDeviceConfigurationWinService;SamsungDeviceConfiguration;c:\program files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe;c:\program files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 ibtfltcoex;ibtfltcoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 irstrtdv;Intel(R) Rapid Start Technology Driver;c:\windows\system32\DRIVERS\irstrtdv.sys;c:\windows\SYSNATIVE\DRIVERS\irstrtdv.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 65937933
*Deregistered* - 65937933
*Deregistered* - uxldapod
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-06-19 06:34        1165776        ----a-w-        c:\program files (x86)\Google\Chrome\Application\27.0.1453.116\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-16 23:51]
.
2013-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-04 13:36]
.
2013-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-04 13:36]
.
2013-07-10 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 04:41]
.
2013-07-10 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 04:41]
.
2013-07-10 c:\windows\Tasks\Xerox PhotoCafe Communicator.job
- c:\programdata\Xerox PhotoCafe\MessageCheck.exe [2011-10-26 09:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58        133840        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36        164016        ----a-w-        c:\users\Sophie\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36        164016        ----a-w-        c:\users\Sophie\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36        164016        ----a-w-        c:\users\Sophie\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36        164016        ----a-w-        c:\users\Sophie\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-04-24 12480616]
"BLEServicesCtrl"="c:\program files (x86)\Intel\Bluetooth\BleServicesCtrl.exe" [2012-02-17 177936]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2012-02-21 11406608]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-11 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-11 398104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-11 440600]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=c1ac0edd-022e-4667-ab0c-cc0bb0546f5e&searchtype=hp&installDate=04/07/2013
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=c1ac0edd-022e-4667-ab0c-cc0bb0546f5e&searchtype=ds&q={searchTerms}&installDate=04/07/2013
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-11  00:04:58
ComboFix-quarantined-files.txt  2013-07-10 22:04
.
Vor Suchlauf: 7 Verzeichnis(se), 408.749.158.400 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 408.492.204.032 Bytes frei
.
- - End Of File - - B96075DB971ED4EC5BE4C6C219D5E95E
D41D8CD98F00B204E9800998ECF8427E

markusg 10.07.2013 23:10
Hi,
es folgen jetzt 2 Arbeitsschritte, poste bitte beide Logs gleichzeitig.
Schritt 2 benötigt die Mitarbeit der Bewohnerin, den kann man während schritt 1 läuft ausführen.
1.
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.
Neustarten.

2.

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

fräuleindoof 10.07.2013 23:20
Okay, an der Stelle muss ich erstmal warten, bis sie hier ist. Sie ist im Moment noch arbeiten. Bin gespannt wann sie kommt. Würde dann mit Schritt 1 auch noch warten, bin mir aber noch nicht ganz sicher, ob ich Schritt 2 hinkriege, klingt vielleicht aber auch schwieriger als es ist...^^
Aber sollte es Probleme geben, melde ich mich einfach nochmal mit einer konkreten Frage. ;)
Danke erstmal bis hierhin. :)
Kann ich Schritt 1 trotzdem jetzt schon durchführen? Oder ist es unbedingt notwendig, es zeitnah zu Schritt 2 zu machen?

markusg 10.07.2013 23:39
kannst du, wollte damit nur sagen, dass während schritt1 läuft man auch schon schritt2 bearbeiten kann, ob du das so machst oder nicht, ist dir überlassen :-)

fräuleindoof 11.07.2013 11:13
soooo. :)

Malwarebytes hat keine infizierten Objekte gefunden, deshalb ist es ja eigentlich auch unnötig, das hier zu posten, aber ich mach es jetzt zur Sicherheit trotzdem. ;)

Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.07.10.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Sophie :: EDDIE [Administrator]

Schutz: Aktiviert

11.07.2013 01:05:14
mbam-log-2013-07-11 (01-05-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 372897
Laufzeit: 1 Stunde(n), 1 Minute(n), 42 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)



und hier die Uninstall-Liste. ;)

Code:
Absolute Reminder        Absolute Software        30.06.2012        990KB        2.0.0.17                                              unbekannt
Adobe Flash Player 11 ActiveX        Adobe Systems Incorporated        12.06.2013        6,00MB        11.7.700.224                          notwendig
Adobe Reader XI (11.0.03) - Deutsch        Adobe Systems Incorporated        21.05.2013        134MB        11.0.03                      notwendig
Apple Application Support        Apple Inc.        18.04.2013        62,7MB        2.3.3                                                notwendig
Apple Mobile Device Support        Apple Inc.        18.04.2013        25,2MB        6.1.0.13                                              notwendig
Apple Software Update        Apple Inc.        18.04.2013        2,38MB        2.1.3.127                                                    notwendig
avast! Free Antivirus        AVAST Software        10.07.2013                8.0.1489.0                                                    notwendig
Bonjour        Apple Inc.        18.04.2013        2,00MB        3.0.0.10                                                                      notwendig
Canon MG5100 series MP Drivers                06.12.2012                                                                              notwendig
CCleaner        Piriform        19.06.2013                4.03                                                                  IST KLAR
CyberLink YouCam        CyberLink Corp.        30.06.2012        136MB        3.1.5016                                                      notwendig
DAEMON Tools Lite        DT Soft Ltd        27.12.2012                4.46.1.0327                                                  unnötig
Dropbox        Dropbox, Inc.        04.07.2013                2.0.22                                                                        notwendig
E-POP        Samsung Electronics CO., LTD.        30.06.2012                1.0.1                                                        notwendig
Easy File Share        Samsung Electronics CO., LTD.        30.06.2012        29,3MB        1.2.4                                                notwendig
Easy Migration        Samsung Electronics CO., LTD.        30.06.2012                1.0                                                  notwendig
Easy Settings        Samsung Electronics CO., LTD.        30.06.2012                1.1                                                  notwendig
Easy Software Manager        Samsung Electronics CO., LTD.        30.06.2012                1.2.17.12                                    notwendig
Easy Support Center        Samsung Electronics CO., LTD.        30.06.2012        86,0MB        1.2.23                                        notwendig
ETDWare PS/2-X64 10.7.13.1_WHQL        ELAN Microelectronic Corp.        30.06.2012                10.7.13.1                            unbekannt
ExpressCache        Diskeeper Corporation        30.06.2012        7,65MB        1.0.86                                                        unbekannt
Free YouTube to MP3 Converter version 3.12.5.628        DVDVideoSoft Ltd.        04.07.2013        82,0MB        3.12.5.628            unnötig
Google Chrome        Google Inc.        04.12.2012                27.0.1453.116                                                        notwendig
Intel(R) Manageability Engine Firmware Recovery Agent        Intel Corporation        30.06.2012        54,8MB        1.0.0.35342          notwendig
Intel(R) Management Engine Components        Intel Corporation        30.06.2012                8.0.2.1410                            notwendig
Intel(R) OpenCL CPU Runtime        Intel Corporation        30.06.2012                                                              notwendig
Intel(R) Processor Graphics        Intel Corporation        30.06.2012                8.15.10.2618                                  notwendig
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed        Intel Corporation        30.06.2012        5,30MB        15.0.0.0059  notwendig
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology        Intel Corporation        30.06.2012        108MB        2.1.0.0140    notwendig
Intel(R) Rapid Start Technology        Intel Corporation        30.06.2012                1.0.0.1021                                    notwendig
Intel(R) Rapid Storage Technology        Intel Corporation        11.07.2013                11.0.0.1032                          notwendig
Intel(R) USB 3.0 eXtensible Host Controller Driver        Intel Corporation        30.06.2012                1.0.1.209            notwendig
Intel(R) WiDi        Intel Corporation        30.06.2012        143MB        3.0.12.0                                                      notwendig
Intel® PROSet/Wireless WiFi Software        Intel Corporation        30.06.2012        125MB        15.00.0000.0642                      notwendig
Intel® Trusted Connect Service Client        Intel Corporation        30.06.2012        10,6MB        1.23.605.1                            notwendig
iTunes        Apple Inc.        18.04.2013        187MB        11.0.2.26                                                                    notwendig
Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        07.12.2012        38,8MB        4.0.30319                      notwendig
Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        07.12.2012        2,93MB        4.0.30319      notwendig
Microsoft Office        Microsoft Corporation        30.06.2012        6,26MB        14.0.6120.5004                                          notwendig
Microsoft Silverlight        Microsoft Corporation        30.06.2012        20,4MB        4.0.50401.0                                            notwendig
Microsoft SQL Server 2005 Compact Edition [ENU]        Microsoft Corporation        30.06.2012        1,69MB        3.1.0000                        notwendig
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        30.06.2012        428KB        8.0.56336                      notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17        Microsoft Corporation        30.06.2012        788KB        9.0.30729      notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148        Microsoft Corporation        30.06.2012        784KB        9.0.30729.4148  notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161        Microsoft Corporation        04.12.2012        786KB        9.0.30729.6161  notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        30.06.2012        596KB        9.0.30729      notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        30.06.2012        592KB        9.0.30729.4148  notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        04.12.2012        598KB        9.0.30729.6161  notwendig
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319        Microsoft Corporation        30.06.2012        13,6MB        10.0.30319      notwendig
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        08.06.2013        11,1MB        10.0.40219      notwendig
Multimedia POP        Samsung Electronics CO., LTD.        30.06.2012                1.2                                                    notwendig
OpenOffice.org 3.4.1        Apache Software Foundation        04.12.2012        331MB        3.41.9593                                      notwendig
Realtek Ethernet Controller Driver        Realtek        30.06.2012                7.50.1123.2011                                          unbekannt
Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        30.06.2012                6.0.1.6622                      unbekannt
Samsung Recovery Solution 5        Samsung Electronics CO., LTD.        30.06.2012                5.0.2.6                                notwendig
Skype™ 6.3        Skype Technologies S.A.        20.05.2013        20,9MB        6.3.105                                                        notwendig
Snap.Do Engine        ReSoft Ltd.        04.07.2013                1.20.1.10742                                                            unnötig
Software Launcher        Samsung Electronics CO., LTD.        30.06.2012        7,34MB        1.0.2                                          notwendig
Spotify        Spotify AB        10.07.2013                0.9.1.57.ge7405149                                                              notwendig
User Guide        Samsung Electronics CO., LTD.        30.06.2012                1.6                                                    notwendig
WildTangent Games        WildTangent        30.06.2012                1.0.1.5                                                        unnötig
Windows Live 程式集        Microsoft Corporation        30.06.2012                15.4.3538.0513                                          unbekannt
WinRAR 4.20 (64-Bit)        win.rar GmbH        27.12.2012                4.20.0                                                          notwendig
Xerox PhotoCafe        Xerox        30.06.2012        40,0MB        1.0.0.6162                                                                      notwendig

markusg 11.07.2013 11:57
HI,
es sind 2 Logs zu erstellen, poste diese möglichst gleichzeitig.
1.
bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
Sicherheit (erweitert)
Erweiterte Sicherheit anhaken
und alle Dateien auswählen.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
DAEMON
Free YouTube
Snap
Wenn die Deinstalation nicht klappt, nutze Rewo:
Revo Uninstaller - Download - Filepony
WildTangent


Öffne bitte CCleaner, analysieren, starten, PC neustarten.
2.
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

neustarten.
3.
HitmanPro - Download - Filepony
Lade Hitmanpro, doppelklicken, Scan klicken.
Nichts löschen, weiter klicken.
Log speichern und posten, bzw als XML exportieren, packen und anhängen.

fräuleindoof 11.07.2013 21:07
adw...

Code:
# AdwCleaner v2.305 - Datei am 11/07/2013 um 21:47:36 erstellt
# Aktualisiert am 11/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Sophie - EDDIE
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Sophie\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\BrowserDefender

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v27.0.1453.116

Datei : C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.2228] : homepage = "hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=4CA7C4850851E0A1&affID=121563&tsp=4[...]
Gelöscht [l.2750] : urls_to_restore_on_startup = [ "hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=4CA7C4850851[...]

*************************

AdwCleaner[R1].txt - [7235 octets] - [10/07/2013 14:16:40]
AdwCleaner[R2].txt - [7295 octets] - [10/07/2013 14:21:02]
AdwCleaner[S1].txt - [382 octets] - [10/07/2013 14:21:28]
AdwCleaner[S2].txt - [7113 octets] - [10/07/2013 15:33:10]
AdwCleaner[S3].txt - [1898 octets] - [11/07/2013 21:47:36]

########## EOF - C:\AdwCleaner[S3].txt - [1958 octets] ##########

hitmanpro

Code:

       
Code:

       
HitmanPro 3.7.6.201
www.hitmanpro.com

   Computer name . . . . : EDDIE
   Windows . . . . . . . : 6.1.1.7601.X64/4
   User name . . . . . . : Eddie\Sophie
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-07-11 21:57:46
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 4m 18s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 27

   Objects scanned . . . : 1.397.361
   Files scanned . . . . : 18.461
   Remnants scanned  . . : 291.862 files / 1.087.038 keys

Potential Unwanted Programs _________________________________________________

   HKU\S-1-5-21-3300620865-1981299825-1167858846-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{4D2D3B0F-69BE-477A-90F5-FDDB05357975} (Claro)

Cookies _____________________________________________________________________

   C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
   C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
   C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net


wusste nicht wie ich das so komisch verpacke oder was auch immer^^
hoffe, das geht so... ;)

markusg 11.07.2013 21:08
hi, lösche alle Hitmanpro Funde, starte neu und poste bitte ein frisches OTL Log.

fräuleindoof 11.07.2013 21:12
hey...entschuldige, aber mein Name entspricht tatsächlich meinem Wissensstand. :D
Wie soll ich die löschen? Welche Funde und überhaupt? Kannst du das etwas genauer erklären? Stehe gerade aufm Schlauch...

Also...nochmal zum Verständnis. Das Ding hat schon versucht die Sachen zu löschen als ich auf Weiter geklickt habe, ist aber nur bei einem geglückt, bei den anderen nicht...

markusg 11.07.2013 21:35
Versuchs noch mal, schließe bitte aber diesmal alle offenen Browser :-)
du hast es schon richtig gemacht, das Problem waren aber geöffnete Browser Prozesse.

fräuleindoof 11.07.2013 22:03
Okay, diesmal wurde alles gelöscht, hehe. :)
Hier jetzt die OTL logs

Code:
OTL logfile created on: 11.07.2013 22:51:58 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Sophie\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,78 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 59,48% Memory free
7,57 Gb Paging File | 6,00 Gb Available in Paging File | 79,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 443,13 Gb Total Space | 381,31 Gb Free Space | 86,05% Space Free | Partition Type: NTFS
 
Computer Name: EDDIE | User Name: Sophie | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.07.10 13:55:33 | 001,104,384 | ---- | M] (Spotify Ltd) -- C:\Users\Sophie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2013.07.04 12:58:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sophie\Desktop\OTL.exe
PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.05.09 10:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013.05.09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) -- C:\Program Files (x86)\Skype\Updater\Updater.exe
PRC - [2012.08.13 12:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2012.08.13 12:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2012.06.11 17:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE
PRC - [2012.05.30 13:55:26 | 001,112,968 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
PRC - [2012.05.02 01:03:44 | 002,279,304 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
PRC - [2012.04.25 06:18:10 | 000,784,264 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
PRC - [2012.04.06 12:17:04 | 002,796,112 | ---- | M] (Samsung Electronics CO., LTD.) -- C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe
PRC - [2012.03.27 08:10:06 | 003,458,952 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Settings\SCCSpeedBoot.exe
PRC - [2012.02.21 12:55:24 | 001,104,208 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2012.02.21 12:55:22 | 001,304,912 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
PRC - [2012.02.21 12:55:18 | 001,014,096 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2012.02.21 12:55:16 | 000,936,272 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
PRC - [2012.02.16 15:08:06 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
PRC - [2012.02.13 08:02:24 | 000,031,624 | ---- | M] () -- C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe
PRC - [2012.02.08 04:03:28 | 000,128,280 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
PRC - [2012.02.08 04:03:16 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
PRC - [2012.02.06 10:49:04 | 000,193,536 | ---- | M] (Intel Corporation) -- C:\Windows\SysWOW64\irstrtsv.exe
PRC - [2012.01.31 08:56:48 | 001,640,328 | ---- | M] (Samsung Electronics) -- C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
PRC - [2012.01.04 20:59:50 | 000,291,608 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.01.28 13:08:56 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013.01.28 13:08:28 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.08.10 17:51:32 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2011.02.16 18:03:20 | 000,203,776 | ---- | M] () -- C:\Program Files (x86)\Samsung\Easy Settings\WinCRT.dll
MOD - [2006.08.12 05:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Samsung\Easy Settings\HookDllPS2.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2013.05.27 07:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2013.05.09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2012.03.30 05:54:10 | 000,079,664 | ---- | M] (Diskeeper Corporation) [Auto | Running] -- C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe -- (ExpressCache)
SRV:64bit: - [2012.02.02 15:29:52 | 000,628,448 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R)
SRV:64bit: - [2011.12.08 03:44:04 | 000,594,704 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe -- (ZeroConfigService)
SRV:64bit: - [2011.12.08 03:43:56 | 000,273,168 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2011.12.08 03:43:48 | 000,618,256 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2011.12.08 03:43:44 | 000,148,752 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2011.12.05 02:30:50 | 000,659,968 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
SRV:64bit: - [2011.12.05 01:55:36 | 000,135,952 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
SRV:64bit: - [2010.09.22 11:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2013.06.12 01:51:57 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.06.11 17:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012.06.11 17:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE -- (BBSvc)
SRV - [2012.03.12 01:46:40 | 000,274,200 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012.02.21 12:55:24 | 001,104,208 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)
SRV - [2012.02.21 12:55:22 | 001,304,912 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)
SRV - [2012.02.21 12:55:18 | 001,014,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)
SRV - [2012.02.13 08:02:24 | 000,031,624 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Samsung\Easy Settings\SamsungDeviceConfiguration.exe -- (SamsungDeviceConfigurationWinService)
SRV - [2012.02.08 04:03:36 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2012.02.08 04:03:34 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2012.02.08 04:03:28 | 000,128,280 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe -- (Intel(R)
SRV - [2012.02.08 04:03:16 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe -- (jhi_service)
SRV - [2012.02.06 10:49:04 | 000,193,536 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysWOW64\irstrtsv.exe -- (irstrtsv)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.07.10 14:25:41 | 001,030,952 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2013.07.10 14:25:41 | 000,378,944 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2013.07.10 14:25:41 | 000,189,936 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2013.05.09 10:59:07 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2013.05.09 10:59:07 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2013.05.09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2013.05.09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2013.05.09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.12.13 13:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.30 05:54:16 | 000,095,024 | ---- | M] (Diskeeper Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\excsd.sys -- (excsd)
DRV:64bit: - [2012.03.30 05:54:16 | 000,023,344 | ---- | M] (Diskeeper Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\excfs.sys -- (excfs)
DRV:64bit: - [2012.03.14 12:49:20 | 000,242,512 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.16 15:08:26 | 000,031,216 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2012.02.14 05:38:56 | 000,060,928 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (ibtfltcoex)
DRV:64bit: - [2012.02.07 02:49:04 | 000,026,504 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\irstrtdv.sys -- (irstrtdv)
DRV:64bit: - [2012.01.05 13:36:54 | 014,652,768 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2012.01.04 20:58:50 | 000,786,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
DRV:64bit: - [2012.01.04 20:58:50 | 000,355,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
DRV:64bit: - [2012.01.04 20:58:50 | 000,016,152 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
DRV:64bit: - [2011.12.20 10:38:38 | 000,042,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:64bit: - [2011.12.20 10:38:36 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)
DRV:64bit: - [2011.12.20 10:38:36 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)
DRV:64bit: - [2011.12.05 21:23:08 | 000,331,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2011.12.05 02:22:58 | 000,195,584 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP)
DRV:64bit: - [2011.12.05 02:22:58 | 000,195,584 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)
DRV:64bit: - [2011.12.01 15:51:00 | 011,417,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2011.11.30 04:19:48 | 000,747,008 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf)
DRV:64bit: - [2011.11.30 04:19:46 | 000,094,720 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux)
DRV:64bit: - [2011.11.29 12:40:32 | 000,568,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.11.23 16:02:20 | 000,648,808 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.11.10 11:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.28 08:38:04 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=c1ac0edd-022e-4667-ab0c-cc0bb0546f5e&searchtype=hp&installDate=04/07/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=c1ac0edd-022e-4667-ab0c-cc0bb0546f5e&searchtype=ds&q={searchTerms}&installDate=04/07/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=c1ac0edd-022e-4667-ab0c-cc0bb0546f5e&searchtype=ds&q={searchTerms}&installDate=04/07/2013
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
[2013.07.04 12:00:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [BLEServicesCtrl] C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKCU..\Run: [Spotify] C:\Users\Sophie\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Sophie\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\Sophie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DelayedDesktopSwitchTimeout = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/AT/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{031EBAC8-B96A-4C55-99AF-8CE40B3A5BBE}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (c:\PROGRA~3\BROWSE~1\261339~1.144\{C16C1~1\BrowserDefender.dll) -  File not found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.11 21:56:58 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2013.07.11 21:53:31 | 009,833,328 | ---- | C] (SurfRight B.V.) -- C:\Users\Sophie\Desktop\HitmanPro_x64.exe
[2013.07.11 21:30:28 | 000,000,000 | ---D | C] -- C:\Users\Sophie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2013.07.11 21:30:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2013.07.11 21:28:29 | 002,623,656 | ---- | C] (VS Revo Group Ltd.) -- C:\Users\Sophie\Desktop\revosetup95.exe
[2013.07.11 00:57:50 | 000,000,000 | ---D | C] -- C:\Users\Sophie\AppData\Roaming\Malwarebytes
[2013.07.11 00:57:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.07.11 00:57:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.07.11 00:57:31 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2013.07.11 00:57:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.07.11 00:57:06 | 000,000,000 | ---D | C] -- C:\Users\Sophie\AppData\Local\Programs
[2013.07.11 00:54:49 | 010,285,040 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Sophie\Desktop\mbam-setup-1.75.0.1300.exe
[2013.07.11 00:33:33 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013.07.11 00:22:09 | 004,396,440 | ---- | C] (Piriform Ltd) -- C:\Users\Sophie\Desktop\ccsetup403.exe
[2013.07.11 00:09:31 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.07.11 00:05:04 | 000,000,000 | ---D | C] -- C:\windows\temp
[2013.07.10 23:47:01 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2013.07.10 23:47:01 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2013.07.10 23:47:01 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2013.07.10 23:46:46 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.07.10 23:46:26 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2013.07.10 23:43:30 | 005,087,643 | R--- | C] (Swearware) -- C:\Users\Sophie\Desktop\ComboFix.exe
[2013.07.10 23:08:19 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Sophie\Desktop\tdsskiller.exe
[2013.07.10 21:34:16 | 000,000,000 | ---D | C] -- C:\windows\Minidump
[2013.07.10 14:10:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013.07.10 14:10:17 | 000,378,944 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswSP.sys
[2013.07.10 14:10:17 | 000,033,400 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswFsBlk.sys
[2013.07.10 14:10:12 | 000,072,016 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswRdr2.sys
[2013.07.10 14:10:12 | 000,064,288 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswTdi.sys
[2013.07.10 14:10:09 | 001,030,952 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswSnx.sys
[2013.07.10 14:10:03 | 000,080,816 | ---- | C] (AVAST Software) -- C:\windows\SysNative\drivers\aswMonFlt.sys
[2013.07.10 14:10:02 | 000,287,840 | ---- | C] (AVAST Software) -- C:\windows\SysNative\aswBoot.exe
[2013.07.10 14:08:57 | 000,041,664 | ---- | C] (AVAST Software) -- C:\windows\avastSS.scr
[2013.07.10 14:08:13 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.07.10 14:06:38 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.07.04 12:58:20 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Sophie\Desktop\OTL.exe
[2013.07.04 12:06:17 | 000,000,000 | ---D | C] -- C:\Users\Sophie\AppData\Roaming\TuneUp Software
[2013.07.04 12:06:02 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2013.07.04 12:05:51 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[2013.07.04 12:05:51 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2013.07.04 12:05:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2013.07.04 12:00:53 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\Extensions
[2013.07.04 12:00:52 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\searchplugins
[2013.07.04 12:00:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.07.04 11:59:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
[2013.07.04 11:59:48 | 000,000,000 | ---D | C] -- C:\Users\Sophie\AppData\Roaming\DVDVideoSoft
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.11 22:53:00 | 000,001,110 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.07.11 22:50:55 | 000,001,106 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.07.11 22:50:52 | 000,000,828 | ---- | M] () -- C:\windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
[2013.07.11 22:50:24 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013.07.11 22:26:00 | 000,000,328 | ---- | M] () -- C:\windows\tasks\Xerox PhotoCafe Communicator.job
[2013.07.11 22:20:00 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013.07.11 22:01:29 | 000,020,992 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.11 22:01:29 | 000,020,992 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.11 21:54:27 | 001,498,506 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2013.07.11 21:54:27 | 000,654,166 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2013.07.11 21:54:27 | 000,616,008 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2013.07.11 21:54:27 | 000,130,006 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2013.07.11 21:54:27 | 000,106,388 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2013.07.11 21:54:02 | 009,833,328 | ---- | M] (SurfRight B.V.) -- C:\Users\Sophie\Desktop\HitmanPro_x64.exe
[2013.07.11 21:45:52 | 000,662,345 | ---- | M] () -- C:\Users\Sophie\Desktop\adwcleaner.exe
[2013.07.11 21:30:28 | 000,001,228 | ---- | M] () -- C:\Users\Sophie\Desktop\Revo Uninstaller.lnk
[2013.07.11 21:28:45 | 002,623,656 | ---- | M] (VS Revo Group Ltd.) -- C:\Users\Sophie\Desktop\revosetup95.exe
[2013.07.11 17:47:04 | 000,000,830 | ---- | M] () -- C:\windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
[2013.07.11 00:57:35 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.07.11 00:55:05 | 010,285,040 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Sophie\Desktop\mbam-setup-1.75.0.1300.exe
[2013.07.11 00:33:35 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013.07.11 00:22:26 | 004,396,440 | ---- | M] (Piriform Ltd) -- C:\Users\Sophie\Desktop\ccsetup403.exe
[2013.07.10 23:44:25 | 005,087,643 | R--- | M] (Swearware) -- C:\Users\Sophie\Desktop\ComboFix.exe
[2013.07.10 23:08:44 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Sophie\Desktop\tdsskiller.exe
[2013.07.10 20:48:12 | 000,377,856 | ---- | M] () -- C:\Users\Sophie\Desktop\gmer_2.1.19163 (1).exe
[2013.07.10 20:03:18 | 000,294,184 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2013.07.10 15:33:46 | 000,000,098 | ---- | M] () -- C:\windows\DeleteOnReboot.bat
[2013.07.10 14:25:41 | 001,030,952 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswSnx.sys
[2013.07.10 14:25:41 | 000,378,944 | ---- | M] (AVAST Software) -- C:\windows\SysNative\drivers\aswSP.sys
[2013.07.10 14:25:41 | 000,189,936 | ---- | M] () -- C:\windows\SysNative\drivers\aswVmm.sys
[2013.07.10 14:25:41 | 000,000,175 | ---- | M] () -- C:\windows\SysNative\drivers\aswVmm.sys.sum
[2013.07.10 14:25:41 | 000,000,175 | ---- | M] () -- C:\windows\SysNative\drivers\aswSP.sys.sum
[2013.07.10 14:25:41 | 000,000,175 | ---- | M] () -- C:\windows\SysNative\drivers\aswSnx.sys.sum
[2013.07.10 14:10:21 | 000,001,922 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.07.10 14:10:03 | 000,000,000 | ---- | M] () -- C:\windows\SysWow64\config.nt
[2013.07.04 12:58:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sophie\Desktop\OTL.exe
[2013.07.04 12:57:41 | 000,000,168 | ---- | M] () -- C:\Users\Sophie\defogger_reenable
[2013.07.04 12:56:50 | 000,050,477 | ---- | M] () -- C:\Users\Sophie\Desktop\Defogger.exe
[2013.07.04 12:42:12 | 000,001,017 | ---- | M] () -- C:\Users\Sophie\Desktop\Dropbox.lnk
[2013.07.04 12:05:37 | 000,001,243 | ---- | M] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
 
========== Files Created - No Company Name ==========
 
[2013.07.11 21:45:32 | 000,662,345 | ---- | C] () -- C:\Users\Sophie\Desktop\adwcleaner.exe
[2013.07.11 21:30:28 | 000,001,228 | ---- | C] () -- C:\Users\Sophie\Desktop\Revo Uninstaller.lnk
[2013.07.11 00:57:35 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.07.11 00:33:35 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2013.07.10 23:47:01 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2013.07.10 23:47:01 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2013.07.10 23:47:01 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2013.07.10 23:47:01 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2013.07.10 23:47:01 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2013.07.10 20:48:09 | 000,377,856 | ---- | C] () -- C:\Users\Sophie\Desktop\gmer_2.1.19163 (1).exe
[2013.07.10 15:33:21 | 000,000,098 | ---- | C] () -- C:\windows\DeleteOnReboot.bat
[2013.07.10 14:25:41 | 000,000,175 | ---- | C] () -- C:\windows\SysNative\drivers\aswVmm.sys.sum
[2013.07.10 14:25:41 | 000,000,175 | ---- | C] () -- C:\windows\SysNative\drivers\aswSP.sys.sum
[2013.07.10 14:25:41 | 000,000,175 | ---- | C] () -- C:\windows\SysNative\drivers\aswSnx.sys.sum
[2013.07.10 14:10:21 | 000,001,922 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.07.10 14:10:08 | 000,189,936 | ---- | C] () -- C:\windows\SysNative\drivers\aswVmm.sys
[2013.07.10 14:10:05 | 000,065,336 | ---- | C] () -- C:\windows\SysNative\drivers\aswRvrt.sys
[2013.07.10 14:10:03 | 000,000,000 | ---- | C] () -- C:\windows\SysWow64\config.nt
[2013.07.04 12:57:41 | 000,000,168 | ---- | C] () -- C:\Users\Sophie\defogger_reenable
[2013.07.04 12:56:49 | 000,050,477 | ---- | C] () -- C:\Users\Sophie\Desktop\Defogger.exe
[2013.07.04 12:26:24 | 000,002,548 | ---- | C] () -- C:\Users\Sophie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
[2013.07.04 12:05:37 | 000,001,243 | ---- | C] () -- C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
[2012.06.30 13:44:34 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2012.06.30 12:37:45 | 000,003,586 | ---- | C] () -- C:\windows\HotFixList.ini
[2012.03.13 04:59:22 | 000,963,912 | ---- | C] () -- C:\windows\SysWow64\igkrng600.bin
[2012.03.13 04:59:22 | 000,734,772 | ---- | C] () -- C:\windows\SysWow64\igkrng700.bin
[2012.03.13 04:59:19 | 000,557,476 | ---- | C] () -- C:\windows\SysWow64\igfcg700m.bin
[2012.03.13 04:59:19 | 000,261,208 | ---- | C] () -- C:\windows\SysWow64\igfcg600m.bin
[2012.03.13 04:59:16 | 000,058,880 | ---- | C] () -- C:\windows\SysWow64\igdde32.dll
[2012.03.13 04:59:14 | 012,978,688 | ---- | C] () -- C:\windows\SysWow64\ig7icd32.dll
[2012.03.13 04:59:14 | 000,145,804 | ---- | C] () -- C:\windows\SysWow64\igcompkrng600.bin
[2012.03.13 04:59:13 | 013,184,512 | ---- | C] () -- C:\windows\SysWow64\ig4icd32.dll
[2012.02.02 15:08:26 | 000,001,536 | ---- | C] () -- C:\windows\SysWow64\IusEventLog.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.07.11 21:38:41 | 000,000,000 | ---D | M] -- C:\Users\Sophie\AppData\Roaming\DAEMON Tools Lite
[2013.07.04 12:42:36 | 000,000,000 | ---D | M] -- C:\Users\Sophie\AppData\Roaming\Dropbox
[2013.07.11 21:23:40 | 000,000,000 | ---D | M] -- C:\Users\Sophie\AppData\Roaming\DVDVideoSoft
[2012.12.06 13:28:59 | 000,000,000 | ---D | M] -- C:\Users\Sophie\AppData\Roaming\OpenOffice.org
[2013.07.11 22:51:42 | 000,000,000 | ---D | M] -- C:\Users\Sophie\AppData\Roaming\Spotify
[2013.07.04 12:06:17 | 000,000,000 | ---D | M] -- C:\Users\Sophie\AppData\Roaming\TuneUp Software
 
========== Purity Check ==========
 
 

< End of report >

markusg 11.07.2013 22:14
b
Hi,


otl fix

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:
:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=c1ac0edd-022e-4667-ab0c-cc0bb0546f5e&searchtype=hp&installDate=04/07/2013
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=c1ac0edd-022e-4667-ab0c-cc0bb0546f5e&searchtype=ds&q={searchTerms}&installDate=04/07/2013
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
O20 - AppInit_DLLs: (c:\PROGRA~3\BROWSE~1\261339~1.144\{C16C1~1\BrowserDefender.dll) -  File not found
:files
:Commands
[emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


bitte teste, ob es im Firefox, internet explorer, und sonstigen
evtl. instalierte Browser, irgendwelche ungewollten toolbars, umleitungen oder sonstigen Probleme gibt.
Teste wie pc und programme allgemein laufen.

fräuleindoof 11.07.2013 22:31
Liste der Anhänge anzeigen (Anzahl: 2)
Erstmal die Log...

Code:
All processes killed
========== OTL ==========
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\PROGRA~3\BROWSE~1\261339~1.144\{C16C1~1\BrowserDefender.dll deleted successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Sophie
->Temp folder emptied: 38545 bytes
->Temporary Internet Files folder emptied: 1184600 bytes
->Google Chrome cache emptied: 7532845 bytes
->Flash cache emptied: 598 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 90949675 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 78140 bytes
RecycleBin emptied: 650027 bytes
 
Total Files Cleaned = 96,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 07112013_231906

Files\Folders moved on Reboot...
C:\Users\Sophie\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Sophie\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
So...also erstmal wirkt alles normal und vernünftig. Aber es gibt etwas, dass jetzt immer noch nicht weg ist...und das ist immer noch irgendwas von snap.do . Ich hänge mal einen Screenshot mit dran. Da sieht man dann das Zeichen und wenn ich da draufklicke kommt immer noch irgendwas snap.do-mäßiges...davon mach ich auch gleich noch einen Screenshot. Nur zur Sicherheit.^^

markusg 11.07.2013 22:34
hi,
in welchem Browser? kanns auf screenshots nichts erkennen.
bitte laufen lassen:

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


fräuleindoof 11.07.2013 22:59
Ich habs doch sogar mit Pfeilen markiert. :D
Es ist in der Taskleiste...also quasi allgegenwärtig.

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.0.7 (07.11.2013:1)
OS: Windows 7 Home Premium x64
Ran by Sophie on 11.07.2013 at 23:42:28,36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.07.2013 at 23:56:43,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Achso...aber es öffnet snap.do automatisch bei google chrome, falls das gemeint war.

markusg 11.07.2013 23:22
ist in rewo noch die
Snap.Do Engine

zu sehen? falls ja mal deinstaliern.
bzw über ccleaner, falls nicht im rewo zu sehen

fräuleindoof 11.07.2013 23:40
Nein, ist nicht mehr da. Vielleicht sollte ich noch erwähnen, dass zuerst snap.do UND snap.do engine drauf waren und snap.do aber gelöscht werden konnte...zumindest dachten wir das, aber das ist übrig geblieben abgesehen von dem snap.do engine Ding.

markusg 11.07.2013 23:55
1.
chrome lesezeichen sichern:
https://support.google.com/chrome/answer/96816?hl=de
2. chrome deinstalieren, haken bei surfspuren löschen drinn lassen, neustarten.
3. chrome reinstalieren, testen.

fräuleindoof 12.07.2013 09:19
So... :)
Ich glaube, das sieht jetzt schon ganz gut aus. :rofl:
Freu mich grad voll, trau der Sache aber noch nicht ganz.^^
Also ich hab das jetzt gemacht, Chrome deinstalliert und reinstalliert und danach hab ich nochmal auf das Symbol in der Taskleiste geklickt und da stand dann, dass die Verknüpfung (verdammt ich hab den genauen Wortlaut vergessen. :D) aber irgendwie sowas wie, dass die Verknüpfung zu Chrome war und jetzt nicht mehr hergestellt werden kann. Dann wurde ich gefragt, ob ich es löschen möchte und habe natürlich "ja" angeklickt und nun ist es weg.
Hat meine Mitbewohnerin jetzt wieder einen gesunden PC? :) :) :)

markusg 12.07.2013 11:23
Hi,
du hast auf die
Snap.do
geklickt? Warum klickt man auf die Verknüpfung eines Programms, dass einem Probleme gemacht hatt?
teste mal alle instalierten browser und den PC, auf Probleme, ungewollte Toolbars etc. Teile mir bitte mit wie er läuft

fräuleindoof 13.07.2013 19:52
Hey,

ja ich hatte ja vorher schon mal draufgeklickt...und wollte nun wissen, ob das immer noch mit irgendwas verknüpft ist, also ob snap.do immer noch da ist. Dazu musste ich ja draufklicken...

Ansonsten ist jetzt auch alles wieder normal...delta search ist weg und von snap.do gibts jetzt auch nicht mehr.... :)

und auch sonst ist nichts auffälliges aufgefallen... ;)

markusg 15.07.2013 19:04
Hi,
bin jetzt erst mal ne Woche im Urlaub.
Sehr gut.
öffne bitte OTL, bereinigen, PC startet neu, Remover werden gelöscht.
Lösche übrig gebliebene Logs, Setups, von uns verwendete Programme.
PC absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 8 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
http://support.google.com/chrome/bin...&answer=118663
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.


Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:41 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131