Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   csrss.exe, wisptis.exe doppelt (https://www.trojaner-board.de/113531-csrss-exe-wisptis-exe-doppelt.html)

kwongk 16.04.2012 14:29
Hier der log vom Fix

Code:
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c55054ff-7def-11df-a598-00269eaf48c8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c55054ff-7def-11df-a598-00269eaf48c8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c55054ff-7def-11df-a598-00269eaf48c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c55054ff-7def-11df-a598-00269eaf48c8}\ not found.
File E:\Launch.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ddf8a33e-411a-11e1-ad07-00269eaf48c8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ddf8a33e-411a-11e1-ad07-00269eaf48c8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ddf8a33e-411a-11e1-ad07-00269eaf48c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ddf8a33e-411a-11e1-ad07-00269eaf48c8}\ not found.
File E:\pushinst.exe not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
 
User: All Users
 
User: ***
->Temp folder emptied: 4463 bytes
->Temporary Internet Files folder emptied: 82322 bytes
->FireFox cache emptied: 46055845 bytes
->Flash cache emptied: 630 bytes
 
User: ***
->Temp folder emptied: 1572938 bytes
 
User: Default
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4432 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67698 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 751 bytes
RecycleBin emptied: 908576 bytes
 
Total Files Cleaned = 46,00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: ***
->Flash cache emptied: 0 bytes
 
User: ***
 
User: Default
 
User: Default User
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.2 log created on 04162012_152126

Files\Folders moved on Reboot...
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
Danke für deine Mühe, wie geht's weiter?

cosinus 16.04.2012 15:27
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten, Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

kwongk 16.04.2012 15:36
Das sieht irgendwie böse aus D:

Code:
16:30:38.0094 0872        TDSS rootkit removing tool 2.7.28.0 Apr 10 2012 16:54:05
16:30:40.0100 0872        ============================================================
16:30:40.0100 0872        Current date / time: 2012/04/16 16:30:40.0100
16:30:40.0100 0872        SystemInfo:
16:30:40.0100 0872       
16:30:40.0100 0872        OS Version: 6.1.7601 ServicePack: 1.0
16:30:40.0100 0872        Product type: Workstation
16:30:40.0100 0872        ComputerName: KWO-COMPUTER
16:30:40.0101 0872        UserName: ***
16:30:40.0101 0872        Windows directory: C:\Windows
16:30:40.0101 0872        System windows directory: C:\Windows
16:30:40.0101 0872        Running under WOW64
16:30:40.0101 0872        Processor architecture: Intel x64
16:30:40.0101 0872        Number of processors: 2
16:30:40.0101 0872        Page size: 0x1000
16:30:40.0101 0872        Boot type: Normal boot
16:30:40.0101 0872        ============================================================
16:30:45.0340 0872        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:30:45.0383 0872        \Device\Harddisk0\DR0:
16:30:45.0383 0872        MBR used
16:30:45.0383 0872        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1800800, BlocksNum 0x32000
16:30:45.0383 0872        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1832800, BlocksNum 0x12D99800
16:30:45.0396 0872        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x145CC800, BlocksNum 0x10E61800
16:30:45.0602 0872        Initialize success
16:30:45.0602 0872        ============================================================
16:32:46.0805 2884        ============================================================
16:32:46.0805 2884        Scan started
16:32:46.0805 2884        Mode: Manual; SigCheck; TDLFS;
16:32:46.0806 2884        ============================================================
16:32:48.0068 2884        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
16:32:48.0785 2884        1394ohci - ok
16:32:48.0902 2884        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
16:32:48.0935 2884        ACPI - ok
16:32:49.0039 2884        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
16:32:49.0134 2884        AcpiPmi - ok
16:32:49.0259 2884        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:32:49.0288 2884        AdobeARMservice - ok
16:32:49.0413 2884        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
16:32:49.0475 2884        adp94xx - ok
16:32:49.0541 2884        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
16:32:49.0573 2884        adpahci - ok
16:32:49.0702 2884        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
16:32:49.0742 2884        adpu320 - ok
16:32:49.0790 2884        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
16:32:50.0016 2884        AeLookupSvc - ok
16:32:50.0139 2884        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
16:32:50.0214 2884        AFD - ok
16:32:50.0296 2884        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
16:32:50.0324 2884        agp440 - ok
16:32:50.0402 2884        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
16:32:50.0447 2884        ALG - ok
16:32:50.0483 2884        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
16:32:50.0503 2884        aliide - ok
16:32:50.0644 2884        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
16:32:50.0666 2884        amdide - ok
16:32:50.0731 2884        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
16:32:50.0808 2884        AmdK8 - ok
16:32:50.0826 2884        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
16:32:50.0901 2884        AmdPPM - ok
16:32:50.0976 2884        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
16:32:51.0008 2884        amdsata - ok
16:32:51.0054 2884        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
16:32:51.0081 2884        amdsbs - ok
16:32:51.0112 2884        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
16:32:51.0133 2884        amdxata - ok
16:32:51.0179 2884        AmUStor        (391887990cdaa83de5c56c3fde966da1) C:\Windows\system32\drivers\AmUStor.SYS
16:32:51.0230 2884        AmUStor - ok
16:32:51.0294 2884        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
16:32:51.0521 2884        AppID - ok
16:32:51.0582 2884        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
16:32:51.0694 2884        AppIDSvc - ok
16:32:51.0779 2884        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
16:32:51.0878 2884        Appinfo - ok
16:32:51.0939 2884        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
16:32:51.0963 2884        arc - ok
16:32:51.0975 2884        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
16:32:51.0998 2884        arcsas - ok
16:32:52.0026 2884        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
16:32:52.0106 2884        AsyncMac - ok
16:32:52.0157 2884        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
16:32:52.0179 2884        atapi - ok
16:32:52.0252 2884        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
16:32:52.0355 2884        AudioEndpointBuilder - ok
16:32:52.0372 2884        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
16:32:52.0437 2884        AudioSrv - ok
16:32:52.0505 2884        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
16:32:52.0562 2884        AxInstSV - ok
16:32:52.0635 2884        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
16:32:52.0706 2884        b06bdrv - ok
16:32:52.0758 2884        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
16:32:52.0814 2884        b57nd60a - ok
16:32:52.0862 2884        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
16:32:52.0902 2884        BDESVC - ok
16:32:52.0934 2884        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
16:32:53.0009 2884        Beep - ok
16:32:53.0097 2884        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
16:32:53.0236 2884        BFE - ok
16:32:53.0276 2884        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
16:32:53.0483 2884        BITS - ok
16:32:53.0619 2884        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
16:32:53.0672 2884        blbdrive - ok
16:32:53.0723 2884        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
16:32:53.0757 2884        bowser - ok
16:32:53.0792 2884        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:32:53.0885 2884        BrFiltLo - ok
16:32:53.0895 2884        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:32:53.0921 2884        BrFiltUp - ok
16:32:53.0969 2884        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
16:32:54.0062 2884        Browser - ok
16:32:54.0095 2884        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
16:32:54.0148 2884        Brserid - ok
16:32:54.0159 2884        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
16:32:54.0192 2884        BrSerWdm - ok
16:32:54.0203 2884        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
16:32:54.0247 2884        BrUsbMdm - ok
16:32:54.0259 2884        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
16:32:54.0291 2884        BrUsbSer - ok
16:32:54.0371 2884        BthEnum        (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
16:32:54.0412 2884        BthEnum - ok
16:32:54.0461 2884        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
16:32:54.0517 2884        BTHMODEM - ok
16:32:54.0560 2884        BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
16:32:54.0609 2884        BthPan - ok
16:32:54.0697 2884        BTHPORT        (64c198198501f7560ee41d8d1efa7952) C:\Windows\System32\Drivers\BTHport.sys
16:32:54.0773 2884        BTHPORT - ok
16:32:54.0828 2884        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
16:32:54.0914 2884        bthserv - ok
16:32:54.0991 2884        BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\System32\Drivers\BTHUSB.sys
16:32:55.0029 2884        BTHUSB - ok
16:32:55.0081 2884        btusbflt        (6e04458e98daf28826482e41a7a62df5) C:\Windows\system32\drivers\btusbflt.sys
16:32:55.0247 2884        btusbflt - ok
16:32:55.0403 2884        btwaudio        (6bcfdc2b5b7f66d484486d4bd4b39a6b) C:\Windows\system32\drivers\btwaudio.sys
16:32:55.0420 2884        btwaudio - ok
16:32:55.0487 2884        btwavdt        (82dc8b7c626e526681c1bebed2bc3ff9) C:\Windows\system32\DRIVERS\btwavdt.sys
16:32:55.0510 2884        btwavdt - ok
16:32:55.0593 2884        btwdins        (9b3bd0ecd82cc08409c55a36d8f56b93) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
16:32:55.0627 2884        btwdins - ok
16:32:55.0735 2884        btwl2cap        (6149301dc3f81d6f9667a3fbac410975) C:\Windows\system32\DRIVERS\btwl2cap.sys
16:32:55.0758 2884        btwl2cap - ok
16:32:55.0820 2884        btwrchid        (28e105ad3b79f440bf94780f507bf66a) C:\Windows\system32\DRIVERS\btwrchid.sys
16:32:55.0839 2884        btwrchid - ok
16:32:55.0871 2884        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
16:32:55.0949 2884        cdfs - ok
16:32:56.0010 2884        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
16:32:56.0057 2884        cdrom - ok
16:32:56.0141 2884        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
16:32:56.0215 2884        CertPropSvc - ok
16:32:56.0265 2884        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
16:32:56.0328 2884        circlass - ok
16:32:56.0379 2884        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
16:32:56.0413 2884        CLFS - ok
16:32:56.0499 2884        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:32:56.0528 2884        clr_optimization_v2.0.50727_32 - ok
16:32:56.0581 2884        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:32:56.0625 2884        clr_optimization_v2.0.50727_64 - ok
16:32:56.0762 2884        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:32:56.0826 2884        clr_optimization_v4.0.30319_32 - ok
16:32:56.0893 2884        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:32:56.0919 2884        clr_optimization_v4.0.30319_64 - ok
16:32:56.0988 2884        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
16:32:57.0028 2884        CmBatt - ok
16:32:57.0088 2884        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
16:32:57.0109 2884        cmdide - ok
16:32:57.0164 2884        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
16:32:57.0244 2884        CNG - ok
16:32:57.0307 2884        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
16:32:57.0328 2884        Compbatt - ok
16:32:57.0375 2884        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
16:32:57.0421 2884        CompositeBus - ok
16:32:57.0446 2884        COMSysApp - ok
16:32:57.0464 2884        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
16:32:57.0486 2884        crcdisk - ok
16:32:57.0551 2884        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
16:32:57.0633 2884        CryptSvc - ok
16:32:57.0717 2884        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
16:32:57.0815 2884        DcomLaunch - ok
16:32:57.0852 2884        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
16:32:57.0940 2884        defragsvc - ok
16:32:58.0012 2884        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
16:32:58.0100 2884        DfsC - ok
16:32:58.0172 2884        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
16:32:58.0253 2884        Dhcp - ok
16:32:58.0296 2884        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
16:32:58.0356 2884        discache - ok
16:32:58.0391 2884        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
16:32:58.0414 2884        Disk - ok
16:32:58.0495 2884        DKbFltr        (d5bcb77be83cf99f508943945d46343d) C:\Windows\SysWOW64\Drivers\DKbFltr.sys
16:32:58.0513 2884        DKbFltr - ok
16:32:58.0567 2884        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
16:32:58.0661 2884        Dnscache - ok
16:32:58.0741 2884        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
16:32:58.0821 2884        dot3svc - ok
16:32:58.0872 2884        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
16:32:58.0928 2884        Dot4 - ok
16:32:58.0992 2884        Dot4Print      (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\drivers\Dot4Prt.sys
16:32:59.0042 2884        Dot4Print - ok
16:32:59.0089 2884        dot4usb        (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
16:32:59.0131 2884        dot4usb - ok
16:32:59.0176 2884        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
16:32:59.0269 2884        DPS - ok
16:32:59.0320 2884        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
16:32:59.0360 2884        drmkaud - ok
16:32:59.0423 2884        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
16:32:59.0496 2884        DXGKrnl - ok
16:32:59.0533 2884        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
16:32:59.0609 2884        EapHost - ok
16:32:59.0736 2884        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
16:32:59.0898 2884        ebdrv - ok
16:32:59.0936 2884        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
16:32:59.0982 2884        EFS - ok
16:33:00.0078 2884        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
16:33:00.0155 2884        ehRecvr - ok
16:33:00.0188 2884        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
16:33:00.0213 2884        ehSched - ok
16:33:00.0303 2884        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
16:33:00.0351 2884        elxstor - ok
16:33:00.0461 2884        ePowerSvc      (fb67aa8ac61b9365add546139a21bed6) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
16:33:00.0534 2884        ePowerSvc - ok
16:33:00.0654 2884        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
16:33:00.0701 2884        ErrDev - ok
16:33:00.0762 2884        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
16:33:00.0861 2884        EventSystem - ok
16:33:00.0951 2884        ewusbnet        (251af86e0a4ddf3a6b181ed5103b06b1) C:\Windows\system32\DRIVERS\ewusbnet.sys
16:33:01.0042 2884        ewusbnet - ok
16:33:01.0082 2884        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
16:33:01.0146 2884        exfat - ok
16:33:01.0503 2884        F-Secure Gatekeeper (c898cf54315e594c33f915b053e2ec2b) C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys
16:33:01.0537 2884        F-Secure Gatekeeper - ok
16:33:01.0866 2884        F-Secure Gatekeeper Handler Starter (abf1bd70c5c182ad8ffea8e8e8253846) C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\fsgk32st.exe
16:33:01.0898 2884        F-Secure Gatekeeper Handler Starter - ok
16:33:02.0155 2884        F-Secure HIPS  (40ac3b8a6b385e05ee011049a8bb64fd) C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\HIPS\drivers\fshs.sys
16:33:02.0184 2884        F-Secure HIPS - ok
16:33:02.0281 2884        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
16:33:02.0364 2884        fastfat - ok
16:33:02.0459 2884        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
16:33:02.0520 2884        Fax - ok
16:33:02.0634 2884        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
16:33:02.0687 2884        fdc - ok
16:33:02.0736 2884        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
16:33:02.0826 2884        fdPHost - ok
16:33:02.0849 2884        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
16:33:02.0934 2884        FDResPub - ok
16:33:02.0986 2884        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
16:33:03.0014 2884        FileInfo - ok
16:33:03.0035 2884        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
16:33:03.0114 2884        Filetrace - ok
16:33:03.0155 2884        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
16:33:03.0207 2884        flpydisk - ok
16:33:03.0277 2884        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
16:33:03.0306 2884        FltMgr - ok
16:33:03.0362 2884        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
16:33:03.0464 2884        FontCache - ok
16:33:03.0546 2884        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:33:03.0572 2884        FontCache3.0.0.0 - ok
16:33:03.0766 2884        fsccsys1331654251 (4ab32767bb7ccd6fd67452f906e93955) C:\Windows\System32\drivers\fsccsys.sys
16:33:03.0786 2884        fsccsys1331654251 - ok
16:33:03.0838 2884        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
16:33:03.0861 2884        FsDepends - ok
16:33:04.0148 2884        FSDFWD          (778d74f5e8deb3b3f82acec9a0656fdb) C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\FWES\Program\fsdfwd.exe
16:33:04.0226 2884        FSDFWD - ok
16:33:04.0342 2884        FSES            (669cfcb1996e06b562f438ff051ec82e) C:\Windows\system32\drivers\fses.sys
16:33:04.0370 2884        FSES - ok
16:33:04.0456 2884        FSFW            (bb636a0ba1f077861aee5494fa06c32c) C:\Windows\system32\drivers\fsdfw.sys
16:33:04.0477 2884        FSFW - ok
16:33:04.0708 2884        fshoster        (42d816de816eeef5a739e780145b38bf) C:\Program Files (x86)\F-Secure\fshoster32.exe
16:33:04.0743 2884        fshoster - ok
16:33:04.0894 2884        FSMA            (f46abb441ee8b700821c479fae5877e6) C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Common\FSMA32.EXE
16:33:04.0916 2884        FSMA - ok
16:33:05.0129 2884        FSORSPClient    (86d7a8ecdc94a0a798eee2323f77a427) C:\Program Files (x86)\F-Secure\apps\CCF_Reputation\fsorsp.exe
16:33:05.0157 2884        FSORSPClient - ok
16:33:05.0302 2884        fsvista        (6bb0b8462c295af79872af82341142fd) C:\Program Files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys
16:33:05.0319 2884        fsvista - ok
16:33:05.0406 2884        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
16:33:05.0436 2884        Fs_Rec - ok
16:33:05.0500 2884        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
16:33:05.0534 2884        fvevol - ok
16:33:05.0574 2884        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
16:33:05.0625 2884        gagp30kx - ok
16:33:05.0690 2884        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
16:33:05.0801 2884        gpsvc - ok
16:33:05.0893 2884        Greg_Service    (816fd5a6f3c2f3d600900096632fc60e) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
16:33:05.0963 2884        Greg_Service - ok
16:33:06.0089 2884        hamachi        (1e6438d4ea6e1174a3b3b1edc4de660b) C:\Windows\system32\DRIVERS\hamachi.sys
16:33:06.0115 2884        hamachi - ok
16:33:06.0195 2884        Hamachi2Svc - ok
16:33:06.0274 2884        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
16:33:06.0316 2884        hcw85cir - ok
16:33:06.0391 2884        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
16:33:06.0427 2884        HdAudAddService - ok
16:33:06.0474 2884        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
16:33:06.0516 2884        HDAudBus - ok
16:33:06.0558 2884        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
16:33:06.0582 2884        HidBatt - ok
16:33:06.0658 2884        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
16:33:06.0723 2884        HidBth - ok
16:33:06.0737 2884        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
16:33:06.0783 2884        HidIr - ok
16:33:06.0817 2884        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
16:33:06.0896 2884        hidserv - ok
16:33:06.0962 2884        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
16:33:07.0000 2884        HidUsb - ok
16:33:07.0052 2884        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
16:33:07.0112 2884        hkmsvc - ok
16:33:07.0158 2884        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
16:33:07.0202 2884        HomeGroupListener - ok
16:33:07.0243 2884        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
16:33:07.0301 2884        HomeGroupProvider - ok
16:33:07.0446 2884        hpqcxs08        (1dae5c46d42b02a6d5862e1482efb390) D:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll
16:33:07.0478 2884        hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
16:33:07.0478 2884        hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
16:33:07.0520 2884        hpqddsvc        (99e8eef42fe2f4af29b08c3355dd7685) D:\Programme\HP\Digital Imaging\bin\hpqddsvc.dll
16:33:07.0541 2884        hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
16:33:07.0541 2884        hpqddsvc - detected UnsignedFile.Multi.Generic (1)
16:33:07.0717 2884        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
16:33:07.0748 2884        HpSAMD - ok
16:33:07.0841 2884        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
16:33:07.0971 2884        HTTP - ok
16:33:08.0020 2884        hwdatacard      (4b5c07db91a0099272faae732e1152bd) C:\Windows\system32\DRIVERS\ewusbmdm.sys
16:33:08.0060 2884        hwdatacard - ok
16:33:08.0099 2884        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
16:33:08.0118 2884        hwpolicy - ok
16:33:08.0175 2884        hwusbfake      (9c13a2691ac410cc7469f298684dca5d) C:\Windows\system32\DRIVERS\ewusbfake.sys
16:33:08.0211 2884        hwusbfake - ok
16:33:08.0252 2884        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
16:33:08.0276 2884        i8042prt - ok
16:33:08.0368 2884        IAANTMON        (660bf3255a1eb18ed803fd2fba6ae400) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
16:33:08.0405 2884        IAANTMON - ok
16:33:08.0524 2884        iaStor          (be7d72fcf442c26975942007e0831241) C:\Windows\system32\DRIVERS\iaStor.sys
16:33:08.0550 2884        iaStor - ok
16:33:08.0640 2884        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
16:33:08.0700 2884        iaStorV - ok
16:33:08.0811 2884        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:33:08.0884 2884        idsvc - ok
16:33:09.0267 2884        igfx            (c6238c6abd6ac99f5d152da4e9439a3d) C:\Windows\system32\DRIVERS\igdkmd64.sys
16:33:09.0706 2884        igfx - ok
16:33:09.0847 2884        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
16:33:09.0868 2884        iirsp - ok
16:33:09.0950 2884        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
16:33:10.0071 2884        IKEEXT - ok
16:33:10.0160 2884        int15.sys      (8c7fa71cb1ebcd3ede8958d27b1bf0b4) C:\Windows\System32\OEM\Factory\int15.sys
16:33:10.0180 2884        int15.sys - ok
16:33:10.0283 2884        IntcAzAudAddService (e200f72882c1e4e45fa2c4b66f19f7fb) C:\Windows\system32\drivers\RTKVHD64.sys
16:33:10.0394 2884        IntcAzAudAddService - ok
16:33:10.0441 2884        IntcHdmiAddService (88a20fa54c73ded4e8dac764e9130ae9) C:\Windows\system32\drivers\IntcHdmi.sys
16:33:10.0493 2884        IntcHdmiAddService - ok
16:33:10.0522 2884        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
16:33:10.0543 2884        intelide - ok
16:33:10.0580 2884        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
16:33:10.0657 2884        intelppm - ok
16:33:10.0714 2884        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
16:33:10.0791 2884        IPBusEnum - ok
16:33:10.0919 2884        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:33:11.0011 2884        IpFilterDriver - ok
16:33:11.0067 2884        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
16:33:11.0161 2884        iphlpsvc - ok
16:33:11.0203 2884        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
16:33:11.0226 2884        IPMIDRV - ok
16:33:11.0257 2884        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
16:33:11.0341 2884        IPNAT - ok
16:33:11.0379 2884        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
16:33:11.0448 2884        IRENUM - ok
16:33:11.0479 2884        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
16:33:11.0500 2884        isapnp - ok
16:33:11.0542 2884        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
16:33:11.0571 2884        iScsiPrt - ok
16:33:11.0671 2884        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
16:33:11.0705 2884        kbdclass - ok
16:33:11.0747 2884        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
16:33:11.0790 2884        kbdhid - ok
16:33:11.0822 2884        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:33:11.0844 2884        KeyIso - ok
16:33:11.0873 2884        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
16:33:11.0896 2884        KSecDD - ok
16:33:11.0917 2884        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
16:33:11.0941 2884        KSecPkg - ok
16:33:11.0983 2884        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
16:33:12.0061 2884        ksthunk - ok
16:33:12.0106 2884        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
16:33:12.0191 2884        KtmRm - ok
16:33:12.0245 2884        L1C            (b4a3a05b0f9c81d098b96ab6aa915042) C:\Windows\system32\DRIVERS\L1C62x64.sys
16:33:12.0299 2884        L1C - ok
16:33:12.0373 2884        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
16:33:12.0456 2884        LanmanServer - ok
16:33:12.0518 2884        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
16:33:12.0595 2884        LanmanWorkstation - ok
16:33:12.0674 2884        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
16:33:12.0760 2884        lltdio - ok
16:33:12.0803 2884        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
16:33:12.0899 2884        lltdsvc - ok
16:33:12.0931 2884        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
16:33:12.0992 2884        lmhosts - ok
16:33:13.0049 2884        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
16:33:13.0073 2884        LSI_FC - ok
16:33:13.0096 2884        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
16:33:13.0119 2884        LSI_SAS - ok
16:33:13.0135 2884        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:33:13.0157 2884        LSI_SAS2 - ok
16:33:13.0170 2884        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:33:13.0194 2884        LSI_SCSI - ok
16:33:13.0228 2884        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
16:33:13.0307 2884        luafv - ok
16:33:13.0357 2884        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
16:33:13.0397 2884        Mcx2Svc - ok
16:33:13.0429 2884        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
16:33:13.0451 2884        megasas - ok
16:33:13.0471 2884        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
16:33:13.0499 2884        MegaSR - ok
16:33:13.0535 2884        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
16:33:13.0614 2884        MMCSS - ok
16:33:13.0644 2884        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
16:33:13.0706 2884        Modem - ok
16:33:13.0743 2884        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
16:33:13.0783 2884        monitor - ok
16:33:13.0836 2884        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
16:33:13.0857 2884        mouclass - ok
16:33:13.0894 2884        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
16:33:13.0932 2884        mouhid - ok
16:33:13.0977 2884        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
16:33:14.0001 2884        mountmgr - ok
16:33:14.0040 2884        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
16:33:14.0066 2884        mpio - ok
16:33:14.0105 2884        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
16:33:14.0166 2884        mpsdrv - ok
16:33:14.0230 2884        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
16:33:14.0339 2884        MpsSvc - ok
16:33:14.0387 2884        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
16:33:14.0419 2884        MRxDAV - ok
16:33:14.0460 2884        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
16:33:14.0500 2884        mrxsmb - ok
16:33:14.0544 2884        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:33:14.0593 2884        mrxsmb10 - ok
16:33:14.0646 2884        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:33:14.0670 2884        mrxsmb20 - ok
16:33:14.0711 2884        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
16:33:14.0733 2884        msahci - ok
16:33:14.0771 2884        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
16:33:14.0797 2884        msdsm - ok
16:33:14.0841 2884        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
16:33:14.0943 2884        MSDTC - ok
16:33:15.0006 2884        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
16:33:15.0066 2884        Msfs - ok
16:33:15.0083 2884        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
16:33:15.0142 2884        mshidkmdf - ok
16:33:15.0177 2884        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
16:33:15.0198 2884        msisadrv - ok
16:33:15.0240 2884        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
16:33:15.0318 2884        MSiSCSI - ok
16:33:15.0327 2884        msiserver - ok
16:33:15.0387 2884        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
16:33:15.0458 2884        MSKSSRV - ok
16:33:15.0481 2884        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
16:33:15.0563 2884        MSPCLOCK - ok
16:33:15.0608 2884        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
16:33:15.0692 2884        MSPQM - ok
16:33:15.0747 2884        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
16:33:15.0779 2884        MsRPC - ok
16:33:15.0818 2884        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
16:33:15.0840 2884        mssmbios - ok
16:33:15.0867 2884        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
16:33:15.0942 2884        MSTEE - ok
16:33:15.0973 2884        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
16:33:16.0013 2884        MTConfig - ok
16:33:16.0049 2884        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
16:33:16.0072 2884        Mup - ok
16:33:16.0125 2884        mwlPSDFilter    (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
16:33:16.0146 2884        mwlPSDFilter - ok
16:33:16.0170 2884        mwlPSDNServ    (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
16:33:16.0186 2884        mwlPSDNServ - ok
16:33:16.0199 2884        mwlPSDVDisk    (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
16:33:16.0216 2884        mwlPSDVDisk - ok
16:33:16.0325 2884        MWLService      (2f139207f618ec2933830227eeffddb4) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe
16:33:16.0356 2884        MWLService - ok
16:33:16.0419 2884        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
16:33:16.0518 2884        napagent - ok
16:33:16.0636 2884        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
16:33:16.0712 2884        NativeWifiP - ok
16:33:16.0803 2884        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
16:33:16.0880 2884        NDIS - ok
16:33:16.0906 2884        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
16:33:16.0965 2884        NdisCap - ok
16:33:17.0023 2884        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
16:33:17.0104 2884        NdisTapi - ok
16:33:17.0150 2884        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
16:33:17.0222 2884        Ndisuio - ok
16:33:17.0269 2884        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
16:33:17.0344 2884        NdisWan - ok
16:33:17.0409 2884        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
16:33:17.0486 2884        NDProxy - ok
16:33:17.0538 2884        Net Driver HPZ12 (2334dc48997ba203b794df3ee70521db) C:\Windows\system32\HPZinw12.dll
16:33:17.0574 2884        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
16:33:17.0574 2884        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
16:33:17.0655 2884        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
16:33:17.0742 2884        NetBIOS - ok
16:33:17.0793 2884        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
16:33:17.0877 2884        NetBT - ok
16:33:17.0914 2884        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:33:17.0937 2884        Netlogon - ok
16:33:17.0990 2884        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
16:33:18.0109 2884        Netman - ok
16:33:18.0138 2884        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
16:33:18.0230 2884        netprofm - ok
16:33:18.0314 2884        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:33:18.0334 2884        NetTcpPortSharing - ok
16:33:18.0609 2884        NETw5s64        (4d85a450edef10c38882182753a49aae) C:\Windows\system32\DRIVERS\NETw5s64.sys
16:33:19.0000 2884        NETw5s64 - ok
16:33:19.0252 2884        netw5v64        (bc9a55a6deef3f9a328e3cb2b31aafd3) C:\Windows\system32\DRIVERS\netw5v64.sys
16:33:19.0506 2884        netw5v64 - ok
16:33:19.0640 2884        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
16:33:19.0674 2884        nfrd960 - ok
16:33:19.0767 2884        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
16:33:19.0892 2884        NlaSvc - ok
16:33:19.0914 2884        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
16:33:19.0976 2884        Npfs - ok
16:33:20.0002 2884        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
16:33:20.0076 2884        nsi - ok
16:33:20.0098 2884        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
16:33:20.0178 2884        nsiproxy - ok
16:33:20.0288 2884        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
16:33:20.0395 2884        Ntfs - ok
16:33:20.0473 2884        NTI IScheduleSvc (14e66f603fb187713aeb02ad3b0390cf) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
16:33:20.0499 2884        NTI IScheduleSvc - ok
16:33:20.0582 2884        NTIDrvr        (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
16:33:20.0606 2884        NTIDrvr - ok
16:33:20.0642 2884        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
16:33:20.0723 2884        Null - ok
16:33:20.0771 2884        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
16:33:20.0796 2884        nvraid - ok
16:33:20.0827 2884        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
16:33:20.0853 2884        nvstor - ok
16:33:20.0880 2884        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
16:33:20.0910 2884        nv_agp - ok
16:33:21.0054 2884        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
16:33:21.0081 2884        odserv - ok
16:33:21.0172 2884        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
16:33:21.0214 2884        ohci1394 - ok
16:33:21.0335 2884        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:33:21.0355 2884        ose - ok
16:33:21.0461 2884        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
16:33:21.0523 2884        p2pimsvc - ok
16:33:21.0569 2884        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
16:33:21.0641 2884        p2psvc - ok
16:33:21.0684 2884        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
16:33:21.0708 2884        Parport - ok
16:33:21.0764 2884        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
16:33:21.0787 2884        partmgr - ok
16:33:21.0809 2884        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
16:33:21.0859 2884        PcaSvc - ok
16:33:21.0916 2884        pccsmcfd        (bc0018c2d29f655188a0ed3fa94fdb24) C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
16:33:21.0950 2884        pccsmcfd - ok
16:33:21.0992 2884        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
16:33:22.0019 2884        pci - ok
16:33:22.0044 2884        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
16:33:22.0065 2884        pciide - ok
16:33:22.0100 2884        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
16:33:22.0128 2884        pcmcia - ok
16:33:22.0153 2884        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
16:33:22.0174 2884        pcw - ok
16:33:22.0204 2884        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
16:33:22.0307 2884        PEAUTH - ok
16:33:22.0385 2884        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
16:33:22.0428 2884        PerfHost - ok
16:33:22.0569 2884        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
16:33:22.0757 2884        pla - ok
16:33:22.0807 2884        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
16:33:22.0850 2884        PlugPlay - ok
16:33:22.0916 2884        Pml Driver HPZ12 (ac78df349f0e4cfb8b667c0cfff83cce) C:\Windows\system32\HPZipm12.dll
16:33:22.0937 2884        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
16:33:22.0937 2884        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
16:33:22.0976 2884        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
16:33:23.0017 2884        PNRPAutoReg - ok
16:33:23.0051 2884        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
16:33:23.0079 2884        PNRPsvc - ok
16:33:23.0145 2884        Point64        (b8d8ec78b0f9ed8e220506181274f3d3) C:\Windows\system32\DRIVERS\point64.sys
16:33:23.0167 2884        Point64 - ok
16:33:23.0230 2884        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
16:33:23.0326 2884        PolicyAgent - ok
16:33:23.0364 2884        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
16:33:23.0455 2884        Power - ok
16:33:23.0540 2884        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
16:33:23.0618 2884        PptpMiniport - ok
16:33:23.0675 2884        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
16:33:23.0715 2884        Processor - ok
16:33:23.0781 2884        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
16:33:23.0880 2884        ProfSvc - ok
16:33:23.0918 2884        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:33:23.0940 2884        ProtectedStorage - ok
16:33:24.0021 2884        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
16:33:24.0096 2884        Psched - ok
16:33:24.0163 2884        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
16:33:24.0253 2884        ql2300 - ok
16:33:24.0266 2884        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
16:33:24.0290 2884        ql40xx - ok
16:33:24.0326 2884        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
16:33:24.0379 2884        QWAVE - ok
16:33:24.0411 2884        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
16:33:24.0439 2884        QWAVEdrv - ok
16:33:24.0450 2884        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
16:33:24.0529 2884        RasAcd - ok
16:33:24.0580 2884        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
16:33:24.0640 2884        RasAgileVpn - ok
16:33:24.0715 2884        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
16:33:24.0785 2884        RasAuto - ok
16:33:24.0844 2884        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
16:33:24.0941 2884        Rasl2tp - ok
16:33:25.0013 2884        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
16:33:25.0098 2884        RasMan - ok
16:33:25.0140 2884        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
16:33:25.0215 2884        RasPppoe - ok
16:33:25.0245 2884        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
16:33:25.0326 2884        RasSstp - ok
16:33:25.0380 2884        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
16:33:25.0460 2884        rdbss - ok
16:33:25.0489 2884        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
16:33:25.0532 2884        rdpbus - ok
16:33:25.0560 2884        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
16:33:25.0639 2884        RDPCDD - ok
16:33:25.0684 2884        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
16:33:25.0758 2884        RDPENCDD - ok
16:33:25.0779 2884        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
16:33:25.0837 2884        RDPREFMP - ok
16:33:25.0886 2884        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
16:33:25.0926 2884        RDPWD - ok
16:33:25.0992 2884        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
16:33:26.0049 2884        rdyboost - ok
16:33:26.0078 2884        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
16:33:26.0158 2884        RemoteAccess - ok
16:33:26.0186 2884        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
16:33:26.0268 2884        RemoteRegistry - ok
16:33:26.0338 2884        RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
16:33:26.0400 2884        RFCOMM - ok
16:33:26.0441 2884        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
16:33:26.0504 2884        RpcEptMapper - ok
16:33:26.0538 2884        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
16:33:26.0580 2884        RpcLocator - ok
16:33:26.0660 2884        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
16:33:26.0729 2884        RpcSs - ok
16:33:26.0774 2884        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
16:33:26.0849 2884        rspndr - ok
16:33:26.0909 2884        S6000KNT        (23b29b8ca68e9d21a70b7ff253d1e179) C:\Windows\system32\Drivers\S6000KNT.sys
16:33:26.0931 2884        S6000KNT - ok
16:33:26.0954 2884        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:33:26.0975 2884        SamSs - ok
16:33:27.0005 2884        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
16:33:27.0029 2884        sbp2port - ok
16:33:27.0065 2884        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
16:33:27.0132 2884        SCardSvr - ok
16:33:27.0194 2884        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
16:33:27.0270 2884        scfilter - ok
16:33:27.0340 2884        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
16:33:27.0476 2884        Schedule - ok
16:33:27.0517 2884        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
16:33:27.0573 2884        SCPolicySvc - ok
16:33:27.0665 2884        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
16:33:27.0736 2884        SDRSVC - ok
16:33:27.0800 2884        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
16:33:27.0863 2884        secdrv - ok
16:33:27.0935 2884        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
16:33:28.0016 2884        seclogon - ok
16:33:28.0063 2884        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
16:33:28.0126 2884        SENS - ok
16:33:28.0161 2884        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
16:33:28.0204 2884        SensrSvc - ok
16:33:28.0271 2884        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
16:33:28.0299 2884        Serenum - ok
16:33:28.0329 2884        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
16:33:28.0364 2884        Serial - ok
16:33:28.0401 2884        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
16:33:28.0442 2884        sermouse - ok
16:33:28.0498 2884        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
16:33:28.0578 2884        SessionEnv - ok
16:33:28.0667 2884        sfdrv01        (a48b9f81d3c2ba989ae2d566747b4623) C:\Windows\system32\drivers\sfdrv01.sys
16:33:28.0696 2884        sfdrv01 ( UnsignedFile.Multi.Generic ) - warning
16:33:28.0697 2884        sfdrv01 - detected UnsignedFile.Multi.Generic (1)
16:33:28.0745 2884        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
16:33:28.0804 2884        sffdisk - ok
16:33:28.0832 2884        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
16:33:28.0919 2884        sffp_mmc - ok
16:33:28.0947 2884        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
16:33:28.0984 2884        sffp_sd - ok
16:33:29.0037 2884        sfhlp02        (9e0ecda6c72c5d0d8cf3f0fba076422b) C:\Windows\system32\drivers\sfhlp02.sys
16:33:29.0055 2884        sfhlp02 ( UnsignedFile.Multi.Generic ) - warning
16:33:29.0055 2884        sfhlp02 - detected UnsignedFile.Multi.Generic (1)
16:33:29.0100 2884        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
16:33:29.0163 2884        sfloppy - ok
16:33:29.0195 2884        sfvfs02        (f65d13175ebf3fa49b1f7f948926a16e) C:\Windows\system32\drivers\sfvfs02.sys
16:33:29.0203 2884        sfvfs02 ( UnsignedFile.Multi.Generic ) - warning
16:33:29.0203 2884        sfvfs02 - detected UnsignedFile.Multi.Generic (1)
16:33:29.0253 2884        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
16:33:29.0344 2884        SharedAccess - ok
16:33:29.0390 2884        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
16:33:29.0474 2884        ShellHWDetection - ok
16:33:29.0546 2884        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:33:29.0570 2884        SiSRaid2 - ok
16:33:29.0605 2884        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
16:33:29.0628 2884        SiSRaid4 - ok
16:33:29.0738 2884        SkypeUpdate    (6128e98eaaed364ed1a32708d2fd22cb) D:\Programme\Skype\Updater\Updater.exe
16:33:29.0767 2884        SkypeUpdate - ok
16:33:29.0780 2884        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
16:33:29.0841 2884        Smb - ok
16:33:29.0914 2884        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
16:33:29.0958 2884        SNMPTRAP - ok
16:33:29.0987 2884        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
16:33:30.0007 2884        spldr - ok
16:33:30.0071 2884        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
16:33:30.0155 2884        Spooler - ok
16:33:30.0304 2884        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
16:33:30.0512 2884        sppsvc - ok
16:33:30.0552 2884        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
16:33:30.0631 2884        sppuinotify - ok
16:33:30.0686 2884        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
16:33:30.0769 2884        srv - ok
16:33:30.0815 2884        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
16:33:30.0868 2884        srv2 - ok
16:33:30.0903 2884        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
16:33:30.0949 2884        srvnet - ok
16:33:31.0018 2884        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
16:33:31.0134 2884        SSDPSRV - ok
16:33:31.0164 2884        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
16:33:31.0227 2884        SstpSvc - ok
16:33:31.0265 2884        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
16:33:31.0287 2884        stexstor - ok
16:33:31.0361 2884        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
16:33:31.0446 2884        stisvc - ok
16:33:31.0489 2884        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
16:33:31.0510 2884        swenum - ok
16:33:31.0583 2884        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
16:33:31.0680 2884        swprv - ok
16:33:31.0741 2884        SynTP          (ed6d1424e5b0c21a57b28dd8508d6843) C:\Windows\system32\DRIVERS\SynTP.sys
16:33:31.0766 2884        SynTP - ok
16:33:31.0861 2884        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
16:33:31.0990 2884        SysMain - ok
16:33:32.0054 2884        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
16:33:32.0109 2884        TabletInputService - ok
16:33:32.0206 2884        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
16:33:32.0316 2884        TapiSrv - ok
16:33:32.0348 2884        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
16:33:32.0409 2884        TBS - ok
16:33:32.0505 2884        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
16:33:32.0625 2884        Tcpip - ok
16:33:32.0684 2884        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
16:33:32.0749 2884        TCPIP6 - ok
16:33:32.0801 2884        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
16:33:32.0872 2884        tcpipreg - ok
16:33:32.0919 2884        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
16:33:32.0940 2884        TDPIPE - ok
16:33:32.0977 2884        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
16:33:33.0019 2884        TDTCP - ok
16:33:33.0104 2884        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
16:33:33.0188 2884        tdx - ok
16:33:33.0227 2884        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
16:33:33.0249 2884        TermDD - ok
16:33:33.0281 2884        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
16:33:33.0363 2884        TermService - ok
16:33:33.0425 2884        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
16:33:33.0478 2884        Themes - ok
16:33:33.0515 2884        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
16:33:33.0576 2884        THREADORDER - ok
16:33:33.0644 2884        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
16:33:33.0732 2884        TrkWks - ok
16:33:33.0801 2884        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
16:33:33.0880 2884        TrustedInstaller - ok
16:33:33.0958 2884        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
16:33:34.0028 2884        tssecsrv - ok
16:33:34.0095 2884        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
16:33:34.0133 2884        TsUsbFlt - ok
16:33:34.0218 2884        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
16:33:34.0307 2884        tunnel - ok
16:33:34.0353 2884        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
16:33:34.0377 2884        uagp35 - ok
16:33:34.0400 2884        UBHelper        (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
16:33:34.0415 2884        UBHelper - ok
16:33:34.0486 2884        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
16:33:34.0573 2884        udfs - ok
16:33:34.0642 2884        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
16:33:34.0682 2884        UI0Detect - ok
16:33:34.0716 2884        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
16:33:34.0739 2884        uliagpkx - ok
16:33:34.0778 2884        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
16:33:34.0819 2884        umbus - ok
16:33:34.0856 2884        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
16:33:34.0893 2884        UmPass - ok
16:33:34.0974 2884        Updater Service (70dde3a86dbeb1d6c3c30ad687b1877a) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
16:33:35.0009 2884        Updater Service - ok
16:33:35.0054 2884        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
16:33:35.0142 2884        upnphost - ok
16:33:35.0198 2884        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
16:33:35.0246 2884        usbccgp - ok
16:33:35.0295 2884        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
16:33:35.0324 2884        usbcir - ok
16:33:35.0343 2884        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
16:33:35.0398 2884        usbehci - ok
16:33:35.0435 2884        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
16:33:35.0478 2884        usbhub - ok
16:33:35.0511 2884        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
16:33:35.0572 2884        usbohci - ok
16:33:35.0675 2884        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
16:33:35.0734 2884        usbprint - ok
16:33:35.0776 2884        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
16:33:35.0803 2884        usbscan - ok
16:33:35.0845 2884        usbser          (4acee387fa8fd39f83564fcd2fc234f2) C:\Windows\system32\drivers\usbser.sys
16:33:35.0884 2884        usbser - ok
16:33:35.0925 2884        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:33:35.0963 2884        USBSTOR - ok
16:33:36.0001 2884        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
16:33:36.0035 2884        usbuhci - ok
16:33:36.0091 2884        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
16:33:36.0122 2884        usbvideo - ok
16:33:36.0155 2884        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
16:33:36.0234 2884        UxSms - ok
16:33:36.0271 2884        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
16:33:36.0291 2884        VaultSvc - ok
16:33:36.0333 2884        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
16:33:36.0353 2884        vdrvroot - ok
16:33:36.0414 2884        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
16:33:36.0497 2884        vds - ok
16:33:36.0532 2884        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
16:33:36.0557 2884        vga - ok
16:33:36.0577 2884        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
16:33:36.0674 2884        VgaSave - ok
16:33:36.0713 2884        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
16:33:36.0738 2884        vhdmp - ok
16:33:36.0778 2884        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
16:33:36.0800 2884        viaide - ok
16:33:36.0829 2884        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
16:33:36.0851 2884        volmgr - ok
16:33:36.0902 2884        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
16:33:36.0934 2884        volmgrx - ok
16:33:36.0966 2884        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
16:33:36.0997 2884        volsnap - ok
16:33:37.0048 2884        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
16:33:37.0075 2884        vsmraid - ok
16:33:37.0171 2884        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
16:33:37.0313 2884        VSS - ok
16:33:37.0338 2884        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
16:33:37.0386 2884        vwifibus - ok
16:33:37.0430 2884        VWiFiFlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
16:33:37.0459 2884        VWiFiFlt - ok
16:33:37.0493 2884        vwifimp        (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
16:33:37.0522 2884        vwifimp - ok
16:33:37.0599 2884        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
16:33:37.0669 2884        W32Time - ok
16:33:37.0687 2884        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
16:33:37.0729 2884        WacomPen - ok
16:33:37.0792 2884        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:33:37.0864 2884        WANARP - ok
16:33:37.0871 2884        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
16:33:37.0929 2884        Wanarpv6 - ok
16:33:37.0999 2884        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
16:33:38.0084 2884        WatAdminSvc - ok
16:33:38.0174 2884        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
16:33:38.0259 2884        wbengine - ok
16:33:38.0297 2884        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
16:33:38.0335 2884        WbioSrvc - ok
16:33:38.0392 2884        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
16:33:38.0442 2884        wcncsvc - ok
16:33:38.0468 2884        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
16:33:38.0507 2884        WcsPlugInService - ok
16:33:38.0566 2884        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
16:33:38.0594 2884        Wd - ok
16:33:38.0652 2884        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
16:33:38.0702 2884        Wdf01000 - ok
16:33:38.0719 2884        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
16:33:38.0841 2884        WdiServiceHost - ok
16:33:38.0851 2884        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
16:33:38.0883 2884        WdiSystemHost - ok
16:33:38.0929 2884        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
16:33:38.0987 2884        WebClient - ok
16:33:39.0022 2884        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
16:33:39.0108 2884        Wecsvc - ok
16:33:39.0138 2884        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
16:33:39.0218 2884        wercplsupport - ok
16:33:39.0257 2884        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
16:33:39.0336 2884        WerSvc - ok
16:33:39.0394 2884        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
16:33:39.0462 2884        WfpLwf - ok
16:33:39.0533 2884        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
16:33:39.0558 2884        WIMMount - ok
16:33:39.0668 2884        WinDefend - ok
16:33:39.0686 2884        WinHttpAutoProxySvc - ok
16:33:39.0748 2884        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
16:33:39.0838 2884        Winmgmt - ok
16:33:39.0928 2884        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
16:33:40.0103 2884        WinRM - ok
16:33:40.0220 2884        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
16:33:40.0280 2884        WinUsb - ok
16:33:40.0339 2884        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
16:33:40.0434 2884        Wlansvc - ok
16:33:40.0629 2884        wlidsvc        (2bacd71123f42cea603f4e205e1ae337) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
16:33:40.0773 2884        wlidsvc - ok
16:33:40.0861 2884        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
16:33:40.0912 2884        WmiAcpi - ok
16:33:40.0987 2884        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
16:33:41.0014 2884        wmiApSrv - ok
16:33:41.0076 2884        WMPNetworkSvc - ok
16:33:41.0115 2884        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
16:33:41.0138 2884        WPCSvc - ok
16:33:41.0198 2884        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
16:33:41.0227 2884        WPDBusEnum - ok
16:33:41.0282 2884        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
16:33:41.0343 2884        ws2ifsl - ok
16:33:41.0368 2884        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
16:33:41.0424 2884        wscsvc - ok
16:33:41.0465 2884        WSDPrintDevice  (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys
16:33:41.0514 2884        WSDPrintDevice - ok
16:33:41.0528 2884        WSearch - ok
16:33:41.0646 2884        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
16:33:41.0828 2884        wuauserv - ok
16:33:41.0891 2884        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
16:33:41.0974 2884        WudfPf - ok
16:33:42.0018 2884        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
16:33:42.0102 2884        WUDFRd - ok
16:33:42.0154 2884        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
16:33:42.0216 2884        wudfsvc - ok
16:33:42.0246 2884        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
16:33:42.0305 2884        WwanSvc - ok
16:33:42.0379 2884        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
16:33:42.0635 2884        \Device\Harddisk0\DR0 - ok
16:33:42.0645 2884        Boot (0x1200)  (c63f64a8b150df958a8d2d720ca3ead0) \Device\Harddisk0\DR0\Partition0
16:33:42.0647 2884        \Device\Harddisk0\DR0\Partition0 - ok
16:33:42.0675 2884        Boot (0x1200)  (9383cddef1eba5c38d3955fd0e88351e) \Device\Harddisk0\DR0\Partition1
16:33:42.0677 2884        \Device\Harddisk0\DR0\Partition1 - ok
16:33:42.0699 2884        Boot (0x1200)  (032147b4facc522059f87ef8049f90c5) \Device\Harddisk0\DR0\Partition2
16:33:42.0701 2884        \Device\Harddisk0\DR0\Partition2 - ok
16:33:42.0701 2884        ============================================================
16:33:42.0701 2884        Scan finished
16:33:42.0701 2884        ============================================================
16:33:42.0870 5004        Detected object count: 7
16:33:42.0870 5004        Actual detected object count: 7
16:34:10.0121 5004        hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:10.0121 5004        hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:10.0122 5004        hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:10.0122 5004        hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:10.0125 5004        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:10.0126 5004        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:10.0128 5004        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:10.0128 5004        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:10.0131 5004        sfdrv01 ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:10.0131 5004        sfdrv01 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:10.0133 5004        sfhlp02 ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:10.0133 5004        sfhlp02 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:34:10.0136 5004        sfvfs02 ( UnsignedFile.Multi.Generic ) - skipped by user
16:34:10.0136 5004        sfvfs02 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 16.04.2012 15:57
Nö, das ist ok

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

kwongk 16.04.2012 16:31
Hier der ComboFix.txt

Code:
ComboFix 12-04-16.01 - *** 16.04.2012  17:13:40.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3999.1517 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: Computer Security *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: Computer Security *Disabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: Computer Security *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-16 bis 2012-04-16  ))))))))))))))))))))))))))))))
.
.
2012-04-16 13:21 . 2012-04-16 13:21        --------        d-----w-        C:\_OTL
2012-04-14 17:39 . 2012-04-16 14:24        --------        d-----w-        c:\users\***\AppData\Roaming\\.minecraft
2012-04-14 17:39 . 2012-04-16 14:24        --------        d-----w-        c:\users\***\AppData\Roaming\.minecraft
2012-04-14 13:32 . 2012-03-14 03:27        8669240        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{B7540078-2D14-46C1-9762-2FE76EEC8413}\mpengine.dll
2012-04-13 15:23 . 2012-04-13 15:23        --------        d-----w-        c:\program files (x86)\ESET
2012-04-13 14:07 . 2012-04-13 14:07        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes
2012-04-13 14:07 . 2012-04-13 14:07        --------        d-----w-        c:\users\***\AppData\Roaming\\Malwarebytes
2012-04-13 14:07 . 2012-04-13 14:07        --------        d-----w-        c:\programdata\Malwarebytes
2012-04-13 14:07 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-04-12 16:33 . 2012-03-06 06:53        5559152        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-04-12 16:33 . 2012-03-06 05:59        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-04-12 16:33 . 2012-03-06 05:59        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-04-12 16:30 . 2012-03-01 06:46        23408        ----a-w-        c:\windows\system32\drivers\fs_rec.sys
2012-04-12 16:30 . 2012-03-01 06:33        81408        ----a-w-        c:\windows\system32\imagehlp.dll
2012-04-12 16:30 . 2012-03-01 05:37        172544        ----a-w-        c:\windows\SysWow64\wintrust.dll
2012-04-12 16:30 . 2012-03-01 05:33        159232        ----a-w-        c:\windows\SysWow64\imagehlp.dll
2012-04-12 16:30 . 2012-03-01 06:38        220672        ----a-w-        c:\windows\system32\wintrust.dll
2012-04-12 16:30 . 2012-03-01 06:28        5120        ----a-w-        c:\windows\system32\wmi.dll
2012-04-12 16:30 . 2012-03-01 05:29        5120        ----a-w-        c:\windows\SysWow64\wmi.dll
2012-04-10 00:37 . 2012-04-14 18:06        --------        d-----w-        c:\users\***\AppData\Roaming\gtk-2.0
2012-04-10 00:37 . 2012-04-14 18:06        --------        d-----w-        c:\users\***\AppData\Roaming\\gtk-2.0
2012-04-08 15:15 . 2012-04-08 15:15        --------        d-----w-        c:\users\***\\.thumbnails
2012-04-08 15:15 . 2012-04-08 15:15        --------        d-----w-        c:\users\***\.thumbnails
2012-03-26 18:16 . 2012-02-03 04:34        3145728        ----a-w-        c:\windows\system32\win32k.sys
2012-03-26 18:16 . 2012-02-10 06:36        1544192        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-26 18:16 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll
2012-03-26 18:16 . 2012-01-25 06:38        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-03-26 18:16 . 2012-01-25 06:38        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-03-26 18:16 . 2012-01-25 06:33        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-03-26 18:16 . 2012-02-17 06:38        1031680        ----a-w-        c:\windows\system32\rdpcore.dll
2012-03-26 18:16 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll
2012-03-26 18:16 . 2012-02-17 04:58        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-26 18:16 . 2012-02-17 04:57        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 10:39 . 2011-06-15 20:36        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-23 07:18 . 2010-05-19 22:02        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-07 09:02 . 2012-02-07 09:02        1070352        ----a-w-        c:\windows\SysWow64\MSCOMCTL.OCX
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-10-07 866824]
"F-Secure Hoster"="c:\program files (x86)\F-Secure\fshoster32.exe" [2011-12-14 160424]
"F-Secure Manager"="c:\program files (x86)\F-Secure\apps\ComputerSecurity\Common\FSM32.EXE" [2011-12-19 310936]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;d:\programme\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\F-Secure\apps\ComputerSecurity\HIPS\drivers\fshs.sys [2012-03-12 61976]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [x]
S1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [2011-12-19 13976]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 VWiFiFlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-09-30 844320]
S2 fshoster;F-Secure Dll Hoster;c:\program files (x86)\F-Secure\fshoster32.exe [2011-12-14 160424]
S2 FSORSPClient;F-Secure ORSP Client;c:\program files (x86)\F-Secure\apps\CCF_Reputation\fsorsp.exe [2011-12-12 61120]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\programme\Hamachi\hamachi-2.exe [2012-02-28 2343816]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-09-24 62720]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [2012-03-06 198808]
S3 fsccsys1331654251;F-Secure Content Control Driver;c:\windows\System32\drivers\fsccsys.sys [x]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 59059924
*Deregistered* - 59059924
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-04-09 320000]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-09-21 8115744]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-09-30 823840]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_1820pt&r=273605100516l0423z165t4573e328
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - d:\office~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\cxgae4ay.default\
FF - prefs.js: browser.startup.homepage - goggle.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\fshoster]
"ImagePath"="\"c:\program files (x86)\F-Secure\fshoster32.exe\" -hosterid:0"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\F-Secure\My Services Agent\Protected]
@Denied: ) (Everyone)
"AgentIdentifier"="f005f03d-e0bc-4bab-a27f-f40ca1ef86cf"
"AuthorizationCode"="CRHeCAtwx69ZwrnsgLVVGmZZD5z8ZyNF3dUPTMi*e4ktMMGXyurEFg"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-04-16  17:27:10
ComboFix-quarantined-files.txt  2012-04-16 15:27
.
Vor Suchlauf: 8 Verzeichnis(se), 122.874.580.992 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 122.577.526.784 Bytes frei
.
- - End Of File - - 99C85ED53121597212F41B278F20941C

cosinus 16.04.2012 19:37
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

kwongk 16.04.2012 20:05
Es ist alle gut gelaufen, keine Abstürze oder ähnliches :D. Hier der aswMBR.txt
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-16 20:50:49
-----------------------------
20:50:49.070    OS Version: Windows x64 6.1.7601 Service Pack 1
20:50:49.070    Number of processors: 2 586 0x170A
20:50:49.070    ComputerName: KWO-COMPUTER  UserName: ***
20:50:50.412    Initialize success
20:54:55.865    AVAST engine defs: 12041600
20:55:09.312    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
20:55:09.328    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
20:55:09.344    Disk 0 MBR read successfully
20:55:09.344    Disk 0 MBR scan
20:55:09.359    Disk 0 Windows 7 default MBR code
20:55:09.375    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        12288 MB offset 2048
20:55:09.406    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 25167872
20:55:09.422    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      154419 MB offset 25372672
20:55:09.437    Disk 0 Partition - 00    0F Extended LBA            138436 MB offset 341622784
20:55:09.468    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      138435 MB offset 341624832
20:55:09.546    Disk 0 scanning C:\Windows\system32\drivers
20:55:21.621    Service scanning
20:55:52.072    Modules scanning
20:55:52.088    Disk 0 trace - called modules:
20:55:52.150    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
20:55:52.150    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005792060]
20:55:52.166    3 CLASSPNP.SYS[fffff88001bad43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa8004687050]
20:55:53.772    AVAST engine scan C:\Windows
20:55:57.532    AVAST engine scan C:\Windows\system32
20:59:29.302    AVAST engine scan C:\Windows\system32\drivers
20:59:43.826    AVAST engine scan C:\Users\***
21:00:55.600    AVAST engine scan C:\ProgramData
21:02:36.957    Scan finished successfully
21:02:52.167    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"
21:02:52.176    The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt"
Seit dem alle Ordner angezeigt werden, um die infzierten Dateien hochzuladen, sind in der Partition C und D Ordner mit dem Namen §RECYCLE.BIN. Was sind das für Ordner?

cosinus 16.04.2012 20:42
Das sind versteckte Ordner, die werden dir standardmäßig nur nicht angezeigt

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

kwongk 16.04.2012 20:47
Sollte etwas gefunden werden, alle Funde löschen?

cosinus 16.04.2012 20:49
Nur bei Malwarebytes. Bei SASW bitte erstmal nichts löschen, nur Log posten

kwongk 16.04.2012 20:52
Ok, mache ich, danke für deine Mühe.

Die Anleitung auf Trojanerboard für SuperAntiSpyware scheint nicht mehr ganz aktuell, kann das sein? Ich fühl mich ein wenig Hilflos auf der Benutzeroberfläche.

So, ich hab mir die Benutzeroberfläche nochmal genauer angeguckt und alles hinbekommen. Hier sind die logs von Malwarebytes und SuperAntiSpyware:

Malwarebytes:
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.16.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
*** :: KWO-COMPUTER [Administrator]

16.04.2012 22:14:19
mbam-log-2012-04-16 (22-14-19).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 418738
Laufzeit: 1 Stunde(n), 8 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
und von SuperAntiSpyware:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/17/2012 at 01:47 AM

Application Version : 5.0.1146

Core Rules Database Version : 8464
Trace Rules Database Version: 6276

Scan type      : Complete Scan
Total Scan Time : 02:18:11

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 652
Memory threats detected  : 0
Registry items scanned    : 66112
Registry threats detected : 0
File items scanned        : 218198
File threats detected    : 8

Adware.Tracking Cookie
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CXGAE4AY.DEFAULT\COOKIES.SQLITE ]

cosinus 17.04.2012 10:40
Sieht ok aus, da wurden nur Cookies gefunden. Kannst du mit SASW löschen.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

kwongk 17.04.2012 12:01
Danke für deine Zeit, die du mir geschenkt hast. Wenn du sagst, dass alles in Ordnung ist, sollte nix mehr drauf sein oder? Eset hat damals die beiden Trojaner gefunden. Im Moment habe ich jetzt ein paar viele Scanner installiert. Sollte ich die behalten?

Eines ist mir doch noch aufgefallen. Alle angezeigten Ordner, die vorher transparent waren, also versteckt, sind jetzt nicht mehr transparent. Wieso?
Die Cokkies werden bei mir immer gelöscht, also mit CCleaner nach jedem Tag.

cosinus 17.04.2012 14:48
Zitat:
Eset hat damals die beiden Trojaner gefunden.
Entfern die mal falls noch vorhanden, ich denke das waren Überreste.

Zitat:
Eines ist mir doch noch aufgefallen. Alle angezeigten Ordner, die vorher transparent waren, also versteckt, sind jetzt nicht mehr transparent. Wieso?
http://www.trojaner-board.de/59624-a...-sichtbar.html

Versteckte Dateien ein/ausblenden ist ein uralter Hut



Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

kwongk 17.04.2012 15:04
Zitat:
Zitat von cosinus (Beitrag 815554)
Entfern die mal falls noch vorhanden, ich denke das waren Überreste.
Was entfernen? Eset hat es damals gefunden, soll ich Eset noch mal drüber laufen lassen?


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:48 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131