Trojaner-Board - Win7 - Speicherplatz verringert sich, Zugriff auf eigene Ordner blockiert

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Win7 - Speicherplatz verringert sich, Zugriff auf eigene Ordner blockiert (https://www.trojaner-board.de/163699-win7-speicherplatz-verringert-zugriff-eigene-ordner-blockiert.html)

Win7 - Speicherplatz verringert sich, Zugriff auf eigene Ordner blockiert

Hallo,
scheine mir was eingefangen zu haben, auch wenn Avast keinen Befund meldet.
Problem: Der Speicherplatz hat sich in den letzten Wochen ohne mein Zutun deutlich (um über 5 GB) verringert. Seit 1 Tag tritt das Problem hinzu, dass der Zugriff auf Ordner in der Ablage mit dem Hinweis, der Ordner sei nicht verfügbar, verweigert wird.

Hier die soeben erstellten FRST-logs.

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2015

Ran by ThoMi (administrator) on PC on 07-02-2015 07:10:58

Running from C:\Users\ThoMi\Downloads

Loaded Profiles: ThoMi (Available profiles: ThoMi)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)

HKLM\...\Policies\Explorer: [NoViewContextMenu] 0

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/

SearchScopes: HKLM-x32 -> DefaultScope value is missing.

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} ->  No File

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: G Data BankGuard -> {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} -> C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} ->  No File

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF user.js: detected! => C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\user.js

FF Extension: Download videos and MP3s from YouTube - C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-23]

FF Extension: Deutsch (DE) Language Pack - C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-03-22]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-07-22]

FF HKU\S-1-5-21-3296977853-467173732-4196599000-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-23]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-25]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-25] (AVAST Software)

S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-25] (Avast Software)

S4 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1540632 2012-06-29] (G Data Software AG)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)

S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [544768 2009-08-24] (mst software GmbH, Germany) [File not signed]

S3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [470008 2012-03-29] (G Data Software AG)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S4 AVKService; "C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe" [X]

S4 AVKWCtl; "C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe" [X]

S3 GDFwSvc; "C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-25] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-25] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-25] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-25] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-25] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-25] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-25] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-25] ()

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [54136 2013-01-04] (G Data Software AG)

R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [122744 2013-01-04] (G Data Software AG)

S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [59768 2013-01-04] (G Data Software AG)

R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [65912 2013-01-04] (G Data Software AG)

R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [64376 2013-01-04] (G Data Software AG)

U5 terminpt; C:\Windows\System32\Drivers\terminpt.sys [29696 2012-08-23] (Microsoft Corporation) [File not signed]

R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-11-17] (Windows (R) 2000 DDK provider)

R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-11-17] (Paragon)

R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-11-17] (Paragon)

R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-25] (Avast Software)

R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-06 06:17 - 2015-02-06 06:17 - 00000000 ____D () C:\Users\ThoMi\Downloads\FRST-OlderVersion

2015-02-06 05:38 - 2015-02-07 06:31 - 00000168 _____ () C:\Windows\setupact.log

2015-02-06 05:38 - 2015-02-06 05:38 - 00000000 _____ () C:\Windows\setuperr.log

2015-02-02 06:42 - 2015-02-02 06:42 - 354175667 _____ () C:\Windows\MEMORY.DMP

2015-01-28 22:04 - 2015-01-30 16:52 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-28 22:04 - 2015-01-28 22:04 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-28 22:04 - 2015-01-28 22:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-28 22:04 - 2015-01-28 22:04 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-01-28 22:04 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-28 22:04 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-28 22:04 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-28 22:03 - 2015-01-28 22:03 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\ThoMi\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-25 06:22 - 2015-01-25 06:22 - 00000197 _____ () C:\Windows\system32\2015-01-25-05-22-09.033-AvastVBoxSVC.exe-2328.log

2015-01-24 17:57 - 2015-02-06 06:19 - 00021356 _____ () C:\Users\ThoMi\Downloads\Addition.txt

2015-01-24 17:56 - 2015-02-07 07:11 - 00013617 _____ () C:\Users\ThoMi\Downloads\FRST.txt

2015-01-24 17:56 - 2015-02-06 06:17 - 02131968 _____ (Farbar) C:\Users\ThoMi\Downloads\FRST64.exe

2015-01-21 16:34 - 2015-01-21 16:34 - 00000247 _____ () C:\Windows\system32\2015-01-21-15-34-54.079-aswFe.exe-1296.log

2015-01-21 16:30 - 2015-01-21 16:34 - 00000247 _____ () C:\Windows\system32\2015-01-21-15-30-19.012-aswFe.exe-872.log

2015-01-21 16:30 - 2015-01-21 16:30 - 00000197 _____ () C:\Windows\system32\2015-01-21-15-30-15.039-AvastVBoxSVC.exe-2336.log

2015-01-19 07:31 - 2015-01-19 07:31 - 00000197 _____ () C:\Windows\system32\2015-01-19-06-31-20.093-AvastVBoxSVC.exe-2604.log

2015-01-18 05:13 - 2015-01-18 05:13 - 00000247 _____ () C:\Windows\system32\2015-01-18-04-13-03.036-aswFe.exe-1796.log

2015-01-18 05:07 - 2015-01-18 05:12 - 00000247 _____ () C:\Windows\system32\2015-01-18-04-07-37.078-aswFe.exe-3988.log

2015-01-18 05:07 - 2015-01-18 05:07 - 00000197 _____ () C:\Windows\system32\2015-01-18-04-07-33.001-AvastVBoxSVC.exe-4812.log

2015-01-17 01:21 - 2015-01-17 01:21 - 00000197 _____ () C:\Windows\system32\2015-01-17-00-21-23.050-AvastVBoxSVC.exe-2612.log

2015-01-16 07:03 - 2015-01-16 07:03 - 00000197 _____ () C:\Windows\system32\2015-01-16-06-03-03.055-AvastVBoxSVC.exe-2592.log

2015-01-14 22:01 - 2015-01-14 22:01 - 00000197 _____ () C:\Windows\system32\2015-01-14-21-01-18.019-AvastVBoxSVC.exe-2560.log

2015-01-14 07:06 - 2015-01-14 07:06 - 00000197 _____ () C:\Windows\system32\2015-01-14-06-06-15.089-AvastVBoxSVC.exe-2088.log

2015-01-14 02:09 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 02:09 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 02:08 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 02:08 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 02:08 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-01-14 02:08 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-01-14 02:08 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-01-14 02:08 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-14 02:08 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-01-14 02:08 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-01-14 02:08 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 02:08 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 02:08 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2015-01-14 01:40 - 2015-01-14 01:40 - 00000197 _____ () C:\Windows\system32\2015-01-14-00-40-37.020-AvastVBoxSVC.exe-2396.log

2015-01-13 07:01 - 2015-01-13 07:01 - 00000197 _____ () C:\Windows\system32\2015-01-13-06-01-51.071-AvastVBoxSVC.exe-2420.log

2015-01-12 17:27 - 2015-01-12 23:15 - 00000000 ____D () C:\Users\ThoMi\AppData\OICE_15_974FA576_32C1D314_24F8

2015-01-12 07:15 - 2015-01-12 07:15 - 00000197 _____ () C:\Windows\system32\2015-01-12-06-15-52.064-AvastVBoxSVC.exe-2344.log

2015-01-11 15:05 - 2015-01-11 15:05 - 00000197 _____ () C:\Windows\system32\2015-01-11-14-05-30.093-AvastVBoxSVC.exe-2500.log

2015-01-11 08:14 - 2015-01-11 08:14 - 00000197 _____ () C:\Windows\system32\2015-01-11-07-14-02.090-AvastVBoxSVC.exe-2316.log

2015-01-10 08:15 - 2015-01-10 08:15 - 00000197 _____ () C:\Windows\system32\2015-01-10-07-15-22.070-AvastVBoxSVC.exe-2460.log

2015-01-10 00:43 - 2015-01-10 00:43 - 00000197 _____ () C:\Windows\system32\2015-01-09-23-43-07.045-AvastVBoxSVC.exe-2440.log

2015-01-08 06:36 - 2015-01-08 06:36 - 00000197 _____ () C:\Windows\system32\2015-01-08-05-36-14.099-AvastVBoxSVC.exe-2312.log
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-07 07:11 - 2014-11-18 14:18 - 00000000 ____D () C:\FRST

2015-02-07 06:46 - 2013-01-05 21:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-02-07 06:38 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-07 06:38 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-07 06:34 - 2014-07-21 04:08 - 01801447 _____ () C:\Windows\WindowsUpdate.log

2015-02-07 06:31 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-06 06:37 - 2014-07-22 17:10 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-02-06 06:31 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-02-05 23:41 - 2013-01-26 13:22 - 00000000 ____D () C:\Windows\Minidump

2015-02-04 21:46 - 2013-01-05 21:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-04 21:46 - 2013-01-05 21:07 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-04 21:46 - 2013-01-05 21:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-31 08:33 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Erbengemeinschaft

2015-01-31 08:32 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Steuer

2015-01-30 16:59 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Thomas

2015-01-30 07:34 - 2014-12-11 08:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-24 23:27 - 2014-01-12 07:22 - 00000000 ____D () C:\Users\ThoMi\AppData\Roaming\vlc

2015-01-14 02:19 - 2013-08-05 18:02 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-14 02:17 - 2012-12-12 17:04 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-01-08 14:16 - 2013-01-05 17:17 - 00000000 ____D () C:\Users\ThoMi\Documents\Gemeinsam
 

==================== Files in the root of some directories =======
 

2014-05-05 05:07 - 2014-05-05 05:07 - 0001506 _____ () C:\Users\ThoMi\AppData\Local\recently-used.xbel
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-03 08:26
 

==================== End Of Log ============================

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-02-2015

Ran by ThoMi at 2015-02-07 07:11:47

Running from C:\Users\ThoMi\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.22beta (HKLM-x32\...\7-Zip) (Version:  - )

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Ashampoo WinOptimizer Free v.1.0.0 (HKLM-x32\...\Ashampoo WinOptimizer Free_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.)

Free YouTube to MP3 Converter version 3.12.50.1111 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.50.1111 - DVDVideoSoft Ltd.)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

KONZ-Steuer-2014 (HKLM-x32\...\InstallShield_{20F1078B-E3B6-4DA1-9570-003DE110890A}) (Version: 1.00.0000 - USM)

KONZ-Steuer-2014 (x32 Version: 1.00.0000 - USM) Hidden

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Paragon Backup & Recovery™ 2012 Free (HKLM-x32\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)

PlayChess  (HKLM-x32\...\PlayChess) (Version:  - ChessBase GmbH)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Steuer 2012 (HKLM-x32\...\{01159E8A-44F7-4885-A7F9-872CE4D74063}) (Version: 20.00.8137 - Buhl Data Service GmbH)

Steuer 2013 (HKLM-x32\...\{05AEF487-8926-48A9-B5BA-9BED72BC6B1C}) (Version: 21.00.8480 - Buhl Data Service GmbH)

Steuer 2014 (HKLM-x32\...\{2EE860C7-4551-479F-AF01-328B8AA46051}) (Version: 22.00.8811 - Buhl Data Service GmbH)

SWR3 RauchFrei Version 1.2 (HKLM-x32\...\SWR3 RauchFrei_is1) (Version: 1.1 - Oliver Reuther und SWR3)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

28-11-2014 22:35:21 Windows Update

02-12-2014 13:30:20 Windows Update

06-12-2014 01:45:17 Windows Update

09-12-2014 13:20:32 Windows Update

10-12-2014 19:12:41 Windows Update

13-12-2014 00:38:57 Windows Update

16-12-2014 07:53:07 Windows Update

18-12-2014 22:11:45 Windows Update

23-12-2014 07:44:27 Windows Update

30-12-2014 09:31:25 Windows Update

02-01-2015 14:29:30 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

02-01-2015 14:30:36 Installiert Steuer 2014

06-01-2015 18:31:38 Windows Update

14-01-2015 02:07:48 Windows Update

14-01-2015 02:16:54 Windows Update

20-01-2015 08:46:17 Windows Update

23-01-2015 10:06:05 Windows Update

23-01-2015 23:37:35 Revo Uninstaller's restore point - Foxit Cloud

23-01-2015 23:39:52 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028

27-01-2015 17:34:33 Windows Update

03-02-2015 07:03:21 Windows Update

07-02-2015 00:06:35 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2014-07-21 03:46 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {14D85A35-E529-449C-A310-3F9DEE865AD6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {A0F1F42A-7F33-4095-B87E-41FFA694C39A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {CE6A2F68-B11C-458F-AFA6-34F23641D579} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)

Task: {CFD9F461-6BBE-4CF4-8D0F-322E254D0471} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {D9D62A1F-F764-49F7-8C27-525A297CD012} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)

Task: {F15C5887-6C5E-4127-BC5A-45007BC033B2} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-25] (AVAST Software)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2014-03-10 12:09 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-02-05 23:23 - 2015-02-05 23:23 - 02913280 _____ () C:\Program Files\AVAST Software\Avast\defs\15020501\algo.dll

2014-11-25 12:45 - 2014-11-25 12:45 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-12-11 08:10 - 2015-01-29 05:52 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Registry Areas =====================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\ThoMi\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-3296977853-467173732-4196599000-500 - Administrator - Disabled)

Gast (S-1-5-21-3296977853-467173732-4196599000-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3296977853-467173732-4196599000-1002 - Limited - Enabled)

ThoMi (S-1-5-21-3296977853-467173732-4196599000-1000 - Administrator - Enabled) => C:\Users\ThoMi
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/07/2015 06:31:18 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/06/2015 07:05:53 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (02/06/2015 06:36:56 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/06/2015 06:33:21 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/06/2015 06:31:32 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1

Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000020a7a

ID des fehlerhaften Prozesses: 0x244

Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0

Pfad der fehlerhaften Anwendung: svchost.exe1

Pfad des fehlerhaften Moduls: svchost.exe2

Berichtskennung: svchost.exe3
 

Error: (02/06/2015 05:39:07 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/05/2015 06:38:42 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/04/2015 05:31:52 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/03/2015 08:25:58 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Fehler beim Generieren des Aktivierungskontextes für "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"1". Fehler in Manifest- oder Richtliniendatei "UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"2" in Zeile  UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"3.

Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.

Verweis: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0".

Definition: UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0".

Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
 

Error: (02/03/2015 06:57:57 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

System errors:

=============

Error: (02/07/2015 06:31:00 AM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/07/2015 06:31:00 AM) (Source: atikmdag) (EventID: 19468) (User: )

Description: CPLIB :: General - Invalid Parameter
 

Error: (02/06/2015 11:54:54 PM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/06/2015 06:56:44 PM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/06/2015 05:00:07 PM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/06/2015 02:22:42 PM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/06/2015 02:22:42 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.
 

Error: (02/06/2015 01:41:57 PM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/06/2015 09:46:52 AM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/06/2015 08:57:49 AM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 
 

Microsoft Office Sessions:

=========================

Error: (02/07/2015 06:31:18 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/06/2015 07:05:53 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1
 

Error: (02/06/2015 06:36:56 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/06/2015 06:33:21 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/06/2015 06:31:32 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: svchost.exe6.1.7600.163854a5bc3c1ntdll.dll6.1.7601.18247521eaf24c00000050000000000020a7a24401d041c6cee8f605C:\Windows\system32\svchost.exeC:\Windows\SYSTEM32\ntdll.dll68311620-adc1-11e4-bad2-90fba686f5f6
 

Error: (02/06/2015 05:39:07 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/05/2015 06:38:42 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/04/2015 05:31:52 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (02/03/2015 08:25:58 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: UccApi,processorArchitecture="AMD64",type="win32",version="15.0.0.0"UccApi,processorArchitecture="x86",type="win32",version="15.0.0.0"C:\Program Files\Microsoft Office 15\root\office15\lync.exe.ManifestC:\Program Files\Microsoft Office 15\root\office15\UccApi.DLL1
 

Error: (02/03/2015 06:57:57 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-07-21 04:46:21.225

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-07-21 04:46:21.162

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: AMD Athlon(tm) II X2 250 Processor

Percentage of memory in use: 38%

Total physical RAM: 3839.18 MB

Available physical RAM: 2353.5 MB

Total Pagefile: 7676.54 MB

Available Pagefile: 6024.43 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (Windows) (Fixed) (Total:140.26 GB) (Free:6 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 78DAE1C9)

Partition 1: (Active) - (Size=8.8 GB) - (Type=27)

Partition 2: (Not Active) - (Size=140.3 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Bin dankbar für jede Unterstützung!
Viele Grüße
Michael

hi,

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Hi Schrauber,
vielen Dank!
Hab ich gemacht, er hat nix gefunden:
10:39:58.0228 0x114c TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
10:40:00.0979 0x114c ============================================================
10:40:00.0979 0x114c Current date / time: 2015/02/07 10:40:00.0979
10:40:00.0979 0x114c SystemInfo:
10:40:00.0979 0x114c
10:40:00.0979 0x114c OS Version: 6.1.7601 ServicePack: 1.0
10:40:00.0979 0x114c Product type: Workstation
10:40:00.0980 0x114c ComputerName: PC
10:40:00.0980 0x114c UserName: ThoMi
10:40:00.0980 0x114c Windows directory: C:\Windows
10:40:00.0980 0x114c System windows directory: C:\Windows
10:40:00.0980 0x114c Running under WOW64
10:40:00.0980 0x114c Processor architecture: Intel x64
10:40:00.0980 0x114c Number of processors: 2
10:40:00.0980 0x114c Page size: 0x1000
10:40:00.0980 0x114c Boot type: Normal boot
10:40:00.0980 0x114c ============================================================
10:40:02.0529 0x114c KLMD registered as C:\Windows\system32\drivers\58952770.sys
10:40:02.0770 0x114c System UUID: {9C772D7C-EBB6-744E-4D3E-B24ABC4F33FB}
10:40:03.0220 0x114c Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 ( 149.05 Gb ), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
10:40:03.0229 0x114c ============================================================
10:40:03.0229 0x114c \Device\Harddisk0\DR0:
10:40:03.0237 0x114c MBR partitions:
10:40:03.0237 0x114c \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1195000, BlocksNum 0x11884000
10:40:03.0237 0x114c ============================================================
10:40:03.0270 0x114c C: <-> \Device\Harddisk0\DR0\Partition1
10:40:03.0270 0x114c ============================================================
10:40:03.0271 0x114c Initialize success
10:40:03.0271 0x114c ============================================================
10:41:25.0079 0x102c ============================================================
10:41:25.0079 0x102c Scan started
10:41:25.0079 0x102c Mode: Manual; SigCheck; TDLFS;
10:41:25.0079 0x102c ============================================================
10:41:25.0079 0x102c KSN ping started
10:41:27.0591 0x102c KSN ping finished: true
10:41:28.0246 0x102c ================ Scan system memory ========================
10:41:28.0246 0x102c System memory - ok
10:41:28.0246 0x102c ================ Scan services =============================
10:41:28.0402 0x102c [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
10:41:28.0558 0x102c 1394ohci - ok
10:41:28.0652 0x102c [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
10:41:28.0730 0x102c ACPI - ok
10:41:28.0777 0x102c [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
10:41:28.0855 0x102c AcpiPmi - ok
10:41:28.0964 0x102c [ 080255CDCB878813B481B8C348D47D8E, 75808821FBC732D0504795B8F85852E4C01D3B412989A1E597E1295CFF7B7A45 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
10:41:29.0042 0x102c AdobeFlashPlayerUpdateSvc - ok
10:41:29.0104 0x102c [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
10:41:29.0182 0x102c adp94xx - ok
10:41:29.0245 0x102c [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\drivers\adpahci.sys
10:41:29.0338 0x102c adpahci - ok
10:41:29.0369 0x102c [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
10:41:29.0447 0x102c adpu320 - ok
10:41:29.0510 0x102c [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
10:41:29.0603 0x102c AeLookupSvc - ok
10:41:29.0697 0x102c [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD C:\Windows\system32\drivers\afd.sys
10:41:29.0822 0x102c AFD - ok
10:41:29.0853 0x102c [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
10:41:29.0931 0x102c agp440 - ok
10:41:29.0978 0x102c [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
10:41:30.0025 0x102c ALG - ok
10:41:30.0056 0x102c [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
10:41:30.0103 0x102c aliide - ok
10:41:30.0165 0x102c [ D696F317BD465A602566F8E1DCCE15F7, 6CE77CD4221C0854986F760D1944DF9F4255192D99630D43A0527A6D58D83406 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
10:41:30.0227 0x102c AMD External Events Utility - ok
10:41:30.0274 0x102c [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
10:41:30.0321 0x102c amdide - ok
10:41:30.0352 0x102c [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
10:41:30.0415 0x102c AmdK8 - ok
10:41:30.0461 0x102c [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
10:41:30.0524 0x102c AmdPPM - ok
10:41:30.0571 0x102c [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
10:41:30.0633 0x102c amdsata - ok
10:41:30.0680 0x102c [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
10:41:30.0758 0x102c amdsbs - ok
10:41:30.0805 0x102c [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
10:41:30.0867 0x102c amdxata - ok
10:41:30.0898 0x102c [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID C:\Windows\system32\drivers\appid.sys
10:41:30.0976 0x102c AppID - ok
10:41:31.0023 0x102c [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc C:\Windows\System32\appidsvc.dll
10:41:31.0148 0x102c AppIDSvc - ok
10:41:31.0179 0x102c [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
10:41:31.0257 0x102c Appinfo - ok
10:41:31.0319 0x102c [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\drivers\arc.sys
10:41:31.0382 0x102c arc - ok
10:41:31.0413 0x102c [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\drivers\arcsas.sys
10:41:31.0475 0x102c arcsas - ok
10:41:31.0569 0x102c [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
10:41:31.0631 0x102c aspnet_state - ok
10:41:31.0663 0x102c [ 9BE9F2B83DE80E2752B1405CC427E2EC, 6015CA66553B3B882083B33F24FB338249A110D9769831C3D3D3C681AAFA9411 ] aswHwid C:\Windows\system32\drivers\aswHwid.sys
10:41:31.0725 0x102c aswHwid - ok
10:41:31.0756 0x102c [ 2DA1C1AEDF454F8E32A863A1AEACDD8C, F02E4D197AE00B9A9507CF6007A7B7BEA54AF0F255B752FBA7174FA2596D1CA9 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys
10:41:31.0787 0x102c aswMonFlt - ok
10:41:31.0819 0x102c [ 4750016EF9CC1DEC6DA3FE5AF9A7F095, C4CF46246D8A3FF9BD8D2FE899685654ADD45EB9B032F33804D0B8131882BC74 ] aswRdr C:\Windows\system32\drivers\aswRdr2.sys
10:41:31.0912 0x102c aswRdr - ok
10:41:31.0943 0x102c [ 1323269A92645705DEFA053F3596829D, 83EC58E0577A1E45D1FCBC0C0AF182099FB70B9005B9F8161166EBB4E9F58F35 ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys
10:41:32.0006 0x102c aswRvrt - ok
10:41:32.0068 0x102c [ E74FD717476B30E23F45354B8F3ACB30, 951D1655E1FA4CF0ACB29F2EEDDB3B42522D392F46DD826C63DCA8941E17ABA8 ] aswSnx C:\Windows\system32\drivers\aswSnx.sys
10:41:32.0162 0x102c aswSnx - ok
10:41:32.0209 0x102c [ B1881A01E301990B671694CA1623F1B6, 5299C713EA7CF96F0550943DB37E963CDA09258F65C471CCEEAB44C4736B7A08 ] aswSP C:\Windows\system32\drivers\aswSP.sys
10:41:32.0255 0x102c aswSP - ok
10:41:32.0271 0x102c [ 7509F07BA6F84C1E3B2C0D78A1F6F782, A90A36E8E23F58E430DE98B3623688DC09D34B62906EF7796DFC90F581FC385F ] aswStm C:\Windows\system32\drivers\aswStm.sys
10:41:32.0318 0x102c aswStm - ok
10:41:32.0365 0x102c [ 1A5BDDE65B648DC3AD48B6ECAA3AE9C8, 858F674C3B775F9C8C782B7AFAC0B02AE9410C9F3B7F5B3AE1C4AD3BF6448C14 ] aswVmm C:\Windows\system32\drivers\aswVmm.sys
10:41:32.0458 0x102c aswVmm - ok
10:41:32.0536 0x102c [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
10:41:32.0645 0x102c AsyncMac - ok
10:41:32.0677 0x102c [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
10:41:32.0755 0x102c atapi - ok
10:41:33.0035 0x102c [ 52BD95CAA9CAE8977FE043E9AD6D2D0E, E96DD29A2FCE1403340CB29D34F657DF17F483F62A2E8E24890F9BC4812B2971 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
10:41:33.0347 0x102c atikmdag - ok
10:41:33.0425 0x102c [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
10:41:33.0519 0x102c AudioEndpointBuilder - ok
10:41:33.0535 0x102c [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioSrv C:\Windows\System32\Audiosrv.dll
10:41:33.0597 0x102c AudioSrv - ok
10:41:33.0659 0x102c [ E3F7EC811923F3F1A77B185F22638E5E, 324041256314C1471B5F123FA8DECC8F374A6B497A6419D4CAF61E68E1733265 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
10:41:33.0737 0x102c avast! Antivirus - ok
10:41:33.0971 0x102c [ 4F4EBF6163D3A02D52A66BBD145B0069, 179B2FD2671F6BB8D3F77B39001F546A0DEBE85BFF9782060AF1DC50DFA071EF ] AvastVBoxSvc C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
10:41:34.0190 0x102c AvastVBoxSvc - ok
10:41:34.0346 0x102c [ 8AEC7EAF321CAC98E8DAC8A7021281B4, D79300A5393EB3724FB2D38E9AEBA19C5630D444866CDB173F92EB8C383C6C03 ] AVKProxy C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
10:41:34.0408 0x0e5c Object required for P2P: [ 9A262EDD17F8473B91B333D6B031A901 ] aspnet_state
10:41:34.0471 0x102c AVKProxy - ok
10:41:34.0502 0x102c AVKService - ok
10:41:34.0502 0x102c AVKWCtl - ok
10:41:34.0533 0x102c [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
10:41:34.0595 0x102c AxInstSV - ok
10:41:34.0642 0x102c [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
10:41:34.0720 0x102c b06bdrv - ok
10:41:34.0814 0x102c [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
10:41:34.0876 0x102c b57nd60a - ok
10:41:34.0923 0x102c [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
10:41:34.0985 0x102c BDESVC - ok
10:41:35.0032 0x102c [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
10:41:35.0110 0x102c Beep - ok
10:41:35.0173 0x102c [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
10:41:35.0251 0x102c BFE - ok
10:41:35.0344 0x102c [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\system32\qmgr.dll
10:41:35.0500 0x102c BITS - ok
10:41:35.0547 0x102c [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
10:41:35.0625 0x102c blbdrive - ok
10:41:35.0687 0x102c [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
10:41:35.0765 0x102c bowser - ok
10:41:35.0797 0x102c [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
10:41:35.0875 0x102c BrFiltLo - ok
10:41:35.0906 0x102c [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
10:41:35.0984 0x102c BrFiltUp - ok
10:41:36.0046 0x102c [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
10:41:36.0171 0x102c BridgeMP - ok
10:41:36.0218 0x102c [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
10:41:36.0280 0x102c Browser - ok
10:41:36.0327 0x102c [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
10:41:36.0405 0x102c Brserid - ok
10:41:36.0436 0x102c [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
10:41:36.0499 0x102c BrSerWdm - ok
10:41:36.0530 0x102c [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
10:41:36.0577 0x102c BrUsbMdm - ok
10:41:36.0592 0x102c [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
10:41:36.0623 0x102c BrUsbSer - ok
10:41:36.0655 0x102c [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
10:41:36.0701 0x102c BTHMODEM - ok
10:41:36.0748 0x102c [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
10:41:36.0826 0x102c bthserv - ok
10:41:36.0826 0x102c catchme - ok
10:41:36.0904 0x102c [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
10:41:36.0982 0x102c cdfs - ok
10:41:37.0013 0x102c [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
10:41:37.0029 0x0e5c Object send P2P result: true
10:41:37.0045 0x102c cdrom - ok
10:41:37.0060 0x102c [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
10:41:37.0123 0x102c CertPropSvc - ok
10:41:37.0154 0x102c [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\drivers\circlass.sys
10:41:37.0232 0x102c circlass - ok
10:41:37.0310 0x102c [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS C:\Windows\system32\CLFS.sys
10:41:37.0372 0x102c CLFS - ok
10:41:37.0575 0x102c [ 7E526C5B4DD233EBCF1EA3EC211E2913, 9DC99F18454001AF5462C773C174E2D6E503316550C7E9D7824E9CBC503FCA3B ] ClickToRunSvc C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
10:41:37.0715 0x102c ClickToRunSvc - ok
10:41:37.0778 0x102c [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:41:37.0856 0x102c clr_optimization_v2.0.50727_32 - ok
10:41:37.0934 0x102c [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
10:41:38.0012 0x102c clr_optimization_v2.0.50727_64 - ok
10:41:38.0059 0x102c [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:41:38.0121 0x102c clr_optimization_v4.0.30319_32 - ok
10:41:38.0137 0x102c [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
10:41:38.0183 0x102c clr_optimization_v4.0.30319_64 - ok
10:41:38.0215 0x102c [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\drivers\CmBatt.sys
10:41:38.0277 0x102c CmBatt - ok
10:41:38.0339 0x102c [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
10:41:38.0402 0x102c cmdide - ok
10:41:38.0480 0x102c [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG C:\Windows\system32\Drivers\cng.sys
10:41:38.0558 0x102c CNG - ok
10:41:38.0589 0x102c [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
10:41:38.0667 0x102c Compbatt - ok
10:41:38.0714 0x102c [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
10:41:38.0792 0x102c CompositeBus - ok
10:41:38.0807 0x102c COMSysApp - ok
10:41:38.0839 0x102c [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
10:41:38.0885 0x102c crcdisk - ok
10:41:38.0932 0x102c [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc C:\Windows\system32\cryptsvc.dll
10:41:38.0932 0x0ff8 Object required for P2P: [ DE3E38431B00C2EA247C53675DCF01A0 ] AudioEndpointBuilder
10:41:39.0010 0x102c CryptSvc - ok
10:41:39.0073 0x102c [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
10:41:39.0229 0x102c DcomLaunch - ok
10:41:39.0291 0x102c [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
10:41:39.0385 0x102c defragsvc - ok
10:41:39.0463 0x102c [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
10:41:39.0572 0x102c DfsC - ok
10:41:39.0697 0x102c [ D51B32BA3897F630D99713B74B40D6A2, 5EB136A8248E6FA1316CFA273D9DC8F9C8E8CCB9AC00AE23C1337FBF5F6FDBEC ] DfSdkS C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe
10:41:39.0759 0x102c DfSdkS - detected UnsignedFile.Multi.Generic ( 1 )
10:41:42.0271 0x102c Detect skipped due to KSN trusted
10:41:42.0271 0x102c DfSdkS - ok
10:41:42.0333 0x102c [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
10:41:42.0395 0x102c Dhcp - ok
10:41:42.0427 0x102c [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
10:41:42.0536 0x102c discache - ok
10:41:42.0567 0x102c [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\drivers\disk.sys
10:41:42.0614 0x102c Disk - ok
10:41:42.0645 0x102c [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
10:41:42.0707 0x102c Dnscache - ok
10:41:42.0754 0x102c [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
10:41:42.0832 0x102c dot3svc - ok
10:41:42.0863 0x102c [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
10:41:43.0004 0x102c DPS - ok
10:41:43.0051 0x102c [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
10:41:43.0097 0x102c drmkaud - ok
10:41:43.0144 0x102c [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
10:41:43.0269 0x102c DXGKrnl - ok
10:41:43.0316 0x102c [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
10:41:43.0425 0x102c EapHost - ok
10:41:43.0643 0x102c [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\drivers\evbda.sys
10:41:43.0831 0x102c ebdrv - ok
10:41:43.0893 0x102c [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS C:\Windows\System32\lsass.exe
10:41:43.0971 0x102c EFS - ok
10:41:44.0065 0x102c [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
10:41:44.0189 0x102c ehRecvr - ok
10:41:44.0236 0x102c [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
10:41:44.0299 0x102c ehSched - ok
10:41:44.0392 0x102c [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\drivers\elxstor.sys
10:41:44.0501 0x102c elxstor - ok
10:41:44.0533 0x102c [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
10:41:44.0579 0x102c ErrDev - ok
10:41:44.0657 0x102c [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
10:41:44.0751 0x102c EventSystem - ok
10:41:44.0782 0x102c [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
10:41:44.0845 0x102c exfat - ok
10:41:44.0891 0x102c [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
10:41:44.0954 0x102c fastfat - ok
10:41:45.0016 0x102c [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
10:41:45.0125 0x102c Fax - ok
10:41:45.0157 0x102c [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\drivers\fdc.sys
10:41:45.0219 0x102c fdc - ok
10:41:45.0250 0x102c [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
10:41:45.0328 0x102c fdPHost - ok
10:41:45.0359 0x102c [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
10:41:45.0469 0x102c FDResPub - ok
10:41:45.0515 0x102c [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
10:41:45.0609 0x102c FileInfo - ok
10:41:45.0625 0x102c [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
10:41:45.0749 0x102c Filetrace - ok
10:41:45.0796 0x102c [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
10:41:45.0859 0x102c flpydisk - ok
10:41:45.0921 0x102c [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
10:41:45.0999 0x102c FltMgr - ok
10:41:46.0124 0x102c [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache C:\Windows\system32\FntCache.dll
10:41:46.0233 0x102c FontCache - ok
10:41:46.0311 0x102c [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
10:41:46.0389 0x102c FontCache3.0.0.0 - ok
10:41:46.0420 0x102c [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
10:41:46.0483 0x102c FsDepends - ok
10:41:46.0529 0x102c [ DC0DCE4EC2C5D2CF6472F9FD6AA9A7DC, 7022722FA38E81F6F4D0EF9F0FBEDD27C09A238B5246A3C36AEAAC11FF76FE07 ] fssfltr C:\Windows\system32\DRIVERS\fssfltr.sys
10:41:46.0607 0x102c fssfltr - ok
10:41:46.0779 0x102c [ 40CDFAD174B3D5E80F95DDA003C0B97F, 2DA149CE42B87681ECDCC8905D0957443F430A9C7002FF78F22A95F9112A7C4C ] fsssvc C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
10:41:46.0951 0x102c fsssvc - ok
10:41:46.0997 0x102c [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
10:41:47.0075 0x102c Fs_Rec - ok
10:41:47.0138 0x102c [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
10:41:47.0200 0x102c fvevol - ok
10:41:47.0231 0x102c [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
10:41:47.0309 0x102c gagp30kx - ok
10:41:47.0356 0x102c [ 116F4672A804DA33E1159C005AE88B9C, 0720573DF5F957726F62397D8E63DB65FC3A045352FED98BAE57D3AC955A921F ] GDBehave C:\Windows\system32\drivers\GDBehave.sys
10:41:47.0419 0x102c GDBehave - ok
10:41:47.0419 0x102c GDFwSvc - ok
10:41:47.0465 0x102c [ E02AC68F1FC31D38EAD729E00BD68C93, 0FB31657421397D28DF502D25BABE0D43C269375CAEF8B4DAECFC3AB7468FB25 ] GDMnIcpt C:\Windows\system32\drivers\MiniIcpt.sys
10:41:47.0528 0x102c GDMnIcpt - ok
10:41:47.0575 0x102c [ 290DDB8C97249F99569B77E9DF2F76FC, 1741D9C510A1CC3951712F07B857B64A67504238EE7D710E1FB5951B7275940A ] GDPkIcpt C:\Windows\system32\drivers\PktIcpt.sys
10:41:47.0668 0x102c GDPkIcpt - ok
10:41:47.0746 0x102c [ 110C6DC36EA9F5DA664A584756B1B297, A107E46F1721176C8D60C2F93B4F9C7B66516D593AFA475DE14DEB1CC3739F3E ] GDScan C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
10:41:47.0855 0x102c GDScan - ok
10:41:47.0918 0x102c [ 876D6FA58981D073DD4063225370B12F, 72F0380C419535AB7C5BDE36CF3D9F9E4FA0C6D60F61962AA69C153194704D6F ] gdwfpcd C:\Windows\system32\drivers\gdwfpcd64.sys
10:41:47.0965 0x102c gdwfpcd - ok
10:41:48.0027 0x102c [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
10:41:48.0121 0x102c gpsvc - ok
10:41:48.0152 0x102c [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
10:41:48.0214 0x102c hcw85cir - ok
10:41:48.0261 0x102c [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
10:41:48.0339 0x102c HdAudAddService - ok
10:41:48.0401 0x102c [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
10:41:48.0479 0x102c HDAudBus - ok
10:41:48.0511 0x102c [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
10:41:48.0557 0x102c HidBatt - ok
10:41:48.0604 0x102c [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\drivers\hidbth.sys
10:41:48.0682 0x102c HidBth - ok
10:41:48.0713 0x102c [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\drivers\hidir.sys
10:41:48.0791 0x102c HidIr - ok
10:41:48.0823 0x102c [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\System32\hidserv.dll
10:41:48.0947 0x102c hidserv - ok
10:41:48.0994 0x102c [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\drivers\hidusb.sys
10:41:49.0072 0x102c HidUsb - ok
10:41:49.0119 0x102c [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
10:41:49.0228 0x102c hkmsvc - ok
10:41:49.0275 0x102c [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
10:41:49.0353 0x102c HomeGroupListener - ok
10:41:49.0400 0x102c [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
10:41:49.0462 0x102c HomeGroupProvider - ok
10:41:49.0478 0x102c [ 3CD18F0B3681FB267E67763CC3152D4E, 147A7F500E8648434B2271599315865B1808AD01F0BF1FAF7F759E2F357BEDC4 ] HookCentre C:\Windows\system32\drivers\HookCentre.sys
10:41:49.0540 0x102c HookCentre - ok
10:41:49.0571 0x102c [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
10:41:49.0665 0x102c HpSAMD - ok
10:41:49.0743 0x102c [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP C:\Windows\system32\drivers\HTTP.sys
10:41:49.0868 0x102c HTTP - ok
10:41:49.0868 0x102c [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
10:41:49.0915 0x102c hwpolicy - ok
10:41:49.0930 0x102c [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
10:41:49.0977 0x102c i8042prt - ok
10:41:50.0024 0x102c [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
10:41:50.0086 0x102c iaStorV - ok
10:41:50.0195 0x102c [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
10:41:50.0305 0x102c idsvc - ok
10:41:50.0351 0x102c IEEtwCollectorService - ok
10:41:50.0367 0x102c [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\drivers\iirsp.sys
10:41:50.0398 0x102c iirsp - ok
10:41:50.0461 0x102c [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
10:41:50.0632 0x102c IKEEXT - ok
10:41:50.0773 0x102c [ BC64B75E8E0A0B8982AB773483164E72, BF7CB0DEAAF78E20EA56B50FC177E99538FC4F29DA018D98E4286D122789435D ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
10:41:50.0929 0x102c IntcAzAudAddService - ok
10:41:50.0960 0x102c [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
10:41:51.0038 0x102c intelide - ok
10:41:51.0085 0x102c [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\drivers\intelppm.sys
10:41:51.0147 0x102c intelppm - ok
10:41:51.0163 0x102c [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
10:41:51.0225 0x102c IPBusEnum - ok
10:41:51.0256 0x102c [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
10:41:51.0365 0x102c IpFilterDriver - ok
10:41:51.0459 0x102c [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
10:41:51.0599 0x102c iphlpsvc - ok
10:41:51.0631 0x102c [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
10:41:51.0677 0x102c IPMIDRV - ok
10:41:51.0709 0x102c [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
10:41:51.0802 0x102c IPNAT - ok
10:41:51.0833 0x102c [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
10:41:51.0880 0x102c IRENUM - ok
10:41:51.0911 0x102c [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
10:41:51.0974 0x102c isapnp - ok
10:41:52.0036 0x102c [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
10:41:52.0145 0x102c iScsiPrt - ok
10:41:52.0161 0x102c [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
10:41:52.0239 0x102c kbdclass - ok
10:41:52.0286 0x102c [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
10:41:52.0333 0x102c kbdhid - ok
10:41:52.0364 0x102c [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso C:\Windows\system32\lsass.exe
10:41:52.0395 0x102c KeyIso - ok
10:41:52.0426 0x102c [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
10:41:52.0504 0x102c KSecDD - ok
10:41:52.0551 0x102c [ 41774FF331F609EF442B7398EE6202B1, AD67DA06A74895C384F4A1F1CF47050DAEE9C6CE8AD12F1A116FC977B6C3A864 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
10:41:52.0613 0x102c KSecPkg - ok
10:41:52.0691 0x102c [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
10:41:52.0785 0x102c ksthunk - ok
10:41:52.0847 0x102c [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
10:41:53.0003 0x102c KtmRm - ok
10:41:53.0050 0x102c [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\System32\srvsvc.dll
10:41:53.0128 0x102c LanmanServer - ok
10:41:53.0175 0x102c [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
10:41:53.0269 0x102c LanmanWorkstation - ok
10:41:53.0315 0x102c [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
10:41:53.0409 0x102c lltdio - ok
10:41:53.0487 0x102c [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
10:41:53.0612 0x102c lltdsvc - ok
10:41:53.0643 0x102c [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
10:41:53.0690 0x102c lmhosts - ok
10:41:53.0752 0x102c [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
10:41:53.0815 0x102c LSI_FC - ok
10:41:53.0846 0x102c [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
10:41:53.0893 0x102c LSI_SAS - ok
10:41:53.0924 0x102c [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
10:41:53.0939 0x102c LSI_SAS2 - ok
10:41:53.0971 0x102c [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
10:41:54.0017 0x102c LSI_SCSI - ok
10:41:54.0064 0x102c [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
10:41:54.0189 0x102c luafv - ok
10:41:54.0236 0x102c [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
10:41:54.0314 0x102c Mcx2Svc - ok
10:41:54.0345 0x102c [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\drivers\megasas.sys
10:41:54.0407 0x102c megasas - ok
10:41:54.0439 0x102c [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
10:41:54.0517 0x102c MegaSR - ok
10:41:54.0563 0x102c [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
10:41:54.0673 0x102c MMCSS - ok
10:41:54.0704 0x102c [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
10:41:54.0782 0x0ff8 Object send P2P result: true
10:41:54.0782 0x0ff8 Object required for P2P: [ DE3E38431B00C2EA247C53675DCF01A0 ] AudioSrv
10:41:54.0797 0x102c Modem - ok
10:41:54.0844 0x102c [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
10:41:54.0938 0x102c monitor - ok
10:41:54.0985 0x102c [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
10:41:55.0031 0x102c mouclass - ok
10:41:55.0047 0x102c [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
10:41:55.0094 0x102c mouhid - ok
10:41:55.0125 0x102c [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
10:41:55.0172 0x102c mountmgr - ok
10:41:55.0234 0x102c [ B4E9C7383A705628AD491CF0F87D901F, 5C0CD7133D4F5B1E0466CDB2A2210ECA57206A8BC41F37BC6324120AE5501C70 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
10:41:55.0281 0x102c MozillaMaintenance - ok
10:41:55.0328 0x102c [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
10:41:55.0375 0x102c mpio - ok
10:41:55.0406 0x102c [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
10:41:55.0484 0x102c mpsdrv - ok
10:41:55.0577 0x102c [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
10:41:55.0702 0x102c MpsSvc - ok
10:41:55.0733 0x102c [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
10:41:55.0765 0x102c MRxDAV - ok
10:41:55.0796 0x102c [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
10:41:55.0858 0x102c mrxsmb - ok
10:41:55.0889 0x102c [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
10:41:55.0967 0x102c mrxsmb10 - ok
10:41:55.0999 0x102c [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
10:41:56.0061 0x102c mrxsmb20 - ok
10:41:56.0108 0x102c [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
10:41:56.0186 0x102c msahci - ok
10:41:56.0233 0x102c [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
10:41:56.0279 0x102c msdsm - ok
10:41:56.0326 0x102c [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
10:41:56.0373 0x102c MSDTC - ok
10:41:56.0404 0x102c [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
10:41:56.0498 0x102c Msfs - ok
10:41:56.0529 0x102c [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
10:41:56.0607 0x102c mshidkmdf - ok
10:41:56.0654 0x102c [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
10:41:56.0716 0x102c msisadrv - ok
10:41:56.0763 0x102c [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
10:41:56.0857 0x102c MSiSCSI - ok
10:41:56.0857 0x102c msiserver - ok
10:41:56.0903 0x102c [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
10:41:57.0013 0x102c MSKSSRV - ok
10:41:57.0044 0x102c [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
10:41:57.0122 0x102c MSPCLOCK - ok
10:41:57.0137 0x102c [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
10:41:57.0184 0x102c MSPQM - ok
10:41:57.0247 0x102c [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
10:41:57.0325 0x0ff8 Object send P2P result: true
10:41:57.0340 0x102c MsRPC - ok
10:41:57.0371 0x102c [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
10:41:57.0418 0x102c mssmbios - ok
10:41:57.0465 0x102c [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
10:41:57.0559 0x102c MSTEE - ok
10:41:57.0590 0x102c [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
10:41:57.0637 0x102c MTConfig - ok
10:41:57.0683 0x102c [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
10:41:57.0730 0x102c Mup - ok
10:41:57.0808 0x102c [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
10:41:57.0949 0x102c napagent - ok
10:41:58.0011 0x102c [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
10:41:58.0089 0x102c NativeWifiP - ok
10:41:58.0167 0x102c [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS C:\Windows\system32\drivers\ndis.sys
10:41:58.0245 0x102c NDIS - ok
10:41:58.0276 0x102c [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
10:41:58.0354 0x102c NdisCap - ok
10:41:58.0385 0x102c [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
10:41:58.0479 0x102c NdisTapi - ok
10:41:58.0495 0x102c [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
10:41:58.0588 0x102c Ndisuio - ok
10:41:58.0620 0x102c [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
10:41:58.0729 0x102c NdisWan - ok
10:41:58.0776 0x102c [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
10:41:58.0869 0x102c NDProxy - ok
10:41:58.0900 0x102c [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
10:41:58.0994 0x102c NetBIOS - ok
10:41:59.0041 0x102c [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
10:41:59.0150 0x102c NetBT - ok
10:41:59.0181 0x102c [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon C:\Windows\system32\lsass.exe
10:41:59.0228 0x102c Netlogon - ok
10:41:59.0259 0x102c [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
10:41:59.0337 0x102c Netman - ok
10:41:59.0384 0x102c [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:41:59.0462 0x102c NetMsmqActivator - ok
10:41:59.0478 0x102c [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:41:59.0524 0x102c NetPipeActivator - ok
10:41:59.0571 0x102c [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
10:41:59.0634 0x102c netprofm - ok
10:41:59.0649 0x102c [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:41:59.0696 0x102c NetTcpActivator - ok
10:41:59.0712 0x102c [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
10:41:59.0758 0x102c NetTcpPortSharing - ok
10:41:59.0790 0x102c [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
10:41:59.0836 0x102c nfrd960 - ok
10:41:59.0899 0x102c [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc C:\Windows\System32\nlasvc.dll
10:41:59.0961 0x102c NlaSvc - ok
10:41:59.0977 0x102c [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
10:42:00.0008 0x102c Npfs - ok
10:42:00.0039 0x102c [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
10:42:00.0102 0x102c nsi - ok
10:42:00.0133 0x102c [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
10:42:00.0226 0x102c nsiproxy - ok
10:42:00.0382 0x102c [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
10:42:00.0507 0x102c Ntfs - ok
10:42:00.0523 0x102c [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
10:42:00.0601 0x102c Null - ok
10:42:00.0648 0x102c [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
10:42:00.0694 0x102c nvraid - ok
10:42:00.0741 0x102c [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
10:42:00.0788 0x102c nvstor - ok
10:42:00.0819 0x102c [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
10:42:00.0882 0x102c nv_agp - ok
10:42:00.0913 0x102c [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
10:42:00.0975 0x102c ohci1394 - ok
10:42:01.0053 0x102c [ 30B5F9FB0C35AE6B4A0851D24CE2EE8B, 0340E77E8EC2ADC21B8DDD9C9CC95B3F4BCAFD54618A333C72D7D9587D593B83 ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:42:01.0100 0x102c ose - ok
10:42:01.0334 0x102c [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
10:42:01.0786 0x102c osppsvc - ok
10:42:01.0833 0x102c [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
10:42:01.0927 0x102c p2pimsvc - ok
10:42:01.0989 0x102c [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
10:42:02.0083 0x102c p2psvc - ok
10:42:02.0145 0x102c [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\DRIVERS\parport.sys
10:42:02.0208 0x102c Parport - ok
10:42:02.0254 0x102c [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
10:42:02.0301 0x102c partmgr - ok
10:42:02.0348 0x102c [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc C:\Windows\System32\pcasvc.dll
10:42:02.0442 0x102c PcaSvc - ok
10:42:02.0473 0x102c [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
10:42:02.0535 0x102c pci - ok
10:42:02.0566 0x102c [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
10:42:02.0644 0x102c pciide - ok
10:42:02.0691 0x102c [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
10:42:02.0754 0x102c pcmcia - ok
10:42:02.0769 0x102c [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
10:42:02.0816 0x102c pcw - ok
10:42:02.0894 0x102c [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
10:42:03.0003 0x102c PEAUTH - ok
10:42:03.0066 0x102c [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
10:42:03.0128 0x102c PerfHost - ok
10:42:03.0237 0x102c [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
10:42:03.0362 0x102c pla - ok
10:42:03.0424 0x102c [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
10:42:03.0502 0x102c PlugPlay - ok
10:42:03.0534 0x102c [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
10:42:03.0565 0x102c PNRPAutoReg - ok
10:42:03.0580 0x102c [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
10:42:03.0612 0x102c PNRPsvc - ok
10:42:03.0674 0x102c [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
10:42:03.0768 0x102c PolicyAgent - ok
10:42:03.0830 0x102c [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
10:42:03.0892 0x102c Power - ok
10:42:03.0924 0x102c [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
10:42:04.0002 0x102c PptpMiniport - ok
10:42:04.0033 0x102c [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\drivers\processr.sys
10:42:04.0126 0x102c Processor - ok
10:42:04.0158 0x102c [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc C:\Windows\system32\profsvc.dll
10:42:04.0251 0x102c ProfSvc - ok
10:42:04.0267 0x102c [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
10:42:04.0314 0x102c ProtectedStorage - ok
10:42:04.0345 0x102c [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
10:42:04.0407 0x102c Psched - ok
10:42:04.0485 0x102c [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
10:42:04.0626 0x102c ql2300 - ok
10:42:04.0688 0x102c [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
10:42:04.0766 0x102c ql40xx - ok
10:42:04.0828 0x102c [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
10:42:04.0938 0x102c QWAVE - ok
10:42:04.0969 0x102c [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
10:42:05.0062 0x102c QWAVEdrv - ok
10:42:05.0094 0x102c [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
10:42:05.0140 0x102c RasAcd - ok
10:42:05.0172 0x102c [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
10:42:05.0250 0x102c RasAgileVpn - ok
10:42:05.0296 0x102c [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
10:42:05.0390 0x102c RasAuto - ok
10:42:05.0437 0x102c [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
10:42:05.0515 0x102c Rasl2tp - ok
10:42:05.0562 0x102c [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
10:42:05.0671 0x102c RasMan - ok
10:42:05.0671 0x102c [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
10:42:05.0718 0x102c RasPppoe - ok
10:42:05.0733 0x102c [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
10:42:05.0811 0x102c RasSstp - ok
10:42:05.0889 0x102c [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
10:42:06.0014 0x102c rdbss - ok
10:42:06.0030 0x102c [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\drivers\rdpbus.sys
10:42:06.0061 0x102c rdpbus - ok
10:42:06.0092 0x102c [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
10:42:06.0154 0x102c RDPCDD - ok
10:42:06.0170 0x102c [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
10:42:06.0201 0x102c RDPENCDD - ok
10:42:06.0217 0x102c [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
10:42:06.0264 0x102c RDPREFMP - ok
10:42:06.0279 0x102c [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
10:42:06.0373 0x102c RDPWD - ok
10:42:06.0420 0x102c [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
10:42:06.0513 0x102c rdyboost - ok
10:42:06.0560 0x102c [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
10:42:06.0716 0x102c RemoteAccess - ok
10:42:06.0763 0x102c [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
10:42:06.0872 0x102c RemoteRegistry - ok
10:42:06.0919 0x102c [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
10:42:07.0028 0x102c RpcEptMapper - ok
10:42:07.0059 0x102c [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
10:42:07.0090 0x102c RpcLocator - ok
10:42:07.0153 0x102c [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
10:42:07.0246 0x102c RpcSs - ok
10:42:07.0278 0x102c [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
10:42:07.0340 0x102c rspndr - ok
10:42:07.0371 0x102c [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs C:\Windows\system32\lsass.exe
10:42:07.0418 0x102c SamSs - ok
10:42:07.0449 0x102c [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
10:42:07.0496 0x102c sbp2port - ok
10:42:07.0543 0x102c [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
10:42:07.0636 0x102c SCardSvr - ok
10:42:07.0683 0x102c [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
10:42:07.0746 0x102c scfilter - ok
10:42:07.0808 0x102c [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
10:42:07.0995 0x102c Schedule - ok
10:42:08.0042 0x102c [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
10:42:08.0104 0x102c SCPolicySvc - ok
10:42:08.0136 0x102c [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
10:42:08.0198 0x102c SDRSVC - ok
10:42:08.0245 0x102c [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
10:42:08.0370 0x102c secdrv - ok
10:42:08.0401 0x102c [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
10:42:08.0479 0x102c seclogon - ok
10:42:08.0510 0x102c [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\system32\sens.dll
10:42:08.0604 0x102c SENS - ok
10:42:08.0619 0x102c [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
10:42:08.0666 0x102c SensrSvc - ok
10:42:08.0682 0x102c [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
10:42:08.0697 0x102c Serenum - ok
10:42:08.0744 0x102c [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
10:42:08.0775 0x102c Serial - ok
10:42:08.0806 0x102c [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\drivers\sermouse.sys
10:42:08.0869 0x102c sermouse - ok
10:42:08.0900 0x102c [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
10:42:08.0994 0x102c SessionEnv - ok
10:42:09.0025 0x102c [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
10:42:09.0103 0x102c sffdisk - ok
10:42:09.0134 0x102c [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
10:42:09.0181 0x102c sffp_mmc - ok
10:42:09.0181 0x102c [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
10:42:09.0243 0x102c sffp_sd - ok
10:42:09.0274 0x102c [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
10:42:09.0337 0x102c sfloppy - ok
10:42:09.0368 0x102c [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
10:42:09.0462 0x102c SharedAccess - ok
10:42:09.0508 0x102c [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
10:42:09.0664 0x102c ShellHWDetection - ok
10:42:09.0680 0x102c [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
10:42:09.0711 0x102c SiSRaid2 - ok
10:42:09.0727 0x102c [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
10:42:09.0774 0x102c SiSRaid4 - ok
10:42:09.0789 0x102c [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
10:42:09.0820 0x102c Smb - ok
10:42:09.0867 0x102c [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
10:42:09.0930 0x102c SNMPTRAP - ok
10:42:09.0976 0x102c [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
10:42:10.0039 0x102c spldr - ok
10:42:10.0101 0x102c [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
10:42:10.0179 0x102c Spooler - ok
10:42:10.0382 0x102c [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
10:42:10.0647 0x102c sppsvc - ok
10:42:10.0710 0x102c [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
10:42:10.0819 0x102c sppuinotify - ok
10:42:10.0897 0x102c [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
10:42:11.0006 0x102c srv - ok
10:42:11.0084 0x102c [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
10:42:11.0162 0x102c srv2 - ok
10:42:11.0193 0x102c [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
10:42:11.0256 0x102c srvnet - ok
10:42:11.0318 0x102c [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
10:42:11.0443 0x102c SSDPSRV - ok
10:42:11.0474 0x102c [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
10:42:11.0583 0x102c SstpSvc - ok
10:42:11.0630 0x102c [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\drivers\stexstor.sys
10:42:11.0677 0x102c stexstor - ok
10:42:11.0755 0x102c [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
10:42:11.0864 0x102c stisvc - ok
10:42:11.0880 0x102c [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
10:42:11.0942 0x102c swenum - ok
10:42:11.0989 0x102c [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
10:42:12.0098 0x102c swprv - ok
10:42:12.0223 0x102c [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
10:42:12.0410 0x102c SysMain - ok
10:42:12.0472 0x102c [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
10:42:12.0519 0x102c TabletInputService - ok
10:42:12.0550 0x102c [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
10:42:12.0613 0x102c TapiSrv - ok
10:42:12.0628 0x102c [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
10:42:12.0706 0x102c TBS - ok
10:42:12.0831 0x102c [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
10:42:13.0003 0x102c Tcpip - ok
10:42:13.0065 0x102c [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
10:42:13.0159 0x102c TCPIP6 - ok
10:42:13.0221 0x102c [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
10:42:13.0268 0x102c tcpipreg - ok
10:42:13.0284 0x102c [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
10:42:13.0346 0x102c TDPIPE - ok
10:42:13.0377 0x102c [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
10:42:13.0424 0x102c TDTCP - ok
10:42:13.0471 0x102c [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx C:\Windows\system32\DRIVERS\tdx.sys
10:42:13.0549 0x102c tdx - ok
10:42:13.0611 0x102c [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
10:42:13.0642 0x102c TermDD - ok
10:42:13.0705 0x102c [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService C:\Windows\System32\termsrv.dll
10:42:13.0767 0x102c TermService - ok
10:42:13.0798 0x102c [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
10:42:13.0830 0x102c Themes - ok
10:42:13.0845 0x102c [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
10:42:13.0908 0x102c THREADORDER - ok
10:42:13.0923 0x102c [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
10:42:13.0986 0x102c TrkWks - ok
10:42:14.0048 0x102c [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
10:42:14.0157 0x102c TrustedInstaller - ok
10:42:14.0204 0x102c [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
10:42:14.0251 0x102c tssecsrv - ok
10:42:14.0282 0x102c [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
10:42:14.0329 0x102c TsUsbFlt - ok
10:42:14.0376 0x102c [ 9CC2CCAE8A84820EAECB886D477CBCB8, 50D8AA2D7477A6618A0C31BB4D1C4887B457865FB1105E2E7B984EEFA337B804 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
10:42:14.0454 0x102c TsUsbGD - ok
10:42:14.0516 0x102c [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
10:42:14.0625 0x102c tunnel - ok
10:42:14.0641 0x102c [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
10:42:14.0656 0x102c uagp35 - ok
10:42:14.0672 0x102c [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
10:42:14.0719 0x102c udfs - ok
10:42:14.0766 0x102c [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
10:42:14.0812 0x102c UI0Detect - ok
10:42:14.0859 0x102c [ 34859D3801F4BD3DACFA131DD928455A, 337A111474D28B9B1DE3280925654F941804E4B1F13759B1664C5F7953A27521 ] UimBus C:\Windows\system32\DRIVERS\uimx64.sys
10:42:14.0890 0x102c UimBus - ok
10:42:14.0922 0x102c [ D3CE4776E7FFB25E6935B1C797F4650C, CF25CB7E596D8E4778E6B4C9D04D3AB7533E20234A76984FE9A010224F4F3EF8 ] Uim_IM C:\Windows\system32\Drivers\Uim_IMx64.sys
10:42:14.0984 0x102c Uim_IM - ok
10:42:15.0015 0x102c [ 532E4BED5C7803B2EE5681818B2528B7, DF1ED9C44D8DD2AFDDCC8D1F027840DAA560D5B72EB77A64A85541040364BD15 ] Uim_VIM C:\Windows\system32\Drivers\uim_vimx64.sys
10:42:15.0046 0x102c Uim_VIM - ok
10:42:15.0062 0x102c [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
10:42:15.0093 0x102c uliagpkx - ok
10:42:15.0109 0x102c [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\DRIVERS\umbus.sys
10:42:15.0171 0x102c umbus - ok
10:42:15.0202 0x102c [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\drivers\umpass.sys
10:42:15.0265 0x102c UmPass - ok
10:42:15.0312 0x102c [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
10:42:15.0436 0x102c upnphost - ok
10:42:15.0499 0x102c [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\drivers\usbccgp.sys
10:42:15.0530 0x102c usbccgp - ok
10:42:15.0561 0x102c [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
10:42:15.0608 0x102c usbcir - ok
10:42:15.0624 0x102c [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
10:42:15.0670 0x102c usbehci - ok
10:42:15.0748 0x102c [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
10:42:15.0826 0x102c usbhub - ok
10:42:15.0873 0x102c [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys
10:42:15.0920 0x102c usbohci - ok
10:42:15.0936 0x102c [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\drivers\usbprint.sys
10:42:15.0998 0x102c usbprint - ok
10:42:16.0014 0x102c [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
10:42:16.0060 0x102c USBSTOR - ok
10:42:16.0092 0x102c [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
10:42:16.0138 0x102c usbuhci - ok
10:42:16.0185 0x102c [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
10:42:16.0294 0x102c UxSms - ok
10:42:16.0326 0x102c [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc C:\Windows\system32\lsass.exe
10:42:16.0357 0x102c VaultSvc - ok
10:42:16.0435 0x102c [ 1352B215BDC5807A5641E7C143796DD7, B54F95307253BB81E4CEE4F2033782210652364DE6A1E833B27ECE7E04A2BD51 ] VBoxAswDrv C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys
10:42:16.0513 0x102c VBoxAswDrv - ok
10:42:16.0575 0x102c [ B0A8C5BC95689A130F9E05492341833D, 8DDC6D77B0541813919B685D2DFCDFA4F752F8DD99400DA87523F8D2E9D72D27 ] VBoxNetAdp C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
10:42:16.0669 0x102c VBoxNetAdp - ok
10:42:16.0669 0x102c VBoxNetFlt - ok
10:42:16.0731 0x102c [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
10:42:16.0809 0x102c vdrvroot - ok
10:42:16.0872 0x102c [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
10:42:16.0981 0x102c vds - ok
10:42:16.0996 0x102c [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
10:42:17.0012 0x102c vga - ok
10:42:17.0043 0x102c [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
10:42:17.0121 0x102c VgaSave - ok
10:42:17.0152 0x102c [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
10:42:17.0262 0x102c vhdmp - ok
10:42:17.0308 0x102c [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
10:42:17.0371 0x102c viaide - ok
10:42:17.0418 0x102c [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
10:42:17.0480 0x102c volmgr - ok
10:42:17.0542 0x102c [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
10:42:17.0589 0x102c volmgrx - ok
10:42:17.0605 0x102c [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
10:42:17.0636 0x102c volsnap - ok
10:42:17.0667 0x102c [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
10:42:17.0730 0x102c vsmraid - ok
10:42:17.0839 0x102c [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
10:42:17.0995 0x102c VSS - ok
10:42:18.0042 0x102c [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
10:42:18.0088 0x102c vwifibus - ok
10:42:18.0166 0x102c [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
10:42:18.0322 0x102c W32Time - ok
10:42:18.0369 0x102c [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
10:42:18.0432 0x102c WacomPen - ok
10:42:18.0447 0x102c [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
10:42:18.0510 0x102c WANARP - ok
10:42:18.0525 0x102c [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
10:42:18.0588 0x102c Wanarpv6 - ok
10:42:18.0697 0x102c [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
10:42:18.0806 0x102c WatAdminSvc - ok
10:42:18.0946 0x102c [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
10:42:19.0134 0x102c wbengine - ok
10:42:19.0165 0x102c [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
10:42:19.0243 0x102c WbioSrvc - ok
10:42:19.0274 0x102c [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
10:42:19.0383 0x102c wcncsvc - ok
10:42:19.0430 0x102c [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
10:42:19.0492 0x102c WcsPlugInService - ok
10:42:19.0539 0x102c [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\drivers\wd.sys
10:42:19.0602 0x102c Wd - ok
10:42:19.0695 0x102c [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
10:42:19.0804 0x102c Wdf01000 - ok
10:42:19.0836 0x102c [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost C:\Windows\system32\wdi.dll
10:42:19.0914 0x102c WdiServiceHost - ok
10:42:19.0929 0x102c [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost C:\Windows\system32\wdi.dll
10:42:19.0976 0x102c WdiSystemHost - ok
10:42:20.0007 0x102c [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient C:\Windows\System32\webclnt.dll
10:42:20.0070 0x102c WebClient - ok
10:42:20.0085 0x102c [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
10:42:20.0148 0x102c Wecsvc - ok
10:42:20.0179 0x102c [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
10:42:20.0257 0x102c wercplsupport - ok
10:42:20.0288 0x102c [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
10:42:20.0335 0x102c WerSvc - ok
10:42:20.0366 0x102c [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
10:42:20.0397 0x102c WfpLwf - ok
10:42:20.0413 0x102c [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
10:42:20.0428 0x102c WIMMount - ok
10:42:20.0460 0x102c WinDefend - ok
10:42:20.0475 0x102c WinHttpAutoProxySvc - ok
10:42:20.0553 0x102c [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
10:42:20.0553 0x1354 Object required for P2P: [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC
10:42:20.0662 0x102c Winmgmt - ok
10:42:20.0787 0x102c [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM C:\Windows\system32\WsmSvc.dll
10:42:20.0974 0x102c WinRM - ok
10:42:21.0021 0x102c [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
10:42:21.0084 0x102c WinUsb - ok
10:42:21.0177 0x102c [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
10:42:21.0255 0x102c Wlansvc - ok
10:42:21.0302 0x102c [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
10:42:21.0380 0x102c wlcrasvc - ok
10:42:21.0536 0x102c [ 2BACD71123F42CEA603F4E205E1AE337, 1FEF20554110371D738F462ECFFA999158EFEED02062414C58C1B61C422BF0B9 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
10:42:21.0801 0x102c wlidsvc - ok
10:42:21.0832 0x102c [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
10:42:21.0879 0x102c WmiAcpi - ok
10:42:21.0942 0x102c [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
10:42:21.0973 0x102c wmiApSrv - ok
10:42:22.0004 0x102c WMPNetworkSvc - ok
10:42:22.0035 0x102c [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
10:42:22.0082 0x102c WPCSvc - ok
10:42:22.0129 0x102c [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
10:42:22.0176 0x102c WPDBusEnum - ok
10:42:22.0207 0x102c [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
10:42:22.0269 0x102c ws2ifsl - ok
10:42:22.0316 0x102c [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\system32\wscsvc.dll
10:42:22.0394 0x102c wscsvc - ok
10:42:22.0410 0x102c WSearch - ok
10:42:22.0534 0x102c [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv C:\Windows\system32\wuaueng.dll
10:42:22.0722 0x102c wuauserv - ok
10:42:22.0784 0x102c [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
10:42:22.0862 0x102c WudfPf - ok
10:42:22.0909 0x102c [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
10:42:22.0956 0x102c WUDFRd - ok
10:42:22.0971 0x102c [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
10:42:23.0002 0x102c wudfsvc - ok
10:42:23.0049 0x102c [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\Windows\System32\wwansvc.dll
10:42:23.0143 0x102c WwanSvc - ok
10:42:23.0190 0x102c [ 64F88AF327AA74E03658AE32B48CCB8B, 52C8941D96F2EF89BBC4A4268DC59E5BC89AE2DAB199C13BBFF11C2606BE7FFA ] yukonw7 C:\Windows\system32\DRIVERS\yk62x64.sys
10:42:23.0299 0x102c yukonw7 - ok
10:42:23.0299 0x102c ================ Scan global ===============================
10:42:23.0361 0x102c [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
10:42:23.0408 0x102c [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
10:42:23.0439 0x102c [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
10:42:23.0470 0x102c [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
10:42:23.0517 0x102c [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
10:42:23.0533 0x102c [ Global ] - ok
10:42:23.0533 0x102c ================ Scan MBR ==================================
10:42:23.0533 0x102c [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
10:42:23.0829 0x102c \Device\Harddisk0\DR0 - ok
10:42:23.0829 0x102c ================ Scan VBR ==================================
10:42:23.0845 0x102c [ 0F53A985675CD82B649C5A064EEF248C ] \Device\Harddisk0\DR0\Partition1
10:42:23.0845 0x102c \Device\Harddisk0\DR0\Partition1 - ok
10:42:23.0845 0x102c ================ Scan generic autorun ======================
10:42:24.0204 0x102c [ 02C60C606B17D7797377F1AC837EA070, AE1E7BF36E51B655A7516D7CCC79BB53BDE6CA15BF5AF37DB65AE242835E1FC2 ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
10:42:24.0765 0x102c RtHDVCpl - ok
10:42:24.0781 0x102c Waiting for KSN requests completion. In queue: 325
10:42:25.0795 0x102c Waiting for KSN requests completion. In queue: 325
10:42:26.0809 0x102c Waiting for KSN requests completion. In queue: 325
10:42:27.0823 0x102c Waiting for KSN requests completion. In queue: 285
10:42:28.0837 0x102c Waiting for KSN requests completion. In queue: 285
10:42:29.0851 0x102c Waiting for KSN requests completion. In queue: 285
10:42:30.0865 0x102c Waiting for KSN requests completion. In queue: 285
10:42:31.0879 0x102c Waiting for KSN requests completion. In queue: 285
10:42:32.0893 0x102c Waiting for KSN requests completion. In queue: 285
10:42:33.0907 0x102c Waiting for KSN requests completion. In queue: 285
10:42:34.0921 0x102c Waiting for KSN requests completion. In queue: 285
10:42:35.0935 0x102c Waiting for KSN requests completion. In queue: 285
10:42:36.0949 0x102c Waiting for KSN requests completion. In queue: 285
10:42:37.0963 0x102c Waiting for KSN requests completion. In queue: 285
10:42:38.0977 0x102c Waiting for KSN requests completion. In queue: 285
10:42:39.0991 0x102c Waiting for KSN requests completion. In queue: 285
10:42:40.0584 0x1354 Object send P2P result: false
10:42:40.0599 0x1354 Object required for P2P: [ DC0DCE4EC2C5D2CF6472F9FD6AA9A7DC ] fssfltr
10:42:41.0005 0x102c Waiting for KSN requests completion. In queue: 250
10:42:42.0019 0x102c Waiting for KSN requests completion. In queue: 250
10:42:43.0033 0x102c Waiting for KSN requests completion. In queue: 250
10:42:43.0142 0x1354 Object send P2P result: true
10:42:43.0142 0x1354 Object required for P2P: [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV
10:42:44.0047 0x102c Waiting for KSN requests completion. In queue: 223
10:42:45.0061 0x102c Waiting for KSN requests completion. In queue: 223
10:42:45.0732 0x1354 Object send P2P result: true
10:42:45.0732 0x1354 Object required for P2P: [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci
10:42:46.0075 0x102c Waiting for KSN requests completion. In queue: 174
10:42:47.0089 0x102c Waiting for KSN requests completion. In queue: 174
10:42:48.0103 0x102c Waiting for KSN requests completion. In queue: 174
10:42:48.0446 0x1354 Object send P2P result: true
10:42:48.0477 0x1354 Object required for P2P: [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port
10:42:49.0117 0x102c Waiting for KSN requests completion. In queue: 86
10:42:50.0131 0x102c Waiting for KSN requests completion. In queue: 86
10:42:51.0145 0x102c Waiting for KSN requests completion. In queue: 86
10:42:52.0159 0x102c Waiting for KSN requests completion. In queue: 86
10:42:53.0173 0x102c Waiting for KSN requests completion. In queue: 86
10:42:54.0187 0x102c Waiting for KSN requests completion. In queue: 86
10:42:55.0201 0x102c Waiting for KSN requests completion. In queue: 86
10:42:56.0215 0x102c Waiting for KSN requests completion. In queue: 86
10:42:57.0229 0x102c Waiting for KSN requests completion. In queue: 86
10:42:58.0243 0x102c Waiting for KSN requests completion. In queue: 86
10:42:59.0257 0x102c Waiting for KSN requests completion. In queue: 86
10:43:00.0271 0x102c Waiting for KSN requests completion. In queue: 86
10:43:01.0285 0x102c Waiting for KSN requests completion. In queue: 86
10:43:02.0299 0x102c Waiting for KSN requests completion. In queue: 86
10:43:03.0313 0x102c Waiting for KSN requests completion. In queue: 86
10:43:04.0327 0x102c Waiting for KSN requests completion. In queue: 86
10:43:05.0341 0x102c Waiting for KSN requests completion. In queue: 86
10:43:06.0355 0x102c Waiting for KSN requests completion. In queue: 86
10:43:07.0369 0x102c Waiting for KSN requests completion. In queue: 86
10:43:08.0383 0x102c Waiting for KSN requests completion. In queue: 86
10:43:08.0508 0x1354 Object send P2P result: false
10:43:08.0523 0x1354 Object required for P2P: [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2
10:43:09.0397 0x102c Waiting for KSN requests completion. In queue: 58
10:43:10.0411 0x102c Waiting for KSN requests completion. In queue: 58
10:43:11.0082 0x1354 Object send P2P result: true
10:43:11.0097 0x1354 Object required for P2P: [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave
10:43:11.0425 0x102c Waiting for KSN requests completion. In queue: 7
10:43:12.0439 0x102c Waiting for KSN requests completion. In queue: 7
10:43:13.0453 0x102c Waiting for KSN requests completion. In queue: 7
10:43:14.0467 0x102c Waiting for KSN requests completion. In queue: 7
10:43:15.0481 0x102c Waiting for KSN requests completion. In queue: 7
10:43:16.0495 0x102c Waiting for KSN requests completion. In queue: 7
10:43:17.0509 0x102c Waiting for KSN requests completion. In queue: 7
10:43:18.0523 0x102c Waiting for KSN requests completion. In queue: 7
10:43:19.0537 0x102c Waiting for KSN requests completion. In queue: 7
10:43:20.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:21.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:22.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:23.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:24.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:25.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:26.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:27.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:28.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:29.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:30.0551 0x102c Waiting for KSN requests completion. In queue: 7
10:43:31.0117 0x1354 Object send P2P result: false
10:43:31.0119 0x1354 Object required for P2P: [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid
10:43:31.0551 0x102c Waiting for KSN requests completion. In queue: 1
10:43:32.0552 0x102c Waiting for KSN requests completion. In queue: 1
10:43:33.0552 0x102c Waiting for KSN requests completion. In queue: 1
10:43:33.0663 0x1354 Object send P2P result: true
10:43:34.0628 0x102c AV detected via SS2: avast! Antivirus, C:\Program Files\AVAST Software\Avast\VisthAux.exe ( 10.0.2208.712 ), 0x41000 ( enabled : updated )
10:43:34.0669 0x102c Win FW state via NFP2: enabled
10:43:37.0142 0x102c ============================================================
10:43:37.0142 0x102c Scan finished
10:43:37.0142 0x102c ============================================================
10:43:37.0167 0x1338 Detected object count: 0
10:43:37.0167 0x1338 Actual detected object count: 0

ups sorry, hatte das erste mal mit STRG+V gearbeitet und dachte, ich könnte mir die raute dann sparen...war wohl leider falsch.

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

TreeSize Free - Download - Filepony
TreeSize laden und installieren. Scannen lassen. Wenn der Scan der Platte fertig ist bitte einen Screenshot machen.
Screenshot unter Windows erstellen - so geht's - Anleitungen

Hi Schrauber,
hier ist der combofix-log
Combofix Logfile:

Code:

ComboFix 15-02-02.01 - ThoMi 07.02.2015  17:45:10.2.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3839.2505 [GMT 1:00]

ausgeführt von:: c:\users\ThoMi\Downloads\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2015-01-07 bis 2015-02-07  ))))))))))))))))))))))))))))))

.

.

2015-02-07 16:49 . 2015-02-07 16:49        --------        d-----w-        c:\users\Public\AppData\Local\temp

2015-02-07 16:49 . 2015-02-07 16:49        --------        d-----w-        c:\users\Default\AppData\Local\temp

2015-02-07 09:38 . 2015-02-07 09:38        75888        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6689C616-F615-4CA3-AF66-B7544DD3C67E}\offreg.dll

2015-02-06 23:07 . 2014-12-02 10:26        11870360        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6689C616-F615-4CA3-AF66-B7544DD3C67E}\mpengine.dll

2015-01-29 04:52 . 2015-01-29 04:52        73816        ----a-w-        c:\program files (x86)\Mozilla Firefox\wow_helper.exe

2015-01-28 21:04 . 2015-02-07 06:35        129752        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys

2015-01-28 21:04 . 2015-01-28 21:04        --------        d-----w-        c:\program files (x86)\Malwarebytes Anti-Malware

2015-01-28 21:04 . 2014-11-21 05:14        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys

2015-01-28 21:04 . 2014-11-21 05:14        93400        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2015-01-28 21:04 . 2014-11-21 05:14        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys

2015-01-14 01:09 . 2014-12-11 17:47        52736        ----a-w-        c:\windows\system32\TSWbPrxy.exe

2015-01-14 01:09 . 2014-12-19 03:06        210432        ----a-w-        c:\windows\system32\profsvc.dll

2015-01-14 01:08 . 2014-12-06 04:17        303616        ----a-w-        c:\windows\system32\nlasvc.dll

2015-01-14 01:08 . 2014-12-06 03:50        156672        ----a-w-        c:\windows\SysWow64\ncsi.dll

2015-01-14 01:08 . 2014-12-06 03:50        52224        ----a-w-        c:\windows\SysWow64\nlaapi.dll

2015-01-14 01:08 . 2014-12-19 01:46        141312        ----a-w-        c:\windows\system32\drivers\mrxdav.sys

2015-01-14 01:08 . 2014-12-12 05:35        5553592        ----a-w-        c:\windows\system32\ntoskrnl.exe

2015-01-14 01:08 . 2014-12-12 05:11        3971512        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2015-01-14 01:08 . 2014-12-12 05:11        3916728        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2015-01-14 01:08 . 2014-12-12 05:31        503808        ----a-w-        c:\windows\system32\srcore.dll

2015-01-14 01:08 . 2014-12-12 05:31        50176        ----a-w-        c:\windows\system32\srclient.dll

2015-01-14 01:08 . 2014-12-12 05:31        296960        ----a-w-        c:\windows\system32\rstrui.exe

2015-01-14 01:08 . 2014-12-12 05:07        43008        ----a-w-        c:\windows\SysWow64\srclient.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2015-02-05 12:51 . 2014-06-14 14:12        163504        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin

2015-02-04 20:46 . 2013-01-05 20:07        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2015-02-04 20:46 . 2013-01-05 20:07        701616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2015-01-14 01:17 . 2012-12-12 16:04        113365784        ----a-w-        c:\windows\system32\MRT.exe

2015-01-06 03:36 . 2010-11-21 03:27        298120        ------w-        c:\windows\system32\MpSigStub.exe

2014-12-13 05:09 . 2014-12-18 04:24        144384        ----a-w-        c:\windows\system32\ieUnatt.exe

2014-12-13 03:33 . 2014-12-18 04:24        115712        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2014-12-04 02:50 . 2014-12-10 11:35        413184        ----a-w-        c:\windows\system32\generaltel.dll

2014-12-04 02:50 . 2014-12-10 11:35        741376        ----a-w-        c:\windows\system32\invagent.dll

2014-12-04 02:50 . 2014-12-10 11:35        396800        ----a-w-        c:\windows\system32\devinv.dll

2014-12-04 02:50 . 2014-12-10 11:35        830976        ----a-w-        c:\windows\system32\appraiser.dll

2014-12-04 02:50 . 2014-12-10 11:35        192000        ----a-w-        c:\windows\system32\aepic.dll

2014-12-04 02:50 . 2014-12-10 11:35        227328        ----a-w-        c:\windows\system32\aepdu.dll

2014-12-04 02:44 . 2014-12-10 11:35        1083392        ----a-w-        c:\windows\system32\aeinv.dll

2014-12-01 23:28 . 2014-12-10 11:35        1232040        ----a-w-        c:\windows\system32\aitstatic.exe

2014-11-27 01:43 . 2014-12-10 11:34        389296        ----a-w-        c:\windows\system32\iedkcs32.dll

2014-11-25 11:46 . 2014-07-22 16:10        1050432        ----a-w-        c:\windows\system32\drivers\aswsnx.sys

2014-11-25 11:45 . 2014-11-25 11:45        364512        ----a-w-        c:\windows\system32\aswBoot.exe

2014-11-25 11:45 . 2014-07-22 16:10        267632        ----a-w-        c:\windows\system32\drivers\aswVmm.sys

2014-11-25 11:45 . 2014-07-22 16:10        116728        ----a-w-        c:\windows\system32\drivers\aswStm.sys

2014-11-25 11:45 . 2014-07-22 16:10        436624        ----a-w-        c:\windows\system32\drivers\aswsp.sys

2014-11-25 11:45 . 2014-07-22 16:10        83280        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2014-11-25 11:45 . 2014-07-22 16:10        65776        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys

2014-11-25 11:45 . 2014-07-22 16:10        29208        ----a-w-        c:\windows\system32\drivers\aswHwid.sys

2014-11-25 11:45 . 2014-07-22 16:10        93568        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys

2014-11-25 11:45 . 2014-11-25 11:45        43152        ----a-w-        c:\windows\avastSS.scr

2014-11-22 03:13 . 2014-12-10 11:34        25059840        ----a-w-        c:\windows\system32\mshtml.dll

2014-11-22 03:06 . 2014-12-10 11:35        2724864        ----a-w-        c:\windows\system32\mshtml.tlb

2014-11-22 03:06 . 2014-12-10 11:34        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll

2014-11-22 02:50 . 2014-12-10 11:34        66560        ----a-w-        c:\windows\system32\iesetup.dll

2014-11-22 02:50 . 2014-12-10 11:34        580096        ----a-w-        c:\windows\system32\vbscript.dll

2014-11-22 02:49 . 2014-12-10 11:35        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll

2014-11-22 02:49 . 2014-12-10 11:34        2885120        ----a-w-        c:\windows\system32\iertutil.dll

2014-11-22 02:48 . 2014-12-10 11:34        88064        ----a-w-        c:\windows\system32\MshtmlDac.dll

2014-11-22 02:41 . 2014-12-10 11:34        54784        ----a-w-        c:\windows\system32\jsproxy.dll

2014-11-22 02:40 . 2014-12-10 11:35        34304        ----a-w-        c:\windows\system32\iernonce.dll

2014-11-22 02:37 . 2014-12-10 11:34        633856        ----a-w-        c:\windows\system32\ieui.dll

2014-11-22 02:35 . 2014-12-10 11:35        114688        ----a-w-        c:\windows\system32\ieetwcollector.exe

2014-11-22 02:34 . 2014-12-10 11:34        814080        ----a-w-        c:\windows\system32\jscript9diag.dll

2014-11-22 02:34 . 2014-12-10 11:34        6039552        ----a-w-        c:\windows\system32\jscript9.dll

2014-11-22 02:26 . 2014-12-10 11:34        968704        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2014-11-22 02:22 . 2014-12-10 11:34        490496        ----a-w-        c:\windows\system32\dxtmsft.dll

2014-11-22 02:20 . 2014-12-10 11:34        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2014-11-22 02:14 . 2014-12-10 11:35        77824        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll

2014-11-22 02:09 . 2014-12-10 11:34        199680        ----a-w-        c:\windows\system32\msrating.dll

2014-11-22 02:08 . 2014-12-10 11:34        92160        ----a-w-        c:\windows\system32\mshtmled.dll

2014-11-22 02:07 . 2014-12-10 11:34        501248        ----a-w-        c:\windows\SysWow64\vbscript.dll

2014-11-22 02:07 . 2014-12-10 11:34        62464        ----a-w-        c:\windows\SysWow64\iesetup.dll

2014-11-22 02:06 . 2014-12-10 11:35        47616        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll

2014-11-22 02:05 . 2014-12-10 11:34        64000        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll

2014-11-22 02:05 . 2014-12-10 11:34        316928        ----a-w-        c:\windows\system32\dxtrans.dll

2014-11-22 01:54 . 2014-12-10 11:34        620032        ----a-w-        c:\windows\SysWow64\jscript9diag.dll

2014-11-22 01:49 . 2014-12-10 11:35        718848        ----a-w-        c:\windows\system32\ie4uinit.exe

2014-11-22 01:49 . 2014-12-10 11:34        800768        ----a-w-        c:\windows\system32\msfeeds.dll

2014-11-22 01:47 . 2014-12-10 11:34        1359360        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2014-11-22 01:46 . 2014-12-10 11:34        2125312        ----a-w-        c:\windows\system32\inetcpl.cpl

2014-11-22 01:43 . 2014-12-10 11:34        14412800        ----a-w-        c:\windows\system32\ieframe.dll

2014-11-22 01:40 . 2014-12-10 11:35        60416        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll

2014-11-22 01:29 . 2014-12-10 11:34        4299264        ----a-w-        c:\windows\SysWow64\jscript9.dll

2014-11-22 01:28 . 2014-12-10 11:34        2358272        ----a-w-        c:\windows\system32\wininet.dll

2014-11-22 01:22 . 2014-12-10 11:34        2052096        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2014-11-22 01:21 . 2014-12-10 11:34        1155072        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2014-11-22 01:15 . 2014-12-10 11:34        1548288        ----a-w-        c:\windows\system32\urlmon.dll

2014-11-22 01:03 . 2014-12-10 11:34        800768        ----a-w-        c:\windows\system32\ieapfltr.dll

2014-11-22 01:00 . 2014-12-10 11:34        1888256        ----a-w-        c:\windows\SysWow64\wininet.dll

2014-11-11 03:09 . 2014-12-10 11:35        1424384        ----a-w-        c:\windows\system32\WindowsCodecs.dll

2014-11-11 03:08 . 2014-11-19 03:43        241152        ----a-w-        c:\windows\system32\pku2u.dll

2014-11-11 03:08 . 2014-11-19 03:43        728064        ----a-w-        c:\windows\system32\kerberos.dll

2014-11-11 02:44 . 2014-12-10 11:35        1230336        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll

2014-11-11 02:44 . 2014-11-19 03:43        186880        ----a-w-        c:\windows\SysWow64\pku2u.dll

2014-11-11 02:44 . 2014-11-19 03:43        550912        ----a-w-        c:\windows\SysWow64\kerberos.dll

2014-11-11 01:46 . 2014-12-10 11:35        119296        ----a-w-        c:\windows\system32\drivers\tdx.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2014-11-12 00:41        1729744        ----a-w-        c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2014-11-12 00:41        1729744        ----a-w-        c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2014-11-12 00:41        1729744        ----a-w-        c:\program files\Microsoft Office 15\root\office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-01-27 5227112]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"EnableSecureUIAPath"= 1 (0x1)

"SoftwareSASGeneration"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoFileAssociate"= 0 (0x0)

.

R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [x]

R3 DfSdkS;Defragmentation-Service;c:\program files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe;c:\program files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [x]

R3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [x]

R3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys;c:\windows\SYSNATIVE\drivers\PktIcpt.sys [x]

R3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]

R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [x]

R4 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [x]

R4 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys;c:\windows\SYSNATIVE\drivers\GDBehave.sys [x]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys;c:\windows\SYSNATIVE\drivers\MiniIcpt.sys [x]

S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys;c:\windows\SYSNATIVE\drivers\gdwfpcd64.sys [x]

S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys;c:\windows\SYSNATIVE\drivers\HookCentre.sys [x]

S1 Uim_VIM;UIM Virtual Image Plugin;c:\windows\system32\Drivers\uim_vimx64.sys;c:\windows\SYSNATIVE\Drivers\uim_vimx64.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S2 ClickToRunSvc;Microsoft Office-Klick-und-Los-Dienst;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]

S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [x]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - 03358929

*NewlyCreated* - 84119081

*Deregistered* - 03358929

*Deregistered* - 84119081

.

Inhalt des "geplante Tasks" Ordners

.

2015-02-07 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-05 20:46]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2014-11-12 08:07        2334928        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2014-11-12 08:07        2334928        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2014-11-12 08:07        2334928        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2014-11-25 11:45        860984        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://google.de/

mDefault_Search_URL = www.google.com

mDefault_Page_URL = about:blank

mStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

mSearch Page = www.google.com

IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000

IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\

FF - prefs.js: browser.startup.homepage - www.google.de

FF - user.js: network.prefetch-next - true

FF - user.js: layout.spellcheckDefault - 1

FF - user.js: browser.search.openintab - false

FF - user.js: browser.tabs.closeButtons - 1

FF - user.js: browser.tabs.opentabfor.middleclick - true

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

BHO-{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2015-02-07  17:51:53

ComboFix-quarantined-files.txt  2015-02-07 16:51

ComboFix2.txt  2015-02-07 16:39

.

Vor Suchlauf: 8.915.050.496 Bytes frei

Nach Suchlauf: 8.843.231.232 Bytes frei

.

- - End Of File - - 2A3ABC4824B657C8001D1C6DD9C17F35

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31

[/CODE]

Grüße

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo Schrauber,
so, hier alle gewünschten logs. Leider im FRST immer noch die beiden ATTENTION-Hinweise.
Viele Grüße und erneut Danke im Voraus
Michael

1. MBAM-Log

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 08.02.2015

Suchlauf-Zeit: 10:55:16

Logdatei: MBAM-Log.txt

Administrator: Ja
 

Version: 2.00.4.1028

Malware Datenbank: v2015.02.08.04

Rootkit Datenbank: v2015.02.03.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: ThoMi
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 343302

Verstrichene Zeit: 15 Min, 42 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente erkannt)
 

Module: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente erkannt)
 

Registrierungswerte: 0

(Keine schädliche Elemente erkannt)
 

Registrierungsdaten: 0

(Keine schädliche Elemente erkannt)
 

Ordner: 0

(Keine schädliche Elemente erkannt)
 

Dateien: 0

(Keine schädliche Elemente erkannt)
 

Physische Sektoren: 0

(Keine schädliche Elemente erkannt)
 
 

(end)

2. AdwCleaner-Log

Code:

# AdwCleaner v4.110 - Bericht erstellt 08/02/2015 um 11:19:29

# Aktualisiert 05/02/2015 von Xplode

# Datenbank : 2015-02-05.2 [Server]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)

# Benutzername : ThoMi - PC

# Gestarted von : C:\Users\ThoMi\Downloads\AdwCleaner_4.110.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Users\ThoMi\AppData\Roaming\Mipony

Datei Gelöscht : C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\user.js
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

Schlüssel Gelöscht : HKCU\Software\OCS
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17496
 
 

-\\ Mozilla Firefox v35.0.1 (x86 en-US)
 
 

*************************
 

AdwCleaner[R0].txt - [1365 Bytes] - [08/02/2015 11:12:31]

AdwCleaner[S0].txt - [1241 Bytes] - [08/02/2015 11:19:29]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1300  Bytes] ##########

3. JRT-Log

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.2 (02.02.2015:1)

OS: Windows 7 Home Premium x64

Ran by ThoMi on 08.02.2015 at 17:06:32,83

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\ThoMi\AppData\Roaming\mozilla\firefox\profiles\b6jnoyg7.default-1385925042425\minidumps [9 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 08.02.2015 at 17:10:15,24

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4. FRST-Log neu

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2015

Ran by ThoMi (administrator) on PC on 08-02-2015 17:13:24

Running from C:\Users\ThoMi\Downloads

Loaded Profiles: ThoMi (Available profiles: ThoMi)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: G Data BankGuard -> {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} -> C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Extension: Download videos and MP3s from YouTube - C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-23]

FF Extension: Deutsch (DE) Language Pack - C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-03-22]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-07-22]

FF HKU\S-1-5-21-3296977853-467173732-4196599000-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-23]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-25]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-25] (AVAST Software)

S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-25] (Avast Software)

S4 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1540632 2012-06-29] (G Data Software AG)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)

S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [544768 2009-08-24] (mst software GmbH, Germany) [File not signed]

S3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [470008 2012-03-29] (G Data Software AG)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S4 AVKService; "C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe" [X]

S4 AVKWCtl; "C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe" [X]

S3 GDFwSvc; "C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-25] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-25] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-25] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-25] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-25] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-25] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-25] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-25] ()

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [54136 2013-01-04] (G Data Software AG)

R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [122744 2013-01-04] (G Data Software AG)

S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [59768 2013-01-04] (G Data Software AG)

R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [65912 2013-01-04] (G Data Software AG)

R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [64376 2013-01-04] (G Data Software AG)

U5 terminpt; C:\Windows\System32\Drivers\terminpt.sys [29696 2012-08-23] (Microsoft Corporation) [File not signed]

R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-11-17] (Windows (R) 2000 DDK provider)

R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-11-17] (Paragon)

R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-11-17] (Paragon)

R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-25] (Avast Software)

R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-08 17:10 - 2015-02-08 17:10 - 00000770 _____ () C:\Users\ThoMi\Desktop\JRT.txt

2015-02-08 11:12 - 2015-02-08 11:19 - 00000000 ____D () C:\AdwCleaner

2015-02-08 10:57 - 2015-02-08 10:57 - 02112512 _____ () C:\Users\ThoMi\Downloads\AdwCleaner_4.110.exe

2015-02-08 10:57 - 2015-02-08 10:57 - 01388274 _____ (Thisisu) C:\Users\ThoMi\Downloads\JRT.exe

2015-02-08 07:15 - 2015-02-08 07:15 - 00000978 _____ () C:\Windows\PFRO.log

2015-02-07 17:51 - 2015-02-07 17:51 - 00021828 _____ () C:\ComboFix.txt

2015-02-07 17:30 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-02-07 17:30 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-02-07 17:30 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2015-02-07 17:27 - 2015-02-07 17:51 - 00000000 ____D () C:\Qoobox

2015-02-07 17:26 - 2015-02-07 17:26 - 05611380 ____R (Swearware) C:\Users\ThoMi\Downloads\ComboFix.exe

2015-02-07 10:37 - 2015-02-07 10:37 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\ThoMi\Downloads\tdsskiller.exe

2015-02-06 06:17 - 2015-02-08 17:13 - 00000000 ____D () C:\Users\ThoMi\Downloads\FRST-OlderVersion

2015-02-06 05:38 - 2015-02-08 11:21 - 00000280 _____ () C:\Windows\setupact.log

2015-02-06 05:38 - 2015-02-06 05:38 - 00000000 _____ () C:\Windows\setuperr.log

2015-02-02 06:42 - 2015-02-02 06:42 - 354175667 _____ () C:\Windows\MEMORY.DMP

2015-01-28 22:04 - 2015-02-08 10:55 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-28 22:04 - 2015-01-28 22:04 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-28 22:04 - 2015-01-28 22:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-28 22:04 - 2015-01-28 22:04 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-01-28 22:04 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-28 22:04 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-28 22:04 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-28 22:03 - 2015-01-28 22:03 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\ThoMi\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-25 06:22 - 2015-01-25 06:22 - 00000197 _____ () C:\Windows\system32\2015-01-25-05-22-09.033-AvastVBoxSVC.exe-2328.log

2015-01-24 17:57 - 2015-02-07 07:12 - 00021234 _____ () C:\Users\ThoMi\Downloads\Addition.txt

2015-01-24 17:56 - 2015-02-08 17:14 - 00013466 _____ () C:\Users\ThoMi\Downloads\FRST.txt

2015-01-24 17:56 - 2015-02-08 17:13 - 02132992 _____ (Farbar) C:\Users\ThoMi\Downloads\FRST64.exe

2015-01-21 16:34 - 2015-01-21 16:34 - 00000247 _____ () C:\Windows\system32\2015-01-21-15-34-54.079-aswFe.exe-1296.log

2015-01-21 16:30 - 2015-01-21 16:34 - 00000247 _____ () C:\Windows\system32\2015-01-21-15-30-19.012-aswFe.exe-872.log

2015-01-21 16:30 - 2015-01-21 16:30 - 00000197 _____ () C:\Windows\system32\2015-01-21-15-30-15.039-AvastVBoxSVC.exe-2336.log

2015-01-19 07:31 - 2015-01-19 07:31 - 00000197 _____ () C:\Windows\system32\2015-01-19-06-31-20.093-AvastVBoxSVC.exe-2604.log

2015-01-18 05:13 - 2015-01-18 05:13 - 00000247 _____ () C:\Windows\system32\2015-01-18-04-13-03.036-aswFe.exe-1796.log

2015-01-18 05:07 - 2015-01-18 05:12 - 00000247 _____ () C:\Windows\system32\2015-01-18-04-07-37.078-aswFe.exe-3988.log

2015-01-18 05:07 - 2015-01-18 05:07 - 00000197 _____ () C:\Windows\system32\2015-01-18-04-07-33.001-AvastVBoxSVC.exe-4812.log

2015-01-17 01:21 - 2015-01-17 01:21 - 00000197 _____ () C:\Windows\system32\2015-01-17-00-21-23.050-AvastVBoxSVC.exe-2612.log

2015-01-16 07:03 - 2015-01-16 07:03 - 00000197 _____ () C:\Windows\system32\2015-01-16-06-03-03.055-AvastVBoxSVC.exe-2592.log

2015-01-14 22:01 - 2015-01-14 22:01 - 00000197 _____ () C:\Windows\system32\2015-01-14-21-01-18.019-AvastVBoxSVC.exe-2560.log

2015-01-14 07:06 - 2015-01-14 07:06 - 00000197 _____ () C:\Windows\system32\2015-01-14-06-06-15.089-AvastVBoxSVC.exe-2088.log

2015-01-14 02:09 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 02:09 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 02:08 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 02:08 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 02:08 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-01-14 02:08 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-01-14 02:08 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-01-14 02:08 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-14 02:08 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-01-14 02:08 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-01-14 02:08 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 02:08 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 02:08 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2015-01-14 01:40 - 2015-01-14 01:40 - 00000197 _____ () C:\Windows\system32\2015-01-14-00-40-37.020-AvastVBoxSVC.exe-2396.log

2015-01-13 07:01 - 2015-01-13 07:01 - 00000197 _____ () C:\Windows\system32\2015-01-13-06-01-51.071-AvastVBoxSVC.exe-2420.log

2015-01-12 17:27 - 2015-01-12 23:15 - 00000000 ____D () C:\Users\ThoMi\AppData\OICE_15_974FA576_32C1D314_24F8

2015-01-12 07:15 - 2015-01-12 07:15 - 00000197 _____ () C:\Windows\system32\2015-01-12-06-15-52.064-AvastVBoxSVC.exe-2344.log

2015-01-11 15:05 - 2015-01-11 15:05 - 00000197 _____ () C:\Windows\system32\2015-01-11-14-05-30.093-AvastVBoxSVC.exe-2500.log

2015-01-11 08:14 - 2015-01-11 08:14 - 00000197 _____ () C:\Windows\system32\2015-01-11-07-14-02.090-AvastVBoxSVC.exe-2316.log

2015-01-10 08:15 - 2015-01-10 08:15 - 00000197 _____ () C:\Windows\system32\2015-01-10-07-15-22.070-AvastVBoxSVC.exe-2460.log

2015-01-10 00:43 - 2015-01-10 00:43 - 00000197 _____ () C:\Windows\system32\2015-01-09-23-43-07.045-AvastVBoxSVC.exe-2440.log
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-08 17:13 - 2014-11-18 14:18 - 00000000 ____D () C:\FRST

2015-02-08 17:05 - 2014-07-21 04:08 - 01887130 _____ () C:\Windows\WindowsUpdate.log

2015-02-08 16:55 - 2013-01-05 21:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-02-08 11:29 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-08 11:29 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-08 11:21 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-08 08:25 - 2010-11-21 07:50 - 00699432 _____ () C:\Windows\system32\perfh007.dat

2015-02-08 08:25 - 2010-11-21 07:50 - 00149572 _____ () C:\Windows\system32\perfc007.dat

2015-02-08 08:25 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-02-08 08:08 - 2013-01-05 17:23 - 00000000 ___RD () C:\Users\ThoMi\Documents\Bilder

2015-02-07 17:50 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2015-02-06 06:37 - 2014-07-22 17:10 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-02-06 06:31 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-02-05 23:41 - 2013-01-26 13:22 - 00000000 ____D () C:\Windows\Minidump

2015-02-04 21:46 - 2013-01-05 21:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-04 21:46 - 2013-01-05 21:07 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-04 21:46 - 2013-01-05 21:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-31 08:33 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Erbengemeinschaft

2015-01-31 08:32 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Steuer

2015-01-30 16:59 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Thomas

2015-01-30 07:34 - 2014-12-11 08:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-24 23:27 - 2014-01-12 07:22 - 00000000 ____D () C:\Users\ThoMi\AppData\Roaming\vlc

2015-01-14 02:19 - 2013-08-05 18:02 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-14 02:17 - 2012-12-12 17:04 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

==================== Files in the root of some directories =======
 

2014-05-05 05:07 - 2014-05-05 05:07 - 0001506 _____ () C:\Users\ThoMi\AppData\Local\recently-used.xbel
 

Some content of TEMP:

====================

C:\Users\ThoMi\AppData\Local\Temp\Quarantine.exe

C:\Users\ThoMi\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-03 08:26
 

==================== End Of Log ============================

--- --- ---

5. FRST/addition

FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2015

Ran by ThoMi at 2015-02-08 17:14:13

Running from C:\Users\ThoMi\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.22beta (HKLM-x32\...\7-Zip) (Version:  - )

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Ashampoo WinOptimizer Free v.1.0.0 (HKLM-x32\...\Ashampoo WinOptimizer Free_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.)

Free YouTube to MP3 Converter version 3.12.50.1111 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.50.1111 - DVDVideoSoft Ltd.)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

KONZ-Steuer-2014 (HKLM-x32\...\InstallShield_{20F1078B-E3B6-4DA1-9570-003DE110890A}) (Version: 1.00.0000 - USM)

KONZ-Steuer-2014 (x32 Version: 1.00.0000 - USM) Hidden

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Paragon Backup & Recovery™ 2012 Free (HKLM-x32\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)

PlayChess  (HKLM-x32\...\PlayChess) (Version:  - ChessBase GmbH)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Steuer 2012 (HKLM-x32\...\{01159E8A-44F7-4885-A7F9-872CE4D74063}) (Version: 20.00.8137 - Buhl Data Service GmbH)

Steuer 2013 (HKLM-x32\...\{05AEF487-8926-48A9-B5BA-9BED72BC6B1C}) (Version: 21.00.8480 - Buhl Data Service GmbH)

Steuer 2014 (HKLM-x32\...\{2EE860C7-4551-479F-AF01-328B8AA46051}) (Version: 22.00.8811 - Buhl Data Service GmbH)

SWR3 RauchFrei Version 1.2 (HKLM-x32\...\SWR3 RauchFrei_is1) (Version: 1.1 - Oliver Reuther und SWR3)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

02-12-2014 13:30:20 Windows Update

06-12-2014 01:45:17 Windows Update

09-12-2014 13:20:32 Windows Update

10-12-2014 19:12:41 Windows Update

13-12-2014 00:38:57 Windows Update

16-12-2014 07:53:07 Windows Update

18-12-2014 22:11:45 Windows Update

23-12-2014 07:44:27 Windows Update

30-12-2014 09:31:25 Windows Update

02-01-2015 14:29:30 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

02-01-2015 14:30:36 Installiert Steuer 2014

06-01-2015 18:31:38 Windows Update

14-01-2015 02:07:48 Windows Update

14-01-2015 02:16:54 Windows Update

20-01-2015 08:46:17 Windows Update

23-01-2015 10:06:05 Windows Update

23-01-2015 23:37:35 Revo Uninstaller's restore point - Foxit Cloud

23-01-2015 23:39:52 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028

27-01-2015 17:34:33 Windows Update

03-02-2015 07:03:21 Windows Update

07-02-2015 00:06:35 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2014-07-21 03:46 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {14D85A35-E529-449C-A310-3F9DEE865AD6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {A0F1F42A-7F33-4095-B87E-41FFA694C39A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {CE6A2F68-B11C-458F-AFA6-34F23641D579} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)

Task: {CFD9F461-6BBE-4CF4-8D0F-322E254D0471} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {D9D62A1F-F764-49F7-8C27-525A297CD012} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)

Task: {F15C5887-6C5E-4127-BC5A-45007BC033B2} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-25] (AVAST Software)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2014-03-10 12:09 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-02-08 16:55 - 2015-02-08 16:55 - 02912768 _____ () C:\Program Files\AVAST Software\Avast\defs\15020800\algo.dll

2014-11-25 12:45 - 2014-11-25 12:45 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-12-11 08:10 - 2015-01-29 05:52 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Registry Areas =====================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\ThoMi\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-3296977853-467173732-4196599000-500 - Administrator - Disabled)

Gast (S-1-5-21-3296977853-467173732-4196599000-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3296977853-467173732-4196599000-1002 - Limited - Enabled)

ThoMi (S-1-5-21-3296977853-467173732-4196599000-1000 - Administrator - Enabled) => C:\Users\ThoMi
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================
 

System errors:

=============
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2014-07-21 04:46:21.225

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-07-21 04:46:21.162

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: AMD Athlon(tm) II X2 250 Processor

Percentage of memory in use: 29%

Total physical RAM: 3839.18 MB

Available physical RAM: 2713.83 MB

Total Pagefile: 7676.54 MB

Available Pagefile: 6215.75 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (Windows) (Fixed) (Total:140.26 GB) (Free:7.55 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 78DAE1C9)

Partition 1: (Active) - (Size=8.8 GB) - (Type=27)

Partition 2: (Not Active) - (Size=140.3 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hi Schrauber,

ESET ging ewig (ca 8 Stunden), deshalb die späte Antwort, hier der Log:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=8482a83fa80533449857df96718e3059

# engine=22365

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-02-09 03:31:46

# local_time=2015-02-09 04:31:46 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='avast! Antivirus'

# compatibility_mode=783 16777213 71 95 948004 17407276 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 40519 175082556 0 0

# scanned=140436

# found=0

# cleaned=0

# scan_time=29246

Security Check hat zunächst abgebrochen und anstatt eines logs in der txt-datei nur stehen: "UNSUPPORTED OPERATING SYSTEM! ABORTED!". Nach einem Neustart lief´s dann doch, folgender Log:

Code:

 Results of screen317's Security Check version 0.99.96  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

avast! Antivirus   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

  Java 64-bit 8 Update 31  

 Adobe Flash Player 16.0.0.305  

 Mozilla Firefox (35.0.1) 
 ````````Process Check: objlist.exe by Laurent````````  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast avastui.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

und hier FRST-logs.

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-02-2015

Ran by ThoMi (administrator) on PC on 09-02-2015 04:40:34

Running from C:\Users\ThoMi\Downloads

Loaded Profiles: ThoMi (Available profiles: ThoMi)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: G Data BankGuard -> {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} -> C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File

Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425

FF Homepage: www.google.de

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Extension: Download videos and MP3s from YouTube - C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-23]

FF Extension: Deutsch (DE) Language Pack - C:\Users\ThoMi\AppData\Roaming\Mozilla\Firefox\Profiles\b6jnoyg7.default-1385925042425\Extensions\langpack-de@firefox.mozilla.org.xpi [2014-03-22]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-07-22]

FF HKU\S-1-5-21-3296977853-467173732-4196599000-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff

FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-23]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-25]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-25] (AVAST Software)

S3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-25] (Avast Software)

S4 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1540632 2012-06-29] (G Data Software AG)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)

S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [544768 2009-08-24] (mst software GmbH, Germany) [File not signed]

S3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [470008 2012-03-29] (G Data Software AG)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

S4 AVKService; "C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe" [X]

S4 AVKWCtl; "C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe" [X]

S3 GDFwSvc; "C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-25] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-25] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-25] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-25] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-25] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-25] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-25] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-25] ()

R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [54136 2013-01-04] (G Data Software AG)

R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [122744 2013-01-04] (G Data Software AG)

S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [59768 2013-01-04] (G Data Software AG)

R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [65912 2013-01-04] (G Data Software AG)

R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [64376 2013-01-04] (G Data Software AG)

U5 terminpt; C:\Windows\System32\Drivers\terminpt.sys [29696 2012-08-23] (Microsoft Corporation) [File not signed]

R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [59184 2011-11-17] (Windows (R) 2000 DDK provider)

R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [572336 2011-11-17] (Paragon)

R1 Uim_VIM; C:\Windows\System32\Drivers\uim_vimx64.sys [352816 2011-11-17] (Paragon)

R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-25] (Avast Software)

R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-09 04:36 - 2015-02-09 04:36 - 00852594 _____ () C:\Users\ThoMi\Downloads\SecurityCheck.exe

2015-02-08 17:10 - 2015-02-08 17:10 - 00000770 _____ () C:\Users\ThoMi\Downloads\JRT.txt

2015-02-08 11:12 - 2015-02-08 11:19 - 00000000 ____D () C:\AdwCleaner

2015-02-08 10:57 - 2015-02-08 10:57 - 02112512 _____ () C:\Users\ThoMi\Downloads\AdwCleaner_4.110.exe

2015-02-08 10:57 - 2015-02-08 10:57 - 01388274 _____ (Thisisu) C:\Users\ThoMi\Downloads\JRT.exe

2015-02-08 07:15 - 2015-02-08 07:15 - 00000978 _____ () C:\Windows\PFRO.log

2015-02-07 17:51 - 2015-02-07 17:51 - 00021828 _____ () C:\ComboFix.txt

2015-02-07 17:30 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe

2015-02-07 17:30 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe

2015-02-07 17:30 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe

2015-02-07 17:30 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe

2015-02-07 17:27 - 2015-02-07 17:51 - 00000000 ____D () C:\Qoobox

2015-02-07 17:26 - 2015-02-07 17:26 - 05611380 ____R (Swearware) C:\Users\ThoMi\Downloads\ComboFix.exe

2015-02-07 10:37 - 2015-02-07 10:37 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\ThoMi\Downloads\tdsskiller.exe

2015-02-06 06:17 - 2015-02-08 17:13 - 00000000 ____D () C:\Users\ThoMi\Downloads\FRST-OlderVersion

2015-02-06 05:38 - 2015-02-08 11:21 - 00000280 _____ () C:\Windows\setupact.log

2015-02-06 05:38 - 2015-02-06 05:38 - 00000000 _____ () C:\Windows\setuperr.log

2015-02-02 06:42 - 2015-02-02 06:42 - 354175667 _____ () C:\Windows\MEMORY.DMP

2015-01-28 22:04 - 2015-02-08 17:15 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-28 22:04 - 2015-01-28 22:04 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-28 22:04 - 2015-01-28 22:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-28 22:04 - 2015-01-28 22:04 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-01-28 22:04 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-28 22:04 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-28 22:04 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-28 22:03 - 2015-01-28 22:03 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\ThoMi\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-25 06:22 - 2015-01-25 06:22 - 00000197 _____ () C:\Windows\system32\2015-01-25-05-22-09.033-AvastVBoxSVC.exe-2328.log

2015-01-24 17:57 - 2015-02-08 17:14 - 00013360 _____ () C:\Users\ThoMi\Downloads\Addition.txt

2015-01-24 17:56 - 2015-02-09 04:41 - 00013409 _____ () C:\Users\ThoMi\Downloads\FRST.txt

2015-01-24 17:56 - 2015-02-08 17:13 - 02132992 _____ (Farbar) C:\Users\ThoMi\Downloads\FRST64.exe

2015-01-21 16:34 - 2015-01-21 16:34 - 00000247 _____ () C:\Windows\system32\2015-01-21-15-34-54.079-aswFe.exe-1296.log

2015-01-21 16:30 - 2015-01-21 16:34 - 00000247 _____ () C:\Windows\system32\2015-01-21-15-30-19.012-aswFe.exe-872.log

2015-01-21 16:30 - 2015-01-21 16:30 - 00000197 _____ () C:\Windows\system32\2015-01-21-15-30-15.039-AvastVBoxSVC.exe-2336.log

2015-01-19 07:31 - 2015-01-19 07:31 - 00000197 _____ () C:\Windows\system32\2015-01-19-06-31-20.093-AvastVBoxSVC.exe-2604.log

2015-01-18 05:13 - 2015-01-18 05:13 - 00000247 _____ () C:\Windows\system32\2015-01-18-04-13-03.036-aswFe.exe-1796.log

2015-01-18 05:07 - 2015-01-18 05:12 - 00000247 _____ () C:\Windows\system32\2015-01-18-04-07-37.078-aswFe.exe-3988.log

2015-01-18 05:07 - 2015-01-18 05:07 - 00000197 _____ () C:\Windows\system32\2015-01-18-04-07-33.001-AvastVBoxSVC.exe-4812.log

2015-01-17 01:21 - 2015-01-17 01:21 - 00000197 _____ () C:\Windows\system32\2015-01-17-00-21-23.050-AvastVBoxSVC.exe-2612.log

2015-01-16 07:03 - 2015-01-16 07:03 - 00000197 _____ () C:\Windows\system32\2015-01-16-06-03-03.055-AvastVBoxSVC.exe-2592.log

2015-01-14 22:01 - 2015-01-14 22:01 - 00000197 _____ () C:\Windows\system32\2015-01-14-21-01-18.019-AvastVBoxSVC.exe-2560.log

2015-01-14 07:06 - 2015-01-14 07:06 - 00000197 _____ () C:\Windows\system32\2015-01-14-06-06-15.089-AvastVBoxSVC.exe-2088.log

2015-01-14 02:09 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-14 02:09 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-14 02:08 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-14 02:08 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-14 02:08 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-01-14 02:08 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-01-14 02:08 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-01-14 02:08 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-01-14 02:08 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-01-14 02:08 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-01-14 02:08 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-14 02:08 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2015-01-14 02:08 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2015-01-14 01:40 - 2015-01-14 01:40 - 00000197 _____ () C:\Windows\system32\2015-01-14-00-40-37.020-AvastVBoxSVC.exe-2396.log

2015-01-13 07:01 - 2015-01-13 07:01 - 00000197 _____ () C:\Windows\system32\2015-01-13-06-01-51.071-AvastVBoxSVC.exe-2420.log

2015-01-12 17:27 - 2015-01-12 23:15 - 00000000 ____D () C:\Users\ThoMi\AppData\OICE_15_974FA576_32C1D314_24F8

2015-01-12 07:15 - 2015-01-12 07:15 - 00000197 _____ () C:\Windows\system32\2015-01-12-06-15-52.064-AvastVBoxSVC.exe-2344.log

2015-01-11 15:05 - 2015-01-11 15:05 - 00000197 _____ () C:\Windows\system32\2015-01-11-14-05-30.093-AvastVBoxSVC.exe-2500.log

2015-01-11 08:14 - 2015-01-11 08:14 - 00000197 _____ () C:\Windows\system32\2015-01-11-07-14-02.090-AvastVBoxSVC.exe-2316.log

2015-01-10 08:15 - 2015-01-10 08:15 - 00000197 _____ () C:\Windows\system32\2015-01-10-07-15-22.070-AvastVBoxSVC.exe-2460.log

2015-01-10 00:43 - 2015-01-10 00:43 - 00000197 _____ () C:\Windows\system32\2015-01-09-23-43-07.045-AvastVBoxSVC.exe-2440.log
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2015-02-09 04:40 - 2014-11-18 14:18 - 00000000 ____D () C:\FRST

2015-02-09 04:21 - 2013-01-05 21:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-02-09 04:20 - 2014-07-21 04:08 - 01899064 _____ () C:\Windows\WindowsUpdate.log

2015-02-08 11:29 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-08 11:29 - 2009-07-14 05:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-08 11:21 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-08 08:25 - 2010-11-21 07:50 - 00699432 _____ () C:\Windows\system32\perfh007.dat

2015-02-08 08:25 - 2010-11-21 07:50 - 00149572 _____ () C:\Windows\system32\perfc007.dat

2015-02-08 08:25 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI

2015-02-08 08:08 - 2013-01-05 17:23 - 00000000 ___RD () C:\Users\ThoMi\Documents\Bilder

2015-02-07 17:50 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini

2015-02-06 06:37 - 2014-07-22 17:10 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2015-02-06 06:31 - 2009-07-14 06:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2015-02-05 23:41 - 2013-01-26 13:22 - 00000000 ____D () C:\Windows\Minidump

2015-02-04 21:46 - 2013-01-05 21:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-02-04 21:46 - 2013-01-05 21:07 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-02-04 21:46 - 2013-01-05 21:07 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-01-31 08:33 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Erbengemeinschaft

2015-01-31 08:32 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Steuer

2015-01-30 16:59 - 2013-01-05 17:22 - 00000000 ____D () C:\Users\ThoMi\Documents\Thomas

2015-01-30 07:34 - 2014-12-11 08:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2015-01-24 23:27 - 2014-01-12 07:22 - 00000000 ____D () C:\Users\ThoMi\AppData\Roaming\vlc

2015-01-14 02:19 - 2013-08-05 18:02 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-14 02:17 - 2012-12-12 17:04 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
 

==================== Files in the root of some directories =======
 

2014-05-05 05:07 - 2014-05-05 05:07 - 0001506 _____ () C:\Users\ThoMi\AppData\Local\recently-used.xbel
 

Some content of TEMP:

====================

C:\Users\ThoMi\AppData\Local\Temp\Quarantine.exe

C:\Users\ThoMi\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-02-03 08:26
 

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-02-2015

Ran by ThoMi at 2015-02-09 04:41:49

Running from C:\Users\ThoMi\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.22beta (HKLM-x32\...\7-Zip) (Version:  - )

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Ashampoo WinOptimizer Free v.1.0.0 (HKLM-x32\...\Ashampoo WinOptimizer Free_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)

CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.)

Free YouTube to MP3 Converter version 3.12.50.1111 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.50.1111 - DVDVideoSoft Ltd.)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

KONZ-Steuer-2014 (HKLM-x32\...\InstallShield_{20F1078B-E3B6-4DA1-9570-003DE110890A}) (Version: 1.00.0000 - USM)

KONZ-Steuer-2014 (x32 Version: 1.00.0000 - USM) Hidden

Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)

Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden

Paragon Backup & Recovery™ 2012 Free (HKLM-x32\...\{C268B5E1-A5DA-11DF-A289-005056C00008}) (Version: 90.00.0003 - Paragon Software)

PlayChess  (HKLM-x32\...\PlayChess) (Version:  - ChessBase GmbH)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5898 - Realtek Semiconductor Corp.)

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Steuer 2012 (HKLM-x32\...\{01159E8A-44F7-4885-A7F9-872CE4D74063}) (Version: 20.00.8137 - Buhl Data Service GmbH)

Steuer 2013 (HKLM-x32\...\{05AEF487-8926-48A9-B5BA-9BED72BC6B1C}) (Version: 21.00.8480 - Buhl Data Service GmbH)

Steuer 2014 (HKLM-x32\...\{2EE860C7-4551-479F-AF01-328B8AA46051}) (Version: 22.00.8811 - Buhl Data Service GmbH)

SWR3 RauchFrei Version 1.2 (HKLM-x32\...\SWR3 RauchFrei_is1) (Version: 1.1 - Oliver Reuther und SWR3)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

02-12-2014 13:30:20 Windows Update

06-12-2014 01:45:17 Windows Update

09-12-2014 13:20:32 Windows Update

10-12-2014 19:12:41 Windows Update

13-12-2014 00:38:57 Windows Update

16-12-2014 07:53:07 Windows Update

18-12-2014 22:11:45 Windows Update

23-12-2014 07:44:27 Windows Update

30-12-2014 09:31:25 Windows Update

02-01-2015 14:29:30 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

02-01-2015 14:30:36 Installiert Steuer 2014

06-01-2015 18:31:38 Windows Update

14-01-2015 02:07:48 Windows Update

14-01-2015 02:16:54 Windows Update

20-01-2015 08:46:17 Windows Update

23-01-2015 10:06:05 Windows Update

23-01-2015 23:37:35 Revo Uninstaller's restore point - Foxit Cloud

23-01-2015 23:39:52 Revo Uninstaller's restore point - Malwarebytes Anti-Malware Version 2.0.4.1028

27-01-2015 17:34:33 Windows Update

03-02-2015 07:03:21 Windows Update

07-02-2015 00:06:35 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 03:34 - 2014-07-21 03:46 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {14D85A35-E529-449C-A310-3F9DEE865AD6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {A0F1F42A-7F33-4095-B87E-41FFA694C39A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {CE6A2F68-B11C-458F-AFA6-34F23641D579} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)

Task: {CFD9F461-6BBE-4CF4-8D0F-322E254D0471} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)

Task: {D9D62A1F-F764-49F7-8C27-525A297CD012} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)

Task: {F15C5887-6C5E-4127-BC5A-45007BC033B2} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-25] (AVAST Software)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
 

==================== Loaded Modules (whitelisted) ==============
 

2014-03-10 12:09 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll

2015-02-08 19:43 - 2015-02-08 19:43 - 02912768 _____ () C:\Program Files\AVAST Software\Avast\defs\15020801\algo.dll

2014-11-25 12:45 - 2014-11-25 12:45 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-12-11 08:10 - 2015-01-29 05:52 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) ===============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== Other Registry Areas =====================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-3296977853-467173732-4196599000-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\ThoMi\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-3296977853-467173732-4196599000-500 - Administrator - Disabled)

Gast (S-1-5-21-3296977853-467173732-4196599000-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3296977853-467173732-4196599000-1002 - Limited - Enabled)

ThoMi (S-1-5-21-3296977853-467173732-4196599000-1000 - Administrator - Enabled) => C:\Users\ThoMi
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (02/09/2015 04:37:52 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (02/09/2015 04:33:30 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (02/08/2015 07:41:34 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (02/08/2015 07:41:32 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (02/08/2015 05:56:53 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80004005
 
 

System errors:

=============

Error: (02/09/2015 04:20:14 AM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/08/2015 07:32:43 PM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active
 

Error: (02/08/2015 07:32:43 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 
 

Microsoft Office Sessions:

=========================

Error: (02/09/2015 04:37:52 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\$RECYCLE.BIN\S-1-5-21-3296977853-467173732-4196599000-1000\$RFDRGT0.exe
 

Error: (02/09/2015 04:33:30 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
 

Error: (02/08/2015 07:41:34 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\ThoMi\Downloads\esetsmartinstaller_deu.exe
 

Error: (02/08/2015 07:41:32 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\ThoMi\Downloads\esetsmartinstaller_deu.exe
 

Error: (02/08/2015 05:56:53 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: 80004005
 
 

CodeIntegrity Errors:

===================================

  Date: 2014-07-21 04:46:21.225

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2014-07-21 04:46:21.162

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: AMD Athlon(tm) II X2 250 Processor

Percentage of memory in use: 33%

Total physical RAM: 3839.18 MB

Available physical RAM: 2537.5 MB

Total Pagefile: 7676.54 MB

Available Pagefile: 6026.34 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: (Windows) (Fixed) (Total:140.26 GB) (Free:7.57 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 78DAE1C9)

Partition 1: (Active) - (Size=8.8 GB) - (Type=27)

Partition 2: (Not Active) - (Size=140.3 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

--- --- ---

Viele Grüße
Michael

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hi Schrauber,

erst mal herzlichen Dank!
Der freie Speicher auf C: ist von irgendwo zwischen 5 und 7 GB (da hing er in den letzten Wochen) wieder auf 72 GB gesprungen. Irgendwas riesiges wurde offenbar entfernt.

Einzige Frage: Kannst Du aus den Logs erkennen, was das war? Habe alle angeschaut, aber wurde nicht wirklich schlau aus denen....

Viele Grüße und danke, danke, DANKE!
Michael

Ich tippe auf Systemwiederherstellungspunkte, entfernt von Delfix :)