Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Extern USB Stick Verknüpfungen (https://www.trojaner-board.de/112330-extern-usb-stick-verknuepfungen.html)

Trosky 26.03.2012 12:42
Extern USB Stick Verknüpfungen
 
Hallo zusammen,

haben auf eurer Seite schon einiges über dieses Virus gelesen (macht Ordner zu Verknüfungen bei extern USB Speichermedien).
Nun habe ich einem Freund mein USB Stick geliehen.....
Als ich ihn wieder bekam hatte er den Virus drauf. Nun habe ich von der Firma aus den McAffee Virenscanner drauf und dieser erkannte es sofort und schreibt in der LOG Datei:
23.03.2012 18:57:02 Gelöscht NT-AUTORITÄT\SYSTEM C:\Windows\system32\svchost.exe G:\autorun.inf New Autorun!inf.a (Trojanisches Pferd)

23.03.2012 18:57:09 Gelöscht Trosky-PC\Trosky C:\Windows\Explorer.EXE G:\84612796\November 11.exe PWS-Spyeye.dh (Trojanisches Pferd)

G:\ war der USB Stick.

Nun wollte ich mal nachhören ob das Zeug mein PC infiziert hat oder nicht?!

Vielen Dank für euere Antworten :crazy:

cosinus 26.03.2012 19:45
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Trosky 27.03.2012 07:13
Ich habe nun ohne Externe Medien gescannt da ich den USB-Stick direkt formatiert habe und keine anderen Medien seit dem angeschlossen waren.

Malwarebytes
Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.23.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Trosky :: TROSKY-PC [Administrator]

Schutz: Aktiviert

24.03.2012 10:05:25
mbam-log-2012-03-24 (10-05-25).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 205805
Laufzeit: 7 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 8
HKCR\Typelib\{6D3F5DE4-E980-4407-A10F-9AC771ABAAE6} (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{7B9A715E-9D87-4C21-BF9E-F914F2FA953F} (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{D6F180CB-E683-41a3-8CD2-C53DBAA0530D} (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Pugi.PugiObj.1 (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Pugi.PugiObj (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D6F180CB-E683-41A3-8CD2-C53DBAA0530D} (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D6F180CB-E683-41A3-8CD2-C53DBAA0530D} (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Rightdown SoftwareRightdown Software SearchBar (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{D6F180CB-E683-41A3-8CD2-C53DBAA0530D} (Adware.ISTBar) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NvCplDaemonTool (Trojan.Agent.WIMP) -> Daten: rundll32.exe C:\Users\Trosky\vpload85.dll,_IWMPEvents -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Program Files (x86)\Rightdown Software SearchBar\rssb.dll (Adware.ISTBar) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Trosky\Downloads\PhotoAlbumSetup.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
ESET Scanner
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-27 12:14:56
# local_time=2012-03-27 02:14:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 25329983 84400145 0 0
# compatibility_mode=8192 67108863 100 0 83 83 0 0
# scanned=418054
# found=4
# cleaned=4
# scan_time=37001
C:\Users\Trosky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\3819bb10-4284ab73        multiple threats (deleted - quarantined)        00000000000000000000000000000000        C
C:\Users\Trosky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\6b06019b-6d5676a4        a variant of Java/TrojanDownloader.OpenConnection.AQ trojan (deleted - quarantined)        00000000000000000000000000000000        C
C:\Users\Trosky\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\52d04023-7404df32        a variant of Java/Agent.DU trojan (deleted - quarantined)        00000000000000000000000000000000        C
C:\Users\Trosky\AppData\Roaming\OpenCandy\OpenCandy_694E194B46CD4ED18096D9E3C7C6B756\registrybooster(9).exe        a variant of Win32/RegistryBooster application (deleted - quarantined)        00000000000000000000000000000000        C
Vielen Dank im Voraus :bussi:

cosinus 27.03.2012 11:44
Zitat:
Art des Suchlaufs: Quick-Scan
Sry aber ich wollte einen Vollscan sehen...bitte nachholen und Log posten!
Denk dran vorher die Signaturen von Malwarebytes zu aktualisieren, da gibt es sehr häufig neue Updates!

Trosky 27.03.2012 13:23
Ahhh sorry , hab ich verpeilt zu posten habe gestern auch ein vollständigen Scan gemacht.

Hier der andere Scan:

Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.23.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Trosky :: TROSKY-PC [Administrator]

Schutz: Aktiviert

26.03.2012 12:06:24
mbam-log-2012-03-26 (12-06-24).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 587199
Laufzeit: 3 Stunde(n), 28 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Program Files (x86)\VDownloader\VDownloader.exe (VirTool.DelfInject) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Nochmals Vielen Dank :-)

cosinus 27.03.2012 14:03
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Trosky 28.03.2012 10:10
Nun hab ich nochmal ein Scan mit OTL gemacht. Habe den Log als Arschiv angehängt.



Kann ich den PC nun wieder nutzen ohne Angst?

Vielen Dank im Voraus

cosinus 28.03.2012 11:43
Nein wir sind hier noch nicht durch!

Zitat:
Scan Mode: Current user
Du hast den Haken bei Scanne alle Benutzer vergessen! :(

Trosky 28.03.2012 14:39
:balla: ahhh sorry.
So jetzt aber, habs nochmal angehängt.

Haben wirs denn nun geschaft?
Was mache ich mit dem PC der den Virus verteilt? (ein Freund) Kann ich da die selben Schritte anwenden ?

Mit freundlichen Grüßen
Vielen Dank :-)

cosinus 28.03.2012 15:07
Zitat:
Was mache ich mit dem PC der den Virus verteilt? (ein Freund) Kann ich da die selben Schritte anwenden ?
Was meinst du da? :confused:
Wer verteilt da was?

Trosky 28.03.2012 15:51
:-D
sorry hatte ich doch am Anfang geschrieben.
Alsoo ein Freund von mir hat sich mein USB Stick geliehen um Fotos zu kopieren, als ich den Stick wieder bekommen haben sagte er , dass dieser nicht funktioniert. Als ich den dann bei mir eingesteckt hab hat mein MCAfee direkt alarm geschlagen und die Viren gelöscht.
Nun haben wir ja meinen Laptop geprüft.

Ist meiner denn nun okay?

Liebe Grüße

cosinus 28.03.2012 19:52
Zitat:
sorry hatte ich doch am Anfang geschrieben.
Naja, das und die letzte Beschreibung hatten irgendwie miteinander nicht viel zu tun :crazy:

Wenns geht solltest du den Stick überformatieren. Deaktivier aber vorher die automatische Wiedergabe auf allen Laufwerken komplett!!

Automatische Wiedergabe deaktivieren

Windows XP: Zur Vereinfachung hab ich mal die noautoplay.reg hochgeladen. Lad das auf dem Desktop herunter, führ die Datei aus und bestätige mit ja. Nach einem Neustart des Rechners ist die automatische Wiedergabe (von Datenträgern) auf allen Laufwerken deaktiviert, d.h. keine CD, kein Stick oder sonstwas startet nach dem Einstecken mehr automatisch.

Windows Vista/7: In der Systemsteuerung unter automatische Wiedergabe von CDs und anderen Medien alles deaktivieren. => siehe auch Einstellungen für automatische Wiedergabe ändern

Melde dich wenn du durch bist, dann gehts weiter

Trosky 28.03.2012 20:16
Okay :-)

Also automatisch Wiedergabe ist deaktiviert und der Stick formatiert.

cosinus 29.03.2012 10:41
Gut. Dann bist du gegen automatische Infektionen durch Sticks und v.a. von diesem Stick erstmal immun, da nichts mehr automatisch startet.

Code:
O1 - Hosts: 127.0.0.1 activate.adobe.com
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager]
Och nee, woher hast du dieses AdobeCS5? :(

Trosky 29.03.2012 11:44
Okay, das hört sich doch schonmal gut an :-)

Also ist mein Lapi wieder bzw. immer noch Viren frei? Und ich kann wieder OnlineBanking betreiben?

Cs5? Photoshop oder wie? Das Photoshop hab ich gekauft, da ich es hin und wieder für die arbeit brauche und wir da nur gekaufte Software einsetzten.

Mit dem PC von dem die Viren ausgehen verfahre ich jetzt genau so und arbeite die Liste durch? Soll ich dazu ein neues Thema aufmachen?

Vielen Dank für deine Hilfe:singsing:

cosinus 29.03.2012 14:42
Zitat:
Cs5? Photoshop oder wie? Das Photoshop hab ich gekauft,
Dann verrat mir mal wie du deine gekaufte Version aktivieren konntest, wenn für dein Rechner der Aktivierungsserver nicht erreichbar war

O1 - Hosts: 127.0.0.1 activate.adobe.com

:pfeiff:

Trosky 29.03.2012 15:02
Ich hab keine Ahnung wie ich das gemacht hab und ich hab auch keine Ahnung was es mit diesem "O1 - Hosts: 127.0.0.1 activate.adobe.com" aufsich hat. Das ist ca. 2 Jahre her. Aber wenn du drauf bestehst mache ich dir gerne ein ScreenShot der Kauf bestätigung über Adobe Photoshop :-D (Ich sollte es noch als Email irgendwo haben wurde Online gekauft).

Zwei fragen habe ich noch:

Also ist mein Lapi wieder bzw. immer noch Viren frei? Und ich kann wieder OnlineBanking betreiben?

Mit dem PC von dem die Viren ausgehen verfahre ich jetzt genau so und arbeite die Liste durch? Soll ich dazu ein neues Thema aufmachen?

Liebe Grüße

cosinus 29.03.2012 15:12
Hattest du vor der Kaufversion mal ne andere Version installiert gehabt?

Zitat:
hab auch keine Ahnung was es mit diesem "O1 - Hosts: 127.0.0.1 activate.adobe.com" aufsich hat.
Dein Rechner kann damit activate.adobe.com nicht mehr erreichen, also so auch keine Adobe-Software mehr aktivieren

Trosky 29.03.2012 16:04
mhh ja gut möglich das ich da früher mal was drauf hatte was runtergeladen war oder so.
Wie ändere ich das denn? Hatte bis jetz aber nie Probleme Updates bzw. verbindungen zu adobe auf zu bauen.

cosinus 29.03.2012 19:26
Schon ok, wir setzten die Hosts Datei gleich zurück. Lass mich vorher aber noch was wissen: Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Trosky 30.03.2012 08:25
Also ich hab mal nach geschaut und nix entdecken können was verdächtig aussieht. Leer war auch nur ein Ordner das war aber ein SPS Programm was ich vor geraumer Zeit deinstalliert habe.

Meinst du denn das ich überweisungen machen kann? Habe dafür das Programm Quicken Deluxe. Müsste nämlich dringend welche machen :-O

Danke dir

cosinus 30.03.2012 11:32
Nein warte bitte ab oder mach die Überweisung bei der Bank am Überweisungsterminal!

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1732836603-3171370862-3923160131-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com
IE - HKU\S-1-5-21-1732836603-3171370862-3923160131-1000\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKU\S-1-5-21-1732836603-3171370862-3923160131-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1732836603-3171370862-3923160131-1000\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Program Files (x86)\Winload\tbWinl.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{20d7bf69-5ade-11e0-8b68-a617298e5ffe}\Shell - "" = AutoRun
O33 - MountPoints2\{20d7bf69-5ade-11e0-8b68-a617298e5ffe}\Shell\AutoRun\command - "" = G:\AutoInstaller.exe
O33 - MountPoints2\{2c55319d-6988-11e0-9064-0027135e10c6}\Shell - "" = AutoRun
O33 - MountPoints2\{2c55319d-6988-11e0-9064-0027135e10c6}\Shell\AutoRun\command - "" = G:\KODAK_Camera_Setup_App.exe
O33 - MountPoints2\{2c5531a9-6988-11e0-9064-0027135e10c6}\Shell - "" = AutoRun
O33 - MountPoints2\{2c5531a9-6988-11e0-9064-0027135e10c6}\Shell\AutoRun\command - "" = G:\KODAK_Camera_Setup_App.exe
O33 - MountPoints2\{370fa2b2-e760-11df-a84e-0027135e10c6}\Shell - "" = AutoRun
O33 - MountPoints2\{370fa2b2-e760-11df-a84e-0027135e10c6}\Shell\AutoRun\command - "" = G:\DWIZARD.exe
O33 - MountPoints2\{76c6e640-b900-11e0-840f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{76c6e640-b900-11e0-840f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\start.exe
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Trosky 30.03.2012 12:19
So ebenfalls erledigt :-)

Code:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{40c3cc16-7269-4b32-9531-17f2950fb06f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ deleted successfully.
C:\Program Files (x86)\Winload\tbWinl.dll moved successfully.
HKU\S-1-5-21-1732836603-3171370862-3923160131-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1732836603-3171370862-3923160131-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{40c3cc16-7269-4b32-9531-17f2950fb06f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ not found.
File C:\Program Files (x86)\Winload\tbWinl.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ not found.
File C:\Program Files (x86)\Winload\tbWinl.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{40c3cc16-7269-4b32-9531-17f2950fb06f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ not found.
File C:\Program Files (x86)\Winload\tbWinl.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ not found.
Registry value HKEY_USERS\S-1-5-21-1732836603-3171370862-3923160131-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_USERS\S-1-5-21-1732836603-3171370862-3923160131-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{40C3CC16-7269-4B32-9531-17F2950FB06F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40C3CC16-7269-4B32-9531-17F2950FB06F}\ not found.
File C:\Program Files (x86)\Winload\tbWinl.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20d7bf69-5ade-11e0-8b68-a617298e5ffe}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20d7bf69-5ade-11e0-8b68-a617298e5ffe}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{20d7bf69-5ade-11e0-8b68-a617298e5ffe}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20d7bf69-5ade-11e0-8b68-a617298e5ffe}\ not found.
File G:\AutoInstaller.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c55319d-6988-11e0-9064-0027135e10c6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c55319d-6988-11e0-9064-0027135e10c6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c55319d-6988-11e0-9064-0027135e10c6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c55319d-6988-11e0-9064-0027135e10c6}\ not found.
File G:\KODAK_Camera_Setup_App.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c5531a9-6988-11e0-9064-0027135e10c6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c5531a9-6988-11e0-9064-0027135e10c6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c5531a9-6988-11e0-9064-0027135e10c6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c5531a9-6988-11e0-9064-0027135e10c6}\ not found.
File G:\KODAK_Camera_Setup_App.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{370fa2b2-e760-11df-a84e-0027135e10c6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{370fa2b2-e760-11df-a84e-0027135e10c6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{370fa2b2-e760-11df-a84e-0027135e10c6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{370fa2b2-e760-11df-a84e-0027135e10c6}\ not found.
File G:\DWIZARD.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{76c6e640-b900-11e0-840f-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76c6e640-b900-11e0-840f-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{76c6e640-b900-11e0-840f-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76c6e640-b900-11e0-840f-806e6f6e6963}\ not found.
File F:\start.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Trosky
->Temp folder emptied: 1023513 bytes
->Temporary Internet Files folder emptied: 35114827 bytes
->Java cache emptied: 90282201 bytes
->FireFox cache emptied: 181720598 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 3269026 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4820252 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67698 bytes
RecycleBin emptied: 237486557 bytes
 
Total Files Cleaned = 528,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: AppData
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Trosky
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.2 log created on 03302012_131001

Files\Folders moved on Reboot...
C:\Users\Trosky\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
Mensch :-D Wieviel schritte habe ich den noch vor mir?
Wollte heute mal mit dem PC anfangen von dem ich die Viren bekommen habe, soll ich dafür ein neues Thema aufmachen?

cosinus 30.03.2012 15:05
Mach für den anderen Rechner ein neues Thema auf


Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Trosky 31.03.2012 12:14
So auch diesen Punkt habe ich nun erledigt. Sah den bisher irgendwas so aus als wäre ein Virus auf dem PC?

Hier der Log
Code:
13:08:16.0380 6584        TDSS rootkit removing tool 2.7.23.0 Mar 26 2012 13:40:18
13:08:16.0486 6584        ============================================================
13:08:16.0486 6584        Current date / time: 2012/03/31 13:08:16.0486
13:08:16.0486 6584        SystemInfo:
13:08:16.0486 6584       
13:08:16.0487 6584        OS Version: 6.1.7601 ServicePack: 1.0
13:08:16.0487 6584        Product type: Workstation
13:08:16.0487 6584        ComputerName: TROSKY-PC
13:08:16.0487 6584        UserName: Trosky
13:08:16.0487 6584        Windows directory: C:\Windows
13:08:16.0487 6584        System windows directory: C:\Windows
13:08:16.0487 6584        Running under WOW64
13:08:16.0487 6584        Processor architecture: Intel x64
13:08:16.0487 6584        Number of processors: 2
13:08:16.0487 6584        Page size: 0x1000
13:08:16.0487 6584        Boot type: Normal boot
13:08:16.0488 6584        ============================================================
13:08:17.0678 6584        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:08:17.0693 6584        \Device\Harddisk0\DR0:
13:08:17.0693 6584        MBR used
13:08:17.0693 6584        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800
13:08:17.0693 6584        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x23109800
13:08:17.0693 6584        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x2316D800, BlocksNum 0x228D000
13:08:17.0693 6584        \Device\Harddisk0\DR0\Partition3: MBR, Type 0xC, StartLBA 0x253FA800, BlocksNum 0x33AB0
13:08:17.0787 6584        Initialize success
13:08:17.0787 6584        ============================================================
13:08:43.0506 2956        ============================================================
13:08:43.0506 2956        Scan started
13:08:43.0506 2956        Mode: Manual; SigCheck; TDLFS;
13:08:43.0506 2956        ============================================================
13:08:44.0017 2956        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
13:08:44.0264 2956        1394ohci - ok
13:08:44.0324 2956        Accelerometer  (5c368f4b04ed2a923e6afca2d37baff5) C:\Windows\system32\DRIVERS\Accelerometer.sys
13:08:44.0535 2956        Accelerometer - ok
13:08:44.0607 2956        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
13:08:44.0648 2956        ACPI - ok
13:08:44.0706 2956        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
13:08:44.0838 2956        AcpiPmi - ok
13:08:44.0916 2956        adfs            (2f0683fd2df1d92e891caca14b45a8c1) C:\Windows\system32\drivers\adfs.sys
13:08:45.0012 2956        adfs - ok
13:08:45.0083 2956        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
13:08:45.0170 2956        adp94xx - ok
13:08:45.0208 2956        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
13:08:45.0239 2956        adpahci - ok
13:08:45.0272 2956        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
13:08:45.0307 2956        adpu320 - ok
13:08:45.0340 2956        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
13:08:45.0474 2956        AeLookupSvc - ok
13:08:45.0600 2956        AESTFilters    (a6fb9db8f1a86861d955fd6975977ae0) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_471277d5d45019ea\AESTSr64.exe
13:08:45.0775 2956        AESTFilters - ok
13:08:45.0874 2956        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
13:08:45.0954 2956        AFD - ok
13:08:46.0013 2956        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
13:08:46.0051 2956        agp440 - ok
13:08:46.0287 2956        Akamai          (1125c7d9fb8898015829c387c1bc87c7) c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll
13:08:46.0288 2956        Suspicious file (Hidden): c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll. md5: 1125c7d9fb8898015829c387c1bc87c7
13:08:46.0302 2956        Akamai ( HiddenFile.Multi.Generic ) - warning
13:08:46.0303 2956        Akamai - detected HiddenFile.Multi.Generic (1)
13:08:46.0371 2956        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
13:08:46.0464 2956        ALG - ok
13:08:46.0536 2956        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
13:08:46.0577 2956        aliide - ok
13:08:46.0672 2956        AMD External Events Utility (5275d9b32c5936d4266d79cdfad2e6f7) C:\Windows\system32\atiesrxx.exe
13:08:46.0808 2956        AMD External Events Utility - ok
13:08:46.0831 2956        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
13:08:46.0850 2956        amdide - ok
13:08:46.0901 2956        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
13:08:46.0955 2956        AmdK8 - ok
13:08:47.0109 2956        amdkmdag        (e3c2c62b9db9b5a2b350164f6e1422b1) C:\Windows\system32\DRIVERS\atipmdag.sys
13:08:47.0494 2956        amdkmdag - ok
13:08:47.0558 2956        amdkmdap        (5faa847e2358a5f74aa99cd8a96aec7f) C:\Windows\system32\DRIVERS\atikmpag.sys
13:08:47.0607 2956        amdkmdap - ok
13:08:47.0646 2956        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
13:08:47.0696 2956        AmdPPM - ok
13:08:47.0760 2956        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
13:08:47.0855 2956        amdsata - ok
13:08:47.0899 2956        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
13:08:47.0926 2956        amdsbs - ok
13:08:47.0945 2956        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
13:08:48.0043 2956        amdxata - ok
13:08:48.0170 2956        Apache2.2      (97ed5aa5fbaa105ef614b8c240b62ba1) c:\xampp\apache\bin\apache.exe
13:08:48.0298 2956        Apache2.2 ( UnsignedFile.Multi.Generic ) - warning
13:08:48.0298 2956        Apache2.2 - detected UnsignedFile.Multi.Generic (1)
13:08:48.0363 2956        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
13:08:48.0534 2956        AppID - ok
13:08:48.0563 2956        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
13:08:48.0668 2956        AppIDSvc - ok
13:08:48.0707 2956        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
13:08:48.0836 2956        Appinfo - ok
13:08:48.0894 2956        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
13:08:48.0929 2956        arc - ok
13:08:48.0951 2956        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
13:08:48.0973 2956        arcsas - ok
13:08:49.0010 2956        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
13:08:49.0123 2956        AsyncMac - ok
13:08:49.0167 2956        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
13:08:49.0196 2956        atapi - ok
13:08:49.0244 2956        AtiHdmiService  (d481083348138b4933acfe95812db71c) C:\Windows\system32\drivers\AtiHdmi.sys
13:08:49.0338 2956        AtiHdmiService - ok
13:08:49.0403 2956        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
13:08:49.0575 2956        AudioEndpointBuilder - ok
13:08:49.0606 2956        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
13:08:49.0677 2956        AudioSrv - ok
13:08:49.0753 2956        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
13:08:49.0907 2956        AxInstSV - ok
13:08:49.0949 2956        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
13:08:50.0042 2956        b06bdrv - ok
13:08:50.0097 2956        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
13:08:50.0178 2956        b57nd60a - ok
13:08:50.0221 2956        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
13:08:50.0282 2956        BDESVC - ok
13:08:50.0301 2956        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
13:08:50.0409 2956        Beep - ok
13:08:50.0498 2956        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
13:08:50.0668 2956        BFE - ok
13:08:50.0737 2956        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
13:08:50.0951 2956        BITS - ok
13:08:51.0004 2956        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
13:08:51.0078 2956        blbdrive - ok
13:08:51.0143 2956        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
13:08:51.0256 2956        bowser - ok
13:08:51.0292 2956        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
13:08:51.0374 2956        BrFiltLo - ok
13:08:51.0404 2956        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
13:08:51.0459 2956        BrFiltUp - ok
13:08:51.0499 2956        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
13:08:51.0641 2956        Browser - ok
13:08:51.0693 2956        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
13:08:51.0799 2956        Brserid - ok
13:08:51.0828 2956        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
13:08:51.0893 2956        BrSerWdm - ok
13:08:51.0939 2956        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
13:08:52.0000 2956        BrUsbMdm - ok
13:08:52.0028 2956        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
13:08:52.0089 2956        BrUsbSer - ok
13:08:52.0164 2956        BthEnum        (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
13:08:52.0253 2956        BthEnum - ok
13:08:52.0298 2956        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
13:08:52.0347 2956        BTHMODEM - ok
13:08:52.0384 2956        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
13:08:52.0439 2956        BthPan - ok
13:08:52.0483 2956        BTHPORT        (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
13:08:52.0595 2956        BTHPORT - ok
13:08:52.0634 2956        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
13:08:52.0720 2956        bthserv - ok
13:08:52.0744 2956        BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
13:08:52.0858 2956        BTHUSB - ok
13:08:52.0895 2956        btwaudio        (4bdbdb86abba924e029fb2683be7c505) C:\Windows\system32\drivers\btwaudio.sys
13:08:52.0986 2956        btwaudio - ok
13:08:53.0007 2956        btwavdt        (5c849bd7c78791c5cee9f4651d7fe38d) C:\Windows\system32\DRIVERS\btwavdt.sys
13:08:53.0100 2956        btwavdt - ok
13:08:53.0182 2956        btwdins        (31da517946ffe416442e864592548f8a) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
13:08:53.0341 2956        btwdins - ok
13:08:53.0358 2956        btwl2cap        (6149301dc3f81d6f9667a3fbac410975) C:\Windows\system32\DRIVERS\btwl2cap.sys
13:08:53.0441 2956        btwl2cap - ok
13:08:53.0468 2956        btwrchid        (3e1991afa851a36dc978b0a1b0535c8b) C:\Windows\system32\DRIVERS\btwrchid.sys
13:08:53.0554 2956        btwrchid - ok
13:08:53.0609 2956        C2XXCOM        (6a50eab6c21ef0886a0366e11af10762) C:\Windows\system32\DRIVERS\C2XXCOM76.sys
13:08:53.0790 2956        C2XXCOM - ok
13:08:53.0842 2956        C2xxUSB        (da5363a532ba554483f5b1ec6ade73bc) C:\Windows\system32\DRIVERS\C2xxUSB76.sys
13:08:53.0981 2956        C2xxUSB - ok
13:08:54.0039 2956        C2xxUsbStorage  (b8e6be77c47f1fe2c9f696bceaeac6f1) C:\Windows\system32\DRIVERS\C2xSTR76.sys
13:08:54.0177 2956        C2xxUsbStorage - ok
13:08:54.0308 2956        CalendarSynchService (ab4a81221c1d0d647cfacbe8a82636b0) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
13:08:54.0431 2956        CalendarSynchService - ok
13:08:54.0482 2956        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
13:08:54.0575 2956        cdfs - ok
13:08:54.0662 2956        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
13:08:54.0794 2956        cdrom - ok
13:08:54.0866 2956        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
13:08:55.0022 2956        CertPropSvc - ok
13:08:55.0076 2956        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
13:08:55.0109 2956        circlass - ok
13:08:55.0145 2956        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
13:08:55.0177 2956        CLFS - ok
13:08:55.0244 2956        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:08:55.0272 2956        clr_optimization_v2.0.50727_32 - ok
13:08:55.0311 2956        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
13:08:55.0337 2956        clr_optimization_v2.0.50727_64 - ok
13:08:55.0418 2956        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:08:55.0534 2956        clr_optimization_v4.0.30319_32 - ok
13:08:55.0574 2956        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
13:08:55.0676 2956        clr_optimization_v4.0.30319_64 - ok
13:08:55.0737 2956        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
13:08:55.0799 2956        CmBatt - ok
13:08:55.0841 2956        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
13:08:55.0862 2956        cmdide - ok
13:08:55.0916 2956        CNG            (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
13:08:56.0045 2956        CNG - ok
13:08:56.0131 2956        Com4QLBEx      (c7a0e61d5714ac20de52d4f66ec773b8) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
13:08:56.0302 2956        Com4QLBEx - ok
13:08:56.0357 2956        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
13:08:56.0383 2956        Compbatt - ok
13:08:56.0417 2956        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
13:08:56.0530 2956        CompositeBus - ok
13:08:56.0551 2956        COMSysApp - ok
13:08:56.0584 2956        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
13:08:56.0607 2956        crcdisk - ok
13:08:56.0666 2956        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
13:08:56.0798 2956        CryptSvc - ok
13:08:56.0850 2956        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
13:08:56.0933 2956        DcomLaunch - ok
13:08:56.0977 2956        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
13:08:57.0098 2956        defragsvc - ok
13:08:57.0145 2956        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
13:08:57.0303 2956        DfsC - ok
13:08:57.0370 2956        dgderdrv        (867fa8b9e9e3078f68c4089904bbf4b0) C:\Windows\system32\drivers\dgderdrv.sys
13:08:57.0475 2956        dgderdrv - ok
13:08:57.0523 2956        dg_ssudbus      (f551cbb5db009b980a03f64b09946f75) C:\Windows\system32\DRIVERS\ssudbus.sys
13:08:57.0623 2956        dg_ssudbus - ok
13:08:57.0685 2956        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
13:08:57.0821 2956        Dhcp - ok
13:08:57.0855 2956        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
13:08:57.0916 2956        discache - ok
13:08:57.0976 2956        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
13:08:58.0009 2956        Disk - ok
13:08:58.0056 2956        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
13:08:58.0131 2956        Dnscache - ok
13:08:58.0178 2956        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
13:08:58.0328 2956        dot3svc - ok
13:08:58.0407 2956        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
13:08:58.0454 2956        Dot4 - ok
13:08:58.0513 2956        Dot4Print      (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\DRIVERS\Dot4Prt.sys
13:08:58.0640 2956        Dot4Print - ok
13:08:58.0664 2956        dot4usb        (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
13:08:58.0710 2956        dot4usb - ok
13:08:58.0806 2956        DpHost          (5bc1d876dfd53c31c5fc65d2e9614015) C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
13:08:58.0943 2956        DpHost ( UnsignedFile.Multi.Generic ) - warning
13:08:58.0943 2956        DpHost - detected UnsignedFile.Multi.Generic (1)
13:08:58.0983 2956        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
13:08:59.0066 2956        DPS - ok
13:08:59.0124 2956        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
13:08:59.0190 2956        drmkaud - ok
13:08:59.0258 2956        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
13:08:59.0427 2956        DXGKrnl - ok
13:08:59.0468 2956        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
13:08:59.0554 2956        EapHost - ok
13:08:59.0659 2956        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
13:08:59.0832 2956        ebdrv - ok
13:08:59.0874 2956        EFS            (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\System32\lsass.exe
13:08:59.0904 2956        EFS - ok
13:09:00.0006 2956        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
13:09:00.0198 2956        ehRecvr - ok
13:09:00.0233 2956        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
13:09:00.0310 2956        ehSched - ok
13:09:00.0390 2956        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
13:09:00.0462 2956        elxstor - ok
13:09:00.0515 2956        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
13:09:00.0572 2956        ErrDev - ok
13:09:00.0646 2956        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
13:09:00.0756 2956        EventSystem - ok
13:09:00.0799 2956        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
13:09:00.0881 2956        exfat - ok
13:09:00.0902 2956        ezSharedSvc - ok
13:09:00.0933 2956        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
13:09:01.0019 2956        fastfat - ok
13:09:01.0095 2956        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
13:09:01.0258 2956        Fax - ok
13:09:01.0299 2956        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
13:09:01.0344 2956        fdc - ok
13:09:01.0388 2956        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
13:09:01.0504 2956        fdPHost - ok
13:09:01.0526 2956        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
13:09:01.0606 2956        FDResPub - ok
13:09:01.0649 2956        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
13:09:01.0683 2956        FileInfo - ok
13:09:01.0705 2956        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
13:09:01.0777 2956        Filetrace - ok
13:09:01.0946 2956        FirebirdServerMAGIXInstance (167d24a045499ebef438f231976158df) C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe
13:09:02.0270 2956        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
13:09:02.0270 2956        FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
13:09:02.0346 2956        FLEXnet Licensing Service (1f63900e2eb00101b9aca2b7a870704e) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
13:09:02.0558 2956        FLEXnet Licensing Service - ok
13:09:02.0659 2956        FLEXnet Licensing Service 64 (1c3fb052a0bb72edaed90785c34d6eed) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
13:09:02.0805 2956        FLEXnet Licensing Service 64 - ok
13:09:02.0895 2956        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
13:09:02.0956 2956        flpydisk - ok
13:09:03.0028 2956        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
13:09:03.0119 2956        FltMgr - ok
13:09:03.0196 2956        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
13:09:03.0395 2956        FontCache - ok
13:09:03.0451 2956        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
13:09:03.0554 2956        FontCache3.0.0.0 - ok
13:09:03.0583 2956        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
13:09:03.0608 2956        FsDepends - ok
13:09:03.0635 2956        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
13:09:03.0658 2956        Fs_Rec - ok
13:09:03.0731 2956        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
13:09:03.0776 2956        fvevol - ok
13:09:03.0823 2956        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
13:09:03.0849 2956        gagp30kx - ok
13:09:03.0908 2956        GameConsoleService (c1bbce4b30b45410178ee674c818d10c) C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
13:09:04.0039 2956        GameConsoleService - ok
13:09:04.0101 2956        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
13:09:04.0283 2956        gpsvc - ok
13:09:04.0380 2956        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
13:09:04.0406 2956        gupdate - ok
13:09:04.0437 2956        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
13:09:04.0460 2956        gupdatem - ok
13:09:04.0530 2956        gusvc          (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
13:09:04.0676 2956        gusvc - ok
13:09:04.0751 2956        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
13:09:04.0806 2956        hcw85cir - ok
13:09:04.0864 2956        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
13:09:05.0007 2956        HdAudAddService - ok
13:09:05.0067 2956        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
13:09:05.0192 2956        HDAudBus - ok
13:09:05.0221 2956        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
13:09:05.0264 2956        HidBatt - ok
13:09:05.0303 2956        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
13:09:05.0350 2956        HidBth - ok
13:09:05.0389 2956        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
13:09:05.0433 2956        HidIr - ok
13:09:05.0469 2956        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
13:09:05.0555 2956        hidserv - ok
13:09:05.0618 2956        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
13:09:05.0655 2956        HidUsb - ok
13:09:05.0707 2956        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
13:09:05.0862 2956        hkmsvc - ok
13:09:05.0912 2956        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
13:09:06.0039 2956        HomeGroupListener - ok
13:09:06.0085 2956        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
13:09:06.0181 2956        HomeGroupProvider - ok
13:09:06.0315 2956        HP Support Assistant Service (170233b8d743efe35f462a5d516b93e3) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
13:09:06.0420 2956        HP Support Assistant Service - ok
13:09:06.0513 2956        HPDrvMntSvc.exe (bcc4a8b2e2e902f52e7f2e7d8e125765) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
13:09:06.0635 2956        HPDrvMntSvc.exe - ok
13:09:06.0701 2956        hpdskflt        (4e0bec0f78096ffd6d3314b497fc49d3) C:\Windows\system32\DRIVERS\hpdskflt.sys
13:09:06.0807 2956        hpdskflt - ok
13:09:06.0854 2956        HpqKbFiltr      (9af482d058be59cc28bce52e7c4b747c) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys
13:09:06.0958 2956        HpqKbFiltr - ok
13:09:07.0012 2956        hpqwmiex        (ec9739a46f1f83c6e52a7a4697f44a65) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
13:09:07.0045 2956        hpqwmiex - ok
13:09:07.0111 2956        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
13:09:07.0227 2956        HpSAMD - ok
13:09:07.0266 2956        hpsrv          (fc7c13b5a9e9be23b7ae72bbc7fdb278) C:\Windows\system32\Hpservice.exe
13:09:07.0396 2956        hpsrv - ok
13:09:07.0461 2956        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
13:09:07.0584 2956        HTTP - ok
13:09:07.0627 2956        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
13:09:07.0646 2956        hwpolicy - ok
13:09:07.0708 2956        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
13:09:07.0759 2956        i8042prt - ok
13:09:07.0801 2956        iaStor          (bbb3b6df1abb0fe35802ede85cc1c011) C:\Windows\system32\DRIVERS\iaStor.sys
13:09:07.0838 2956        iaStor - ok
13:09:07.0902 2956        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
13:09:08.0030 2956        iaStorV - ok
13:09:08.0125 2956        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
13:09:08.0277 2956        idsvc - ok
13:09:08.0496 2956        igfx            (2d18c9e1f23970de32d78d3b1cdda0a7) C:\Windows\system32\DRIVERS\igdkmd64.sys
13:09:08.0855 2956        igfx - ok
13:09:08.0912 2956        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
13:09:08.0941 2956        iirsp - ok
13:09:09.0009 2956        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
13:09:09.0182 2956        IKEEXT - ok
13:09:09.0207 2956        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
13:09:09.0229 2956        intelide - ok
13:09:09.0472 2956        intelkmd        (2d18c9e1f23970de32d78d3b1cdda0a7) C:\Windows\system32\DRIVERS\igdpmd64.sys
13:09:09.0833 2956        intelkmd - ok
13:09:09.0891 2956        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
13:09:09.0938 2956        intelppm - ok
13:09:09.0990 2956        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
13:09:10.0106 2956        IPBusEnum - ok
13:09:10.0143 2956        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
13:09:10.0302 2956        IpFilterDriver - ok
13:09:10.0355 2956        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
13:09:10.0442 2956        iphlpsvc - ok
13:09:10.0482 2956        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
13:09:10.0578 2956        IPMIDRV - ok
13:09:10.0616 2956        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
13:09:10.0705 2956        IPNAT - ok
13:09:10.0742 2956        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
13:09:10.0798 2956        IRENUM - ok
13:09:10.0824 2956        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
13:09:10.0848 2956        isapnp - ok
13:09:10.0880 2956        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
13:09:10.0984 2956        iScsiPrt - ok
13:09:11.0023 2956        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
13:09:11.0051 2956        kbdclass - ok
13:09:11.0075 2956        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
13:09:11.0173 2956        kbdhid - ok
13:09:11.0202 2956        KeyIso          (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
13:09:11.0228 2956        KeyIso - ok
13:09:11.0280 2956        KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
13:09:11.0366 2956        KSecDD - ok
13:09:11.0420 2956        KSecPkg        (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
13:09:11.0517 2956        KSecPkg - ok
13:09:11.0536 2956        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
13:09:11.0618 2956        ksthunk - ok
13:09:11.0666 2956        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
13:09:11.0767 2956        KtmRm - ok
13:09:11.0855 2956        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
13:09:12.0029 2956        LanmanServer - ok
13:09:12.0096 2956        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
13:09:12.0227 2956        LanmanWorkstation - ok
13:09:12.0307 2956        LightScribeService (0ee66bdf485c6828aa65c0ef5d591133) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
13:09:12.0445 2956        LightScribeService ( UnsignedFile.Multi.Generic ) - warning
13:09:12.0445 2956        LightScribeService - detected UnsignedFile.Multi.Generic (1)
13:09:12.0521 2956        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
13:09:12.0635 2956        lltdio - ok
13:09:12.0687 2956        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
13:09:12.0779 2956        lltdsvc - ok
13:09:12.0805 2956        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
13:09:12.0878 2956        lmhosts - ok
13:09:12.0922 2956        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
13:09:12.0944 2956        LSI_FC - ok
13:09:12.0968 2956        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
13:09:12.0992 2956        LSI_SAS - ok
13:09:13.0049 2956        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
13:09:13.0085 2956        LSI_SAS2 - ok
13:09:13.0137 2956        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
13:09:13.0172 2956        LSI_SCSI - ok
13:09:13.0211 2956        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
13:09:13.0312 2956        luafv - ok
13:09:13.0394 2956        MBAMProtector  (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys
13:09:13.0498 2956        MBAMProtector - ok
13:09:13.0590 2956        MBAMService    (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
13:09:13.0760 2956        MBAMService - ok
13:09:13.0862 2956        McAfeeFramework (062d80f13d762f7bc2f38430d60f5048) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
13:09:13.0968 2956        McAfeeFramework - ok
13:09:14.0085 2956        McShield        (00315dc847778d65728197b63803b523) C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
13:09:14.0114 2956        McShield - ok
13:09:14.0168 2956        McTaskManager  (b15bb3aef59158b4e1dda5328c842713) C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
13:09:14.0195 2956        McTaskManager - ok
13:09:14.0283 2956        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
13:09:14.0409 2956        Mcx2Svc - ok
13:09:14.0450 2956        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
13:09:14.0471 2956        megasas - ok
13:09:14.0514 2956        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
13:09:14.0549 2956        MegaSR - ok
13:09:14.0596 2956        mfeapfk        (0d121a46e0148a3bc941fa3bb0269329) C:\Windows\system32\drivers\mfeapfk.sys
13:09:14.0690 2956        mfeapfk - ok
13:09:14.0721 2956        mfeavfk        (93f251905c028809ffb49f95a63fcbc9) C:\Windows\system32\drivers\mfeavfk.sys
13:09:14.0817 2956        mfeavfk - ok
13:09:14.0852 2956        mfeavfk01 - ok
13:09:14.0900 2956        mfehidk        (a282a937127ea7b15eb85559e59ae576) C:\Windows\system32\drivers\mfehidk.sys
13:09:15.0044 2956        mfehidk - ok
13:09:15.0092 2956        mferkdet        (04d7e0e2a48730a1c535837f105e6352) C:\Windows\system32\drivers\mferkdet.sys
13:09:15.0193 2956        mferkdet - ok
13:09:15.0220 2956        mfevtp          (45f1580c7c9f49a68b72ef2ccefef3a3) C:\Windows\system32\mfevtps.exe
13:09:15.0308 2956        mfevtp - ok
13:09:15.0362 2956        mfewfpk        (325dd1031cfd71bd4d8afdb1faaf3bea) C:\Windows\system32\drivers\mfewfpk.sys
13:09:15.0464 2956        mfewfpk - ok
13:09:15.0553 2956        Microsoft SharePoint Workspace Audit Service - ok
13:09:15.0627 2956        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
13:09:15.0725 2956        MMCSS - ok
13:09:15.0765 2956        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
13:09:15.0853 2956        Modem - ok
13:09:15.0895 2956        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
13:09:15.0938 2956        monitor - ok
13:09:15.0976 2956        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
13:09:16.0004 2956        mouclass - ok
13:09:16.0047 2956        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
13:09:16.0094 2956        mouhid - ok
13:09:16.0139 2956        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
13:09:16.0160 2956        mountmgr - ok
13:09:16.0212 2956        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
13:09:16.0312 2956        mpio - ok
13:09:16.0336 2956        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
13:09:16.0409 2956        mpsdrv - ok
13:09:16.0468 2956        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
13:09:16.0598 2956        MpsSvc - ok
13:09:16.0642 2956        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
13:09:16.0766 2956        MRxDAV - ok
13:09:16.0809 2956        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
13:09:16.0921 2956        mrxsmb - ok
13:09:16.0965 2956        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
13:09:17.0079 2956        mrxsmb10 - ok
13:09:17.0109 2956        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
13:09:17.0208 2956        mrxsmb20 - ok
13:09:17.0247 2956        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
13:09:17.0356 2956        msahci - ok
13:09:17.0391 2956        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
13:09:17.0505 2956        msdsm - ok
13:09:17.0545 2956        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
13:09:17.0597 2956        MSDTC - ok
13:09:17.0635 2956        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
13:09:17.0696 2956        Msfs - ok
13:09:17.0725 2956        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
13:09:17.0810 2956        mshidkmdf - ok
13:09:17.0849 2956        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
13:09:17.0879 2956        msisadrv - ok
13:09:17.0923 2956        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
13:09:18.0012 2956        MSiSCSI - ok
13:09:18.0023 2956        msiserver - ok
13:09:18.0060 2956        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
13:09:18.0149 2956        MSKSSRV - ok
13:09:18.0184 2956        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
13:09:18.0279 2956        MSPCLOCK - ok
13:09:18.0300 2956        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
13:09:18.0378 2956        MSPQM - ok
13:09:18.0430 2956        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
13:09:18.0530 2956        MsRPC - ok
13:09:18.0587 2956        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
13:09:18.0612 2956        mssmbios - ok
13:09:18.0639 2956        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
13:09:18.0709 2956        MSTEE - ok
13:09:18.0745 2956        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
13:09:18.0772 2956        MTConfig - ok
13:09:18.0802 2956        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
13:09:18.0829 2956        Mup - ok
13:09:18.0889 2956        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
13:09:18.0974 2956        napagent - ok
13:09:19.0032 2956        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
13:09:19.0114 2956        NativeWifiP - ok
13:09:19.0199 2956        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
13:09:19.0264 2956        NDIS - ok
13:09:19.0297 2956        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
13:09:19.0369 2956        NdisCap - ok
13:09:19.0404 2956        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
13:09:19.0473 2956        NdisTapi - ok
13:09:19.0530 2956        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
13:09:19.0683 2956        Ndisuio - ok
13:09:19.0728 2956        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
13:09:19.0873 2956        NdisWan - ok
13:09:19.0909 2956        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
13:09:20.0084 2956        NDProxy - ok
13:09:20.0194 2956        Net Driver HPZ12 (2334dc48997ba203b794df3ee70521db) C:\Windows\system32\HPZinw12.dll
13:09:20.0290 2956        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
13:09:20.0290 2956        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
13:09:20.0322 2956        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
13:09:20.0393 2956        NetBIOS - ok
13:09:20.0439 2956        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
13:09:20.0539 2956        NetBT - ok
13:09:20.0582 2956        Netlogon        (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
13:09:20.0609 2956        Netlogon - ok
13:09:20.0653 2956        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
13:09:20.0747 2956        Netman - ok
13:09:20.0779 2956        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
13:09:20.0862 2956        netprofm - ok
13:09:20.0918 2956        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
13:09:20.0953 2956        NetTcpPortSharing - ok
13:09:21.0202 2956        NETw5s64        (39ede676d17f37af4573c2b33ec28aca) C:\Windows\system32\DRIVERS\NETw5s64.sys
13:09:21.0500 2956        NETw5s64 - ok
13:09:21.0703 2956        netw5v64        (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys
13:09:21.0916 2956        netw5v64 - ok
13:09:21.0961 2956        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
13:09:21.0993 2956        nfrd960 - ok
13:09:22.0054 2956        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
13:09:22.0161 2956        NlaSvc - ok
13:09:22.0191 2956        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
13:09:22.0252 2956        Npfs - ok
13:09:22.0286 2956        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
13:09:22.0368 2956        nsi - ok
13:09:22.0392 2956        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
13:09:22.0473 2956        nsiproxy - ok
13:09:22.0550 2956        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
13:09:22.0740 2956        Ntfs - ok
13:09:22.0765 2956        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
13:09:22.0836 2956        Null - ok
13:09:22.0886 2956        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
13:09:22.0995 2956        nvraid - ok
13:09:23.0018 2956        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
13:09:23.0117 2956        nvstor - ok
13:09:23.0163 2956        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
13:09:23.0203 2956        nv_agp - ok
13:09:23.0243 2956        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
13:09:23.0292 2956        ohci1394 - ok
13:09:23.0379 2956        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:09:23.0484 2956        ose - ok
13:09:23.0709 2956        osppsvc        (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
13:09:24.0112 2956        osppsvc - ok
13:09:24.0193 2956        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
13:09:24.0289 2956        p2pimsvc - ok
13:09:24.0334 2956        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
13:09:24.0412 2956        p2psvc - ok
13:09:24.0459 2956        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
13:09:24.0506 2956        Parport - ok
13:09:24.0556 2956        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
13:09:24.0648 2956        partmgr - ok
13:09:24.0670 2956        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
13:09:24.0728 2956        PcaSvc - ok
13:09:24.0768 2956        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
13:09:24.0798 2956        pci - ok
13:09:24.0817 2956        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
13:09:24.0838 2956        pciide - ok
13:09:24.0867 2956        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
13:09:24.0897 2956        pcmcia - ok
13:09:25.0063 2956        pcvisit UAC starting service v8.2.1.2238 (052942171bfde210ebdb3ac376248e08) C:\Program Files (x86)\pcvisit Software AG\pcvisit 8\pcvisit.exe
13:09:29.0514 2956        pcvisit UAC starting service v8.2.1.2238 - ok
13:09:29.0586 2956        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
13:09:29.0620 2956        pcw - ok
13:09:29.0665 2956        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
13:09:29.0824 2956        PEAUTH - ok
13:09:29.0908 2956        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
13:09:29.0968 2956        PerfHost - ok
13:09:30.0046 2956        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
13:09:30.0240 2956        pla - ok
13:09:30.0295 2956        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
13:09:30.0427 2956        PlugPlay - ok
13:09:30.0521 2956        Pml Driver HPZ12 (ac78df349f0e4cfb8b667c0cfff83cce) C:\Windows\system32\HPZipm12.dll
13:09:30.0592 2956        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
13:09:30.0592 2956        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
13:09:30.0621 2956        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
13:09:30.0668 2956        PNRPAutoReg - ok
13:09:30.0702 2956        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
13:09:30.0731 2956        PNRPsvc - ok
13:09:30.0789 2956        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
13:09:30.0945 2956        PolicyAgent - ok
13:09:30.0986 2956        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
13:09:31.0067 2956        Power - ok
13:09:31.0131 2956        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
13:09:31.0283 2956        PptpMiniport - ok
13:09:31.0325 2956        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
13:09:31.0379 2956        Processor - ok
13:09:31.0411 2956        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
13:09:31.0549 2956        ProfSvc - ok
13:09:31.0588 2956        ProtectedStorage (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
13:09:31.0616 2956        ProtectedStorage - ok
13:09:31.0679 2956        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
13:09:31.0749 2956        Psched - ok
13:09:31.0821 2956        PSI_SVC_2      (a6a7ad767bf5141665f5c675f671b3e1) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
13:09:32.0022 2956        PSI_SVC_2 - ok
13:09:32.0085 2956        PxHlpa64        (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
13:09:32.0193 2956        PxHlpa64 - ok
13:09:32.0265 2956        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
13:09:32.0374 2956        ql2300 - ok
13:09:32.0407 2956        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
13:09:32.0429 2956        ql40xx - ok
13:09:32.0462 2956        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
13:09:32.0506 2956        QWAVE - ok
13:09:32.0533 2956        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
13:09:32.0583 2956        QWAVEdrv - ok
13:09:32.0671 2956        RapiMgr        (a55e7d0d873b2c97585b3b5926ac6ade) C:\Windows\WindowsMobile\rapimgr.dll
13:09:32.0746 2956        RapiMgr - ok
13:09:32.0767 2956        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
13:09:32.0841 2956        RasAcd - ok
13:09:32.0885 2956        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
13:09:32.0968 2956        RasAgileVpn - ok
13:09:32.0988 2956        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
13:09:33.0062 2956        RasAuto - ok
13:09:33.0114 2956        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
13:09:33.0267 2956        Rasl2tp - ok
13:09:33.0301 2956        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
13:09:33.0467 2956        RasMan - ok
13:09:33.0493 2956        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
13:09:33.0574 2956        RasPppoe - ok
13:09:33.0616 2956        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
13:09:33.0691 2956        RasSstp - ok
13:09:33.0741 2956        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
13:09:33.0898 2956        rdbss - ok
13:09:33.0937 2956        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
13:09:33.0973 2956        rdpbus - ok
13:09:33.0999 2956        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
13:09:34.0088 2956        RDPCDD - ok
13:09:34.0123 2956        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
13:09:34.0201 2956        RDPENCDD - ok
13:09:34.0230 2956        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
13:09:34.0289 2956        RDPREFMP - ok
13:09:34.0388 2956        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
13:09:34.0535 2956        RDPWD - ok
13:09:34.0596 2956        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
13:09:34.0715 2956        rdyboost - ok
13:09:34.0751 2956        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
13:09:34.0840 2956        RemoteAccess - ok
13:09:34.0877 2956        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
13:09:34.0962 2956        RemoteRegistry - ok
13:09:35.0014 2956        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
13:09:35.0077 2956        RFCOMM - ok
13:09:35.0141 2956        RichVideo      (498eb62a160674e793fa40fd65390625) C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
13:09:35.0331 2956        RichVideo - ok
13:09:35.0354 2956        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
13:09:35.0419 2956        RpcEptMapper - ok
13:09:35.0439 2956        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
13:09:35.0484 2956        RpcLocator - ok
13:09:35.0539 2956        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
13:09:35.0615 2956        RpcSs - ok
13:09:35.0658 2956        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
13:09:35.0741 2956        rspndr - ok
13:09:35.0796 2956        RSUSBSTOR      (8c22f21c924413d4e109995f748e18bb) C:\Windows\system32\Drivers\RtsUStor.sys
13:09:35.0852 2956        RSUSBSTOR - ok
13:09:35.0893 2956        RTL8167        (365ed58b47b46de8b1c5fa759b6fcd6e) C:\Windows\system32\DRIVERS\Rt64win7.sys
13:09:36.0029 2956        RTL8167 - ok
13:09:36.0042 2956        RtsUIR - ok
13:09:36.0069 2956        SamSs          (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
13:09:36.0096 2956        SamSs - ok
13:09:36.0143 2956        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
13:09:36.0244 2956        sbp2port - ok
13:09:36.0275 2956        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
13:09:36.0369 2956        SCardSvr - ok
13:09:36.0395 2956        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
13:09:36.0547 2956        scfilter - ok
13:09:36.0617 2956        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
13:09:36.0772 2956        Schedule - ok
13:09:36.0820 2956        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
13:09:36.0888 2956        SCPolicySvc - ok
13:09:36.0925 2956        sdbus          (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
13:09:37.0037 2956        sdbus - ok
13:09:37.0082 2956        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
13:09:37.0230 2956        SDRSVC - ok
13:09:37.0332 2956        SeaPort        (16a252022535b680046f6e34e136d378) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
13:09:37.0474 2956        SeaPort - ok
13:09:37.0521 2956        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
13:09:37.0602 2956        secdrv - ok
13:09:37.0671 2956        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
13:09:37.0817 2956        seclogon - ok
13:09:37.0865 2956        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
13:09:37.0942 2956        SENS - ok
13:09:37.0975 2956        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
13:09:38.0029 2956        SensrSvc - ok
13:09:38.0071 2956        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
13:09:38.0100 2956        Serenum - ok
13:09:38.0122 2956        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
13:09:38.0173 2956        Serial - ok
13:09:38.0212 2956        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
13:09:38.0270 2956        sermouse - ok
13:09:38.0341 2956        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
13:09:38.0490 2956        SessionEnv - ok
13:09:38.0535 2956        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
13:09:38.0613 2956        sffdisk - ok
13:09:38.0643 2956        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
13:09:38.0697 2956        sffp_mmc - ok
13:09:38.0727 2956        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
13:09:38.0838 2956        sffp_sd - ok
13:09:38.0890 2956        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
13:09:38.0945 2956        sfloppy - ok
13:09:39.0010 2956        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
13:09:39.0104 2956        SharedAccess - ok
13:09:39.0153 2956        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
13:09:39.0329 2956        ShellHWDetection - ok
13:09:39.0377 2956        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
13:09:39.0409 2956        SiSRaid2 - ok
13:09:39.0433 2956        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
13:09:39.0468 2956        SiSRaid4 - ok
13:09:39.0509 2956        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
13:09:39.0578 2956        Smb - ok
13:09:39.0643 2956        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
13:09:39.0701 2956        SNMPTRAP - ok
13:09:39.0732 2956        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
13:09:39.0754 2956        spldr - ok
13:09:39.0805 2956        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
13:09:39.0991 2956        Spooler - ok
13:09:40.0122 2956        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
13:09:40.0384 2956        sppsvc - ok
13:09:40.0414 2956        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
13:09:40.0503 2956        sppuinotify - ok
13:09:40.0567 2956        sptd - ok
13:09:40.0638 2956        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
13:09:40.0796 2956        srv - ok
13:09:40.0849 2956        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
13:09:40.0985 2956        srv2 - ok
13:09:41.0044 2956        SrvHsfHDA      (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
13:09:41.0083 2956        SrvHsfHDA - ok
13:09:41.0138 2956        SrvHsfV92      (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
13:09:41.0262 2956        SrvHsfV92 - ok
13:09:41.0299 2956        SrvHsfWinac    (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
13:09:41.0383 2956        SrvHsfWinac - ok
13:09:41.0408 2956        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
13:09:41.0526 2956        srvnet - ok
13:09:41.0565 2956        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
13:09:41.0648 2956        SSDPSRV - ok
13:09:41.0675 2956        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
13:09:41.0738 2956        SstpSvc - ok
13:09:41.0852 2956        STacSV          (7f30633a5aec81140dbc6daaaebd0cbe) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_471277d5d45019ea\STacSV64.exe
13:09:42.0013 2956        STacSV - ok
13:09:42.0051 2956        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
13:09:42.0072 2956        stexstor - ok
13:09:42.0116 2956        STHDA          (f991751c2477257bbcedb364a0f449b4) C:\Windows\system32\DRIVERS\stwrt64.sys
13:09:42.0238 2956        STHDA - ok
13:09:42.0290 2956        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
13:09:42.0419 2956        stisvc - ok
13:09:42.0486 2956        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
13:09:42.0528 2956        swenum - ok
13:09:42.0663 2956        SwitchBoard    (f577910a133a592234ebaad3f3afa258) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
13:09:42.0850 2956        SwitchBoard ( UnsignedFile.Multi.Generic ) - warning
13:09:42.0850 2956        SwitchBoard - detected UnsignedFile.Multi.Generic (1)
13:09:42.0924 2956        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
13:09:43.0069 2956        swprv - ok
13:09:43.0166 2956        SynTP          (3a706a967295e16511e40842b1a2761d) C:\Windows\system32\DRIVERS\SynTP.sys
13:09:43.0275 2956        SynTP - ok
13:09:43.0371 2956        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
13:09:43.0567 2956        SysMain - ok
13:09:43.0635 2956        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
13:09:43.0739 2956        TabletInputService - ok
13:09:43.0883 2956        TabletServicePen (ba44830cdebe45fe2e1440b4c5b5d8e8) C:\Windows\system32\Pen_Tablet.exe
13:09:44.0198 2956        TabletServicePen - ok
13:09:44.0228 2956        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
13:09:44.0365 2956        TapiSrv - ok
13:09:44.0404 2956        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
13:09:44.0497 2956        TBS - ok
13:09:44.0610 2956        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
13:09:44.0795 2956        Tcpip - ok
13:09:44.0853 2956        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
13:09:44.0920 2956        TCPIP6 - ok
13:09:44.0973 2956        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
13:09:45.0156 2956        tcpipreg - ok
13:09:45.0199 2956        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
13:09:45.0229 2956        TDPIPE - ok
13:09:45.0271 2956        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
13:09:45.0370 2956        TDTCP - ok
13:09:45.0412 2956        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
13:09:45.0541 2956        tdx - ok
13:09:45.0702 2956        TeamViewer6    (839e88db24d2d8f05b72e12b175951ca) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
13:09:45.0982 2956        TeamViewer6 - ok
13:09:46.0028 2956        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
13:09:46.0135 2956        TermDD - ok
13:09:46.0193 2956        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
13:09:46.0380 2956        TermService - ok
13:09:46.0441 2956        TFsExDisk      (ce4b6956e4e12492715a53076e58761f) C:\Windows\System32\Drivers\TFsExDisk.sys
13:09:46.0548 2956        TFsExDisk - ok
13:09:46.0584 2956        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
13:09:46.0632 2956        Themes - ok
13:09:46.0682 2956        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
13:09:46.0748 2956        THREADORDER - ok
13:09:46.0773 2956        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
13:09:46.0859 2956        TrkWks - ok
13:09:46.0914 2956        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
13:09:46.0992 2956        TrustedInstaller - ok
13:09:47.0044 2956        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
13:09:47.0171 2956        tssecsrv - ok
13:09:47.0234 2956        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
13:09:47.0379 2956        TsUsbFlt - ok
13:09:47.0452 2956        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
13:09:47.0594 2956        tunnel - ok
13:09:47.0627 2956        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
13:09:47.0652 2956        uagp35 - ok
13:09:47.0709 2956        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
13:09:47.0883 2956        udfs - ok
13:09:47.0929 2956        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
13:09:47.0975 2956        UI0Detect - ok
13:09:48.0017 2956        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
13:09:48.0042 2956        uliagpkx - ok
13:09:48.0094 2956        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
13:09:48.0220 2956        umbus - ok
13:09:48.0256 2956        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
13:09:48.0300 2956        UmPass - ok
13:09:48.0336 2956        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
13:09:48.0421 2956        upnphost - ok
13:09:48.0469 2956        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
13:09:48.0583 2956        usbaudio - ok
13:09:48.0611 2956        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
13:09:48.0753 2956        usbccgp - ok
13:09:48.0770 2956        USBCCID - ok
13:09:48.0828 2956        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
13:09:48.0884 2956        usbcir - ok
13:09:48.0935 2956        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
13:09:49.0063 2956        usbehci - ok
13:09:49.0093 2956        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
13:09:49.0208 2956        usbhub - ok
13:09:49.0237 2956        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
13:09:49.0344 2956        usbohci - ok
13:09:49.0397 2956        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
13:09:49.0447 2956        usbprint - ok
13:09:49.0508 2956        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
13:09:49.0557 2956        usbscan - ok
13:09:49.0586 2956        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
13:09:49.0718 2956        USBSTOR - ok
13:09:49.0764 2956        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
13:09:49.0869 2956        usbuhci - ok
13:09:49.0944 2956        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
13:09:50.0057 2956        usbvideo - ok
13:09:50.0111 2956        usb_rndisx      (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys
13:09:50.0176 2956        usb_rndisx - ok
13:09:50.0221 2956        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
13:09:50.0327 2956        UxSms - ok
13:09:50.0366 2956        VaultSvc        (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe
13:09:50.0392 2956        VaultSvc - ok
13:09:50.0489 2956        VBoxDrv        (0d0fb2ee4333aa6808592a2ab0ebdd0f) C:\Windows\system32\DRIVERS\VBoxDrv.sys
13:09:50.0607 2956        VBoxDrv - ok
13:09:50.0651 2956        VBoxNetAdp      (626f0a31303b999ea4999138ac63c3e9) C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
13:09:50.0770 2956        VBoxNetAdp - ok
13:09:50.0799 2956        VBoxNetFlt      (44023cd9a22b91e0704b41fc2fdeef77) C:\Windows\system32\DRIVERS\VBoxNetFlt.sys
13:09:50.0886 2956        VBoxNetFlt - ok
13:09:50.0946 2956        VBoxUSB        (20b10bcf909cd3711a2cf9cd704845a2) C:\Windows\system32\Drivers\VBoxUSB.sys
13:09:51.0044 2956        VBoxUSB - ok
13:09:51.0128 2956        VBoxUSBMon      (d31ef2f40e092501f2752a5ba766f193) C:\Windows\system32\DRIVERS\VBoxUSBMon.sys
13:09:51.0230 2956        VBoxUSBMon - ok
13:09:51.0330 2956        vcsFPService    (bdb28d602e63de51c252996290ec0ca4) C:\Windows\system32\vcsFPService.exe
13:09:51.0557 2956        vcsFPService - ok
13:09:51.0615 2956        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
13:09:51.0649 2956        vdrvroot - ok
13:09:51.0712 2956        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
13:09:51.0883 2956        vds - ok
13:09:51.0917 2956        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
13:09:51.0948 2956        vga - ok
13:09:51.0971 2956        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
13:09:52.0038 2956        VgaSave - ok
13:09:52.0085 2956        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
13:09:52.0191 2956        vhdmp - ok
13:09:52.0217 2956        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
13:09:52.0239 2956        viaide - ok
13:09:52.0260 2956        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
13:09:52.0355 2956        volmgr - ok
13:09:52.0407 2956        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
13:09:52.0435 2956        volmgrx - ok
13:09:52.0462 2956        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
13:09:52.0569 2956        volsnap - ok
13:09:52.0615 2956        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
13:09:52.0640 2956        vsmraid - ok
13:09:52.0730 2956        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
13:09:53.0001 2956        VSS - ok
13:09:53.0032 2956        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
13:09:53.0079 2956        vwifibus - ok
13:09:53.0131 2956        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
13:09:53.0194 2956        vwififlt - ok
13:09:53.0264 2956        vwifimp        (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
13:09:53.0312 2956        vwifimp - ok
13:09:53.0350 2956        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
13:09:53.0424 2956        W32Time - ok
13:09:53.0461 2956        wacommousefilter (e04d43c7d1641e95d35cae6086c7e350) C:\Windows\system32\DRIVERS\wacommousefilter.sys
13:09:53.0548 2956        wacommousefilter - ok
13:09:53.0583 2956        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
13:09:53.0636 2956        WacomPen - ok
13:09:53.0651 2956        wacomvhid      (ec1ceb237e365330c1fcfc4876aa0ac0) C:\Windows\system32\DRIVERS\wacomvhid.sys
13:09:53.0732 2956        wacomvhid - ok
13:09:53.0793 2956        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
13:09:53.0945 2956        WANARP - ok
13:09:53.0967 2956        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
13:09:54.0025 2956        Wanarpv6 - ok
13:09:54.0109 2956        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
13:09:54.0289 2956        WatAdminSvc - ok
13:09:54.0367 2956        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
13:09:54.0558 2956        wbengine - ok
13:09:54.0596 2956        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
13:09:54.0643 2956        WbioSrvc - ok
13:09:54.0710 2956        WcesComm        (8bda6db43aa54e8bb5e0794541ddc209) C:\Windows\WindowsMobile\wcescomm.dll
13:09:54.0791 2956        WcesComm - ok
13:09:54.0843 2956        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
13:09:54.0898 2956        wcncsvc - ok
13:09:54.0929 2956        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
13:09:54.0980 2956        WcsPlugInService - ok
13:09:55.0032 2956        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
13:09:55.0064 2956        Wd - ok
13:09:55.0117 2956        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
13:09:55.0180 2956        Wdf01000 - ok
13:09:55.0205 2956        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
13:09:55.0307 2956        WdiServiceHost - ok
13:09:55.0318 2956        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
13:09:55.0352 2956        WdiSystemHost - ok
13:09:55.0404 2956        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
13:09:55.0512 2956        WebClient - ok
13:09:55.0541 2956        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
13:09:55.0637 2956        Wecsvc - ok
13:09:55.0663 2956        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
13:09:55.0731 2956        wercplsupport - ok
13:09:55.0756 2956        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
13:09:55.0842 2956        WerSvc - ok
13:09:55.0898 2956        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
13:09:55.0962 2956        WfpLwf - ok
13:09:55.0986 2956        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
13:09:56.0009 2956        WIMMount - ok
13:09:56.0041 2956        WinDefend - ok
13:09:56.0060 2956        WinHttpAutoProxySvc - ok
13:09:56.0133 2956        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
13:09:56.0219 2956        Winmgmt - ok
13:09:56.0314 2956        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
13:09:56.0537 2956        WinRM - ok
13:09:56.0615 2956        WinUSB          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
13:09:56.0672 2956        WinUSB - ok
13:09:56.0741 2956        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
13:09:56.0846 2956        Wlansvc - ok
13:09:57.0000 2956        wlidsvc        (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
13:09:57.0205 2956        wlidsvc - ok
13:09:57.0297 2956        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
13:09:57.0337 2956        WmiAcpi - ok
13:09:57.0407 2956        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
13:09:57.0458 2956        wmiApSrv - ok
13:09:57.0500 2956        WMPNetworkSvc - ok
13:09:57.0531 2956        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
13:09:57.0574 2956        WPCSvc - ok
13:09:57.0627 2956        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
13:09:57.0718 2956        WPDBusEnum - ok
13:09:57.0759 2956        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
13:09:57.0839 2956        ws2ifsl - ok
13:09:57.0877 2956        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
13:09:57.0923 2956        wscsvc - ok
13:09:57.0934 2956        WSearch - ok
13:09:58.0030 2956        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
13:09:58.0182 2956        wuauserv - ok
13:09:58.0230 2956        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
13:09:58.0381 2956        WudfPf - ok
13:09:58.0419 2956        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
13:09:58.0568 2956        WUDFRd - ok
13:09:58.0619 2956        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
13:09:58.0743 2956        wudfsvc - ok
13:09:58.0785 2956        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
13:09:58.0832 2956        WwanSvc - ok
13:09:58.0898 2956        yukonw7        (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys
13:09:58.0941 2956        yukonw7 - ok
13:09:59.0051 2956        {55662437-DA8C-40c0-AADA-2C816A897A49} (74983addca2d9618512c088d856d6615) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl
13:09:59.0168 2956        {55662437-DA8C-40c0-AADA-2C816A897A49} - ok
13:09:59.0214 2956        MBR (0x1B8)    (14de041899ab7aef358ad790eb499356) \Device\Harddisk0\DR0
13:09:59.0366 2956        \Device\Harddisk0\DR0 - ok
13:09:59.0406 2956        Boot (0x1200)  (d82d368c6354bda8bb2ab279561b3883) \Device\Harddisk0\DR0\Partition0
13:09:59.0410 2956        \Device\Harddisk0\DR0\Partition0 - ok
13:09:59.0423 2956        Boot (0x1200)  (b4be3856f3eb8f5d03d6afbea50fc27d) \Device\Harddisk0\DR0\Partition1
13:09:59.0426 2956        \Device\Harddisk0\DR0\Partition1 - ok
13:09:59.0457 2956        Boot (0x1200)  (dfe4b5170c309c0bef6a39c565bcff76) \Device\Harddisk0\DR0\Partition2
13:09:59.0461 2956        \Device\Harddisk0\DR0\Partition2 - ok
13:09:59.0477 2956        Boot (0x1200)  (e394ef90db36fcf7045c1132ec5c607b) \Device\Harddisk0\DR0\Partition3
13:09:59.0479 2956        \Device\Harddisk0\DR0\Partition3 - ok
13:09:59.0481 2956        ============================================================
13:09:59.0481 2956        Scan finished
13:09:59.0481 2956        ============================================================
13:09:59.0508 0940        Detected object count: 8
13:09:59.0508 0940        Actual detected object count: 8
13:11:08.0098 0940        Akamai ( HiddenFile.Multi.Generic ) - skipped by user
13:11:08.0099 0940        Akamai ( HiddenFile.Multi.Generic ) - User select action: Skip
13:11:08.0104 0940        Apache2.2 ( UnsignedFile.Multi.Generic ) - skipped by user
13:11:08.0104 0940        Apache2.2 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:11:08.0106 0940        DpHost ( UnsignedFile.Multi.Generic ) - skipped by user
13:11:08.0106 0940        DpHost ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:11:08.0109 0940        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
13:11:08.0109 0940        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:11:08.0112 0940        LightScribeService ( UnsignedFile.Multi.Generic ) - skipped by user
13:11:08.0112 0940        LightScribeService ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:11:08.0114 0940        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
13:11:08.0115 0940        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:11:08.0117 0940        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
13:11:08.0117 0940        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:11:08.0120 0940        SwitchBoard ( UnsignedFile.Multi.Generic ) - skipped by user
13:11:08.0120 0940        SwitchBoard ( UnsignedFile.Multi.Generic ) - User select action: Skip
liebe grüße

cosinus 02.04.2012 10:06
Ja da wurde schon einiges an Müll entfernt. Toolbars und Adware
Da kann aber immer noch mehr drauf sein.

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131