Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Ihr Computer wurde durch das system der automatischen Informationskontrolle gesperrt (https://www.trojaner-board.de/125208-computer-wurde-system-automatischen-informationskontrolle-gesperrt.html)

edlgrafix 05.10.2012 18:04
Ihr Computer wurde durch das system der automatischen Informationskontrolle gesperrt
 
Ich habe den Trojaner "Ihr Computer wurde durch das system der automatischen Informationskontrolle gesperrt" auf einem Computer - kann nicht mehr normal starten, aber im abgesicherten Modus schon! Was soll ich tun?

Vielen Dank!

M-K-D-B 05.10.2012 18:39
:hallo:


Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
    Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
  • Bei Anzeichen von illegaler Software wird der Support ohne Diskussion eingestellt.
  • Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
  • Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
  • Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
    Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.





Starte deinen Rechner nach dieser Anleitung im abgesicherten Modus mit Netzwerktreibern und führe die folgenden Schritte dort aus!





Schritt 1
Downloade dir bitte dds ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.
dds.com
dds.scr
dds.pif
  • Schließe alle laufenden Programme.
  • Starte DDS mit Doppelklick.
  • Es wird 2 Logfiles erstellen.
    • dds.txt
    • attach.txt
  • Speichere beide Logfiles auf deinem Desktop
  • Poste beide Logfiles hier.





Schritt 2
Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
  • Starte das Tool mit Doppelklick.
    Vista und Win7 User mit Rechtsklick "als Administrator starten".
  • Klicke nun auf den Disable Button, um die Treiber gewisser Emulatoren zu deaktivieren.
  • Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
  • Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
Sollte Defogger eine Fehlermeldung ausgeben, poste bitte die defogger_disable Log von deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung.





Schritt 3
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.






Schritt 4
Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen.

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ )
    Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.





Bitte poste mit deiner nächsten Antwort
  • die beiden Logdateien von DDS,
  • die Logdatei von aswMBR,
  • die Logdatei von TDSSKiller.

edlgrafix 07.10.2012 17:04
Vielen Dank, habe alle Logs bis auf das zweite von dds ... da hat sich irgendwie nur ein Fenster aufgemacht? Ist das Log sonst irgendwo gespeichert, sodass ich noch einmal dazu komme? Hier einmal, was ich habe:
DDS:
[CODE].DDS Logfile:
Code:
DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK
Internet Explorer: 9.0.8112.16421
Run by Ana Aimee at 11:43:48 on 2012-10-06
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.1.1033.18.6044.5444 [GMT -6:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com.gt/
uDefault_Page_URL = hxxp://sony.msn.com
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
BHO: CIESpeechBHO Class: {8d10f6c4-0e01-4bd4-8601-11ac1fdf8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
uRun: [ijhrohwoykdolll] C:\ProgramData\ijhrohwo.exe
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun: [<NO NAME>]
mRun: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
mRun: [PMBVolumeWatcher] c:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1 195.58.160.194 195.58.161.122
TCP: Interfaces\{7E7E1B98-1CCD-4397-84BD-32DCD282C0AA} : DhcpNameServer = 192.168.2.1 195.58.160.194 195.58.161.122
TCP: Interfaces\{7E7E1B98-1CCD-4397-84BD-32DCD282C0AA}\34143514028444 : DhcpNameServer = 216.230.147.90 216.230.128.32
TCP: Interfaces\{7E7E1B98-1CCD-4397-84BD-32DCD282C0AA}\45552524F4E4544545F574B4 : DhcpNameServer = 216.230.147.90 216.230.128.32
TCP: Interfaces\{FA7A5B6E-C355-487C-86B9-D7BC4568362F} : DhcpNameServer = 62.25.0.55
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64:    AcroIEHelperStub - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
BHO-X64: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
BHO-X64:    IESpeakDoc - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
mRun-x64: [(Default)]
mRun-x64: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
mRun-x64: [PMBVolumeWatcher] c:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\system32\drivers\iusb3hcs.sys --> C:\Windows\system32\drivers\iusb3hcs.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\system32\drivers\btath_bus.sys --> C:\Windows\system32\drivers\btath_bus.sys [?]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\system32\drivers\iusb3hub.sys --> C:\Windows\system32\drivers\iusb3hub.sys [?]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\system32\drivers\iusb3xhc.sys --> C:\Windows\system32\drivers\iusb3xhc.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface ;C:\Windows\system32\drivers\HECIx64.sys --> C:\Windows\system32\drivers\HECIx64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 SFEP;Sony Firmware Extension Parser;C:\Windows\system32\drivers\SFEP.sys --> C:\Windows\system32\drivers\SFEP.sys [?]
S1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys --> C:\Windows\system32\DRIVERS\avkmgr.sys [?]
S2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-9-17 86224]
S2 AntiVirService;Avira Realtime Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-9-17 110032]
S2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2012-2-23 106144]
S2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
S2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-7-13 249648]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-4-27 13592]
S2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-4-27 2429544]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-2-2 628448]
S2 Intel(R) ME Service;Intel(R) ME Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-4-27 128280]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-4-27 161560]
S2 Oasis2Service;Oasis2Service;C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe [2011-12-5 51200]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [2012-2-21 473960]
S2 SampleCollector;VAIO Care Performance Service;C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2011-11-30 260768]
S2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2012-4-27 105024]
S2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-4-27 363800]
S2 VSNService;VSNService;C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2012-4-27 978056]
S2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2012-2-23 158880]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-27 250288]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys --> C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys [?]
S3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\system32\DRIVERS\btath_flt.sys --> C:\Windows\system32\DRIVERS\btath_flt.sys [?]
S3 ATHDFU;Atheros Valkyrie USB BootROM;C:\Windows\system32\Drivers\AthDfu.sys --> C:\Windows\system32\Drivers\AthDfu.sys [?]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-9-15 195320]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\system32\drivers\btath_a2dp.sys --> C:\Windows\system32\drivers\btath_a2dp.sys [?]
S3 btath_avdt;Atheros Bluetooth AVDT Service;C:\Windows\system32\drivers\btath_avdt.sys --> C:\Windows\system32\drivers\btath_avdt.sys [?]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\system32\drivers\btath_hcrp.sys --> C:\Windows\system32\drivers\btath_hcrp.sys [?]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\system32\DRIVERS\btath_lwflt.sys --> C:\Windows\system32\DRIVERS\btath_lwflt.sys [?]
S3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\system32\drivers\btath_rcp.sys --> C:\Windows\system32\drivers\btath_rcp.sys [?]
S3 BTATH_VDP;Bluetooth VDP Driver;C:\Windows\system32\drivers\btath_vdp.sys --> C:\Windows\system32\drivers\btath_vdp.sys [?]
S3 BtFilter;BtFilter;C:\Windows\system32\DRIVERS\btfilter.sys --> C:\Windows\system32\DRIVERS\btfilter.sys [?]
S3 cphs;Intel(R) Content Protection HECI Service;C:\Windows\SysWOW64\IntelCpHeciSvc.exe [2012-3-14 274200]
S3 DCDhcpService;DCDhcpService;C:\Program Files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [2012-4-27 112256]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;C:\Windows\system32\DRIVERS\e1y60x64.sys --> C:\Windows\system32\DRIVERS\e1y60x64.sys [?]
S3 IntcDAud;Intel(R) Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
S3 lehidmini;Bluetooth Low Energy Hid Device;C:\Windows\system32\drivers\leath_hid.sys --> C:\Windows\system32\drivers\leath_hid.sys [?]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]
S3 SmbDrv;SmbDrv;C:\Windows\system32\drivers\Smb_driver.sys --> C:\Windows\system32\drivers\Smb_driver.sys [?]
S3 SOHCImp;VAIO Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2012-1-6 138392]
S3 SOHDs;VAIO Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2012-1-6 74904]
S3 SpfService;VAIO Entertainment Common Service;C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-12-1 289952]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2012-4-27 535688]
S3 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-12-29 960160]
S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-12-21 550128]
S3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2011-12-21 382720]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-8-26 101600]
S3 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2012-1-20 54432]
S3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update Common\VUAgent.exe [2012-1-13 1256040]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-10-04 19:25:53        --------        d-----w-        C:\ProgramData\xwxzwyecydufcde
2012-10-04 19:25:52        105984        ----a-w-        C:\ProgramData\ijhrohwo.exe
2012-10-04 19:25:44        105984        ----a-w-        C:\Users\Ana Aimee\0.9733233090621961.exe
2012-09-19 03:12:42        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\Microsoft Games
2012-09-18 16:26:01        --------        d-----w-        C:\Program Files (x86)\Microsoft Visual Studio 8
2012-09-18 16:25:23        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\Microsoft Help
2012-09-18 16:23:09        650752        ----a-w-        C:\Windows\SysWow64\xvidcore.dll
2012-09-18 16:23:09        243200        ----a-w-        C:\Windows\SysWow64\xvidvfw.dll
2012-09-18 16:23:09        216064        ----a-w-        C:\Windows\SysWow64\lagarith.dll
2012-09-18 16:23:08        178688        ----a-w-        C:\Windows\SysWow64\unrar.dll
2012-09-18 16:23:08        151552        ----a-w-        C:\Windows\SysWow64\ac3acm.acm
2012-09-18 16:23:06        112640        ----a-w-        C:\Windows\SysWow64\ff_vfw.dll
2012-09-18 16:23:05        --------        d-----w-        C:\Program Files (x86)\K-Lite Codec Pack
2012-09-18 16:20:36        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\Sony
2012-09-18 13:52:16        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\ArcSoft
2012-09-18 13:50:35        --------        d-----w-        C:\Users\Ana Aimee\AppData\Roaming\Avira
2012-09-18 13:43:31        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\CrashDumps
2012-09-18 04:30:40        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\Cyberlink
2012-09-18 04:25:37        98848        ----a-w-        C:\Windows\System32\drivers\avgntflt.sys
2012-09-18 04:25:37        27760        ----a-w-        C:\Windows\System32\drivers\avkmgr.sys
2012-09-18 04:25:36        --------        d-----w-        C:\ProgramData\Avira
2012-09-18 04:25:36        --------        d-----w-        C:\Program Files (x86)\Avira
2012-09-18 04:13:57        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\BMExplorer
2012-09-18 04:13:48        --------        d-----w-        C:\Users\Ana Aimee\AppData\Roaming\Intel Corporation
2012-09-18 04:13:47        --------        d-----w-        C:\Users\Ana Aimee\AppData\Roaming\Atheros
2012-09-18 04:11:51        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\Sony Corporation
2012-09-18 04:11:46        --------        d-----w-        C:\Users\Ana Aimee\AppData\Local\VirtualStore
2012-09-18 04:11:31        --------        d-----w-        C:\Windows\SysWow64\VAIO Startup Setting Tool
2012-09-18 04:11:31        --------        d-----w-        C:\Windows\pss
.
==================== Find3M  ====================
.
2012-10-01 02:33:48        73136        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-01 02:33:48        696240        ----a-w-        C:\Windows\SysWow64\FlashPlayerApp.exe
.
============= FINISH: 11:44:22.71 ===============
--- --- ---


Deffoger:
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:39 on 07/10/2012 (Ana Aimee)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
aswMBR:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-07 09:41:01
-----------------------------
09:41:01.537    OS Version: Windows x64 6.1.7601 Service Pack 1
09:41:01.537    Number of processors: 4 586 0x2A07
09:41:01.537    ComputerName: ANAAIMEE-VAIO  UserName: Ana Aimee
09:41:03.206    Initialize success
09:44:16.568    AVAST engine defs: 12100701
09:44:20.343    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
09:44:20.359    Disk 0 Vendor: Hitachi_ JEDO Size: 610480MB BusType: 3
09:44:20.359    Disk 0 MBR read successfully
09:44:20.375    Disk 0 MBR scan
09:44:20.375    Disk 0 Windows 7 default MBR code
09:44:20.375    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        18940 MB offset 2048
09:44:20.390    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          350 MB offset 38791168
09:44:20.406    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      591188 MB offset 39507968
09:44:20.421    Disk 0 scanning C:\Windows\system32\drivers
09:44:28.455    Service scanning
09:44:53.478    Modules scanning
09:44:53.478    Disk 0 trace - called modules:
09:44:53.509    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
09:44:53.509    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008a78060]
09:44:53.525    3 CLASSPNP.SYS[fffff88001d7c43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80077fc050]
09:44:54.710    AVAST engine scan C:\Windows
09:44:57.425    AVAST engine scan C:\Windows\system32
09:46:39.511    AVAST engine scan C:\Windows\system32\drivers
09:46:49.324    AVAST engine scan C:\Users\Ana Aimee
09:46:49.464    File: C:\Users\Ana Aimee\0.9733233090621961.exe  **INFECTED** Win32:Ransom-UF [Trj]
09:48:41.269    AVAST engine scan C:\ProgramData
09:48:47.135    File: C:\ProgramData\ijhrohwo.exe  **INFECTED** Win32:Ransom-UF [Trj]
09:49:40.741    Scan finished successfully
09:55:04.160    Disk 0 MBR has been saved successfully to "C:\Users\Ana Aimee\Desktop\MBR.dat"
09:55:04.160    The log file has been saved successfully to "C:\Users\Ana Aimee\Desktop\aswMBR.txt"
TDSS Killer:
Code:
09:56:56.0948 1984  TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24
09:56:57.0323 1984  ============================================================
09:56:57.0323 1984  Current date / time: 2012/10/07 09:56:57.0323
09:56:57.0323 1984  SystemInfo:
09:56:57.0323 1984 
09:56:57.0323 1984  OS Version: 6.1.7601 ServicePack: 1.0
09:56:57.0323 1984  Product type: Workstation
09:56:57.0323 1984  ComputerName: ANAAIMEE-VAIO
09:56:57.0323 1984  UserName: Ana Aimee
09:56:57.0323 1984  Windows directory: C:\Windows
09:56:57.0323 1984  System windows directory: C:\Windows
09:56:57.0323 1984  Running under WOW64
09:56:57.0323 1984  Processor architecture: Intel x64
09:56:57.0323 1984  Number of processors: 4
09:56:57.0323 1984  Page size: 0x1000
09:56:57.0323 1984  Boot type: Safe boot with network
09:56:57.0323 1984  ============================================================
09:56:57.0853 1984  Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
09:56:57.0853 1984  ============================================================
09:56:57.0853 1984  \Device\Harddisk0\DR0:
09:56:57.0853 1984  MBR partitions:
09:56:57.0853 1984  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x24FE800, BlocksNum 0xAF000
09:56:57.0853 1984  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x25AD800, BlocksNum 0x482AA2B0
09:56:57.0853 1984  ============================================================
09:56:57.0916 1984  C: <-> \Device\Harddisk0\DR0\Partition2
09:56:57.0916 1984  ============================================================
09:56:57.0916 1984  Initialize success
09:56:57.0916 1984  ============================================================
09:57:00.0349 1580  ============================================================
09:57:00.0349 1580  Scan started
09:57:00.0349 1580  Mode: Manual;
09:57:00.0349 1580  ============================================================
09:57:00.0630 1580  ================ Scan system memory ========================
09:57:00.0630 1580  System memory - ok
09:57:00.0630 1580  ================ Scan services =============================
09:57:01.0020 1580  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
09:57:01.0020 1580  1394ohci - ok
09:57:01.0114 1580  [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon        C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
09:57:01.0129 1580  ACDaemon - ok
09:57:01.0192 1580  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
09:57:01.0192 1580  ACPI - ok
09:57:01.0223 1580  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
09:57:01.0223 1580  AcpiPmi - ok
09:57:01.0348 1580  [ E12CFCF1DDBFC50948A75E6E38793225 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
09:57:01.0363 1580  AdobeFlashPlayerUpdateSvc - ok
09:57:01.0441 1580  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
09:57:01.0441 1580  adp94xx - ok
09:57:01.0504 1580  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
09:57:01.0519 1580  adpahci - ok
09:57:01.0535 1580  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
09:57:01.0535 1580  adpu320 - ok
09:57:01.0582 1580  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
09:57:01.0582 1580  AeLookupSvc - ok
09:57:01.0644 1580  [ D5B031C308A409A0A576BFF4CF083D30 ] AFD            C:\Windows\system32\drivers\afd.sys
09:57:01.0660 1580  AFD - ok
09:57:01.0722 1580  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
09:57:01.0722 1580  agp440 - ok
09:57:01.0769 1580  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
09:57:01.0769 1580  ALG - ok
09:57:01.0800 1580  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
09:57:01.0800 1580  aliide - ok
09:57:01.0816 1580  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
09:57:01.0816 1580  amdide - ok
09:57:01.0816 1580  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
09:57:01.0816 1580  AmdK8 - ok
09:57:01.0847 1580  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
09:57:01.0847 1580  AmdPPM - ok
09:57:01.0894 1580  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
09:57:01.0894 1580  amdsata - ok
09:57:01.0925 1580  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
09:57:01.0925 1580  amdsbs - ok
09:57:01.0941 1580  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
09:57:01.0941 1580  amdxata - ok
09:57:02.0128 1580  [ 0A1CC583E8147004E4AD4625D7FBF88C ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
09:57:02.0128 1580  AntiVirSchedulerService - ok
09:57:02.0190 1580  [ C9A36EF935ACED86AEDF93E97E606911 ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
09:57:02.0190 1580  AntiVirService - ok
09:57:02.0237 1580  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
09:57:02.0237 1580  AppID - ok
09:57:02.0268 1580  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
09:57:02.0268 1580  AppIDSvc - ok
09:57:02.0268 1580  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
09:57:02.0268 1580  Appinfo - ok
09:57:02.0299 1580  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\drivers\arc.sys
09:57:02.0299 1580  arc - ok
09:57:02.0315 1580  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
09:57:02.0315 1580  arcsas - ok
09:57:02.0346 1580  [ C130BC4A51B1382B2BE8E44579EC4C0A ] ArcSoftKsUFilter C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys
09:57:02.0346 1580  ArcSoftKsUFilter - ok
09:57:02.0440 1580  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
09:57:02.0487 1580  aspnet_state - ok
09:57:02.0518 1580  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
09:57:02.0518 1580  AsyncMac - ok
09:57:02.0549 1580  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
09:57:02.0549 1580  atapi - ok
09:57:02.0580 1580  [ BCC09E0B0362741D0C084828A1B950F3 ] AthBTPort      C:\Windows\system32\DRIVERS\btath_flt.sys
09:57:02.0580 1580  AthBTPort - ok
09:57:02.0658 1580  [ 4119870B90E1B5E7797D6433D21F9216 ] ATHDFU          C:\Windows\System32\Drivers\AthDfu.sys
09:57:02.0658 1580  ATHDFU - ok
09:57:02.0705 1580  [ 1FDE0AAAEA06519AAE98CCF24715B765 ] AtherosSvc      C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
09:57:02.0705 1580  AtherosSvc - ok
09:57:02.0799 1580  [ 237EE0B7A65D55E08EB7530F77423480 ] athr            C:\Windows\system32\DRIVERS\athrx.sys
09:57:02.0830 1580  athr - ok
09:57:02.0861 1580  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
09:57:02.0861 1580  AudioEndpointBuilder - ok
09:57:02.0877 1580  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
09:57:02.0877 1580  AudioSrv - ok
09:57:02.0923 1580  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
09:57:02.0923 1580  avgntflt - ok
09:57:02.0939 1580  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
09:57:02.0955 1580  avipbb - ok
09:57:02.0970 1580  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
09:57:02.0970 1580  avkmgr - ok
09:57:03.0017 1580  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
09:57:03.0017 1580  AxInstSV - ok
09:57:03.0048 1580  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
09:57:03.0048 1580  b06bdrv - ok
09:57:03.0079 1580  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
09:57:03.0095 1580  b57nd60a - ok
09:57:03.0173 1580  [ 216EC30BEAA9AE6818B21C969500D308 ] BBSvc          C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
09:57:03.0173 1580  BBSvc - ok
09:57:03.0204 1580  [ 785DE7ABDA13309D6065305542829E76 ] BBUpdate        C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
09:57:03.0204 1580  BBUpdate - ok
09:57:03.0235 1580  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
09:57:03.0235 1580  BDESVC - ok
09:57:03.0282 1580  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
09:57:03.0282 1580  Beep - ok
09:57:03.0313 1580  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
09:57:03.0329 1580  BFE - ok
09:57:03.0360 1580  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
09:57:03.0360 1580  BITS - ok
09:57:03.0391 1580  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
09:57:03.0391 1580  blbdrive - ok
09:57:03.0407 1580  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
09:57:03.0407 1580  bowser - ok
09:57:03.0438 1580  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
09:57:03.0438 1580  BrFiltLo - ok
09:57:03.0454 1580  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
09:57:03.0454 1580  BrFiltUp - ok
09:57:03.0485 1580  [ 8EF0D5C41EC907751B8429162B1239ED ] Browser        C:\Windows\System32\browser.dll
09:57:03.0485 1580  Browser - ok
09:57:03.0516 1580  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
09:57:03.0516 1580  Brserid - ok
09:57:03.0532 1580  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
09:57:03.0532 1580  BrSerWdm - ok
09:57:03.0563 1580  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
09:57:03.0563 1580  BrUsbMdm - ok
09:57:03.0579 1580  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
09:57:03.0579 1580  BrUsbSer - ok
09:57:03.0625 1580  [ 9455A8F85BE24514E50AFE90D4C976DB ] BTATH_A2DP      C:\Windows\system32\drivers\btath_a2dp.sys
09:57:03.0625 1580  BTATH_A2DP - ok
09:57:03.0641 1580  [ 2D27F7A831657D63AFC78E5E78DCA83F ] btath_avdt      C:\Windows\system32\drivers\btath_avdt.sys
09:57:03.0641 1580  btath_avdt - ok
09:57:03.0672 1580  [ E6B734A37ADE36FE1A77035F4E484C8C ] BTATH_BUS      C:\Windows\system32\drivers\btath_bus.sys
09:57:03.0672 1580  BTATH_BUS - ok
09:57:03.0703 1580  [ FB3833E63FF602B69C2FF085846DCF43 ] BTATH_HCRP      C:\Windows\system32\drivers\btath_hcrp.sys
09:57:03.0703 1580  BTATH_HCRP - ok
09:57:03.0719 1580  [ 371A11C1333BA526263A987A93ACDE3D ] BTATH_LWFLT    C:\Windows\system32\DRIVERS\btath_lwflt.sys
09:57:03.0719 1580  BTATH_LWFLT - ok
09:57:03.0735 1580  [ ABCD3C16CA850A7594CEB9AD5D966810 ] BTATH_RCP      C:\Windows\system32\drivers\btath_rcp.sys
09:57:03.0735 1580  BTATH_RCP - ok
09:57:03.0781 1580  [ 680BE9ED6431DAFA844F5F7B61B11F9A ] BTATH_VDP      C:\Windows\system32\drivers\btath_vdp.sys
09:57:03.0781 1580  BTATH_VDP - ok
09:57:03.0828 1580  [ EA92CE309DD24F489FDB149847AE6835 ] BtFilter        C:\Windows\system32\DRIVERS\btfilter.sys
09:57:03.0828 1580  BtFilter - ok
09:57:03.0859 1580  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum        C:\Windows\system32\DRIVERS\BthEnum.sys
09:57:03.0859 1580  BthEnum - ok
09:57:03.0891 1580  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
09:57:03.0891 1580  BTHMODEM - ok
09:57:03.0906 1580  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
09:57:03.0906 1580  BthPan - ok
09:57:03.0937 1580  [ 64C198198501F7560EE41D8D1EFA7952 ] BTHPORT        C:\Windows\system32\Drivers\BTHport.sys
09:57:03.0937 1580  BTHPORT - ok
09:57:03.0969 1580  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
09:57:03.0969 1580  bthserv - ok
09:57:03.0984 1580  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys
09:57:03.0984 1580  BTHUSB - ok
09:57:04.0015 1580  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
09:57:04.0015 1580  cdfs - ok
09:57:04.0031 1580  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
09:57:04.0047 1580  cdrom - ok
09:57:04.0078 1580  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
09:57:04.0078 1580  CertPropSvc - ok
09:57:04.0125 1580  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
09:57:04.0125 1580  circlass - ok
09:57:04.0156 1580  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
09:57:04.0156 1580  CLFS - ok
09:57:04.0218 1580  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
09:57:04.0218 1580  clr_optimization_v2.0.50727_32 - ok
09:57:04.0281 1580  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
09:57:04.0312 1580  clr_optimization_v2.0.50727_64 - ok
09:57:04.0359 1580  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
09:57:04.0405 1580  clr_optimization_v4.0.30319_32 - ok
09:57:04.0437 1580  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
09:57:04.0499 1580  clr_optimization_v4.0.30319_64 - ok
09:57:04.0546 1580  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
09:57:04.0546 1580  CmBatt - ok
09:57:04.0577 1580  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
09:57:04.0577 1580  cmdide - ok
09:57:04.0593 1580  [ C4943B6C962E4B82197542447AD599F4 ] CNG            C:\Windows\system32\Drivers\cng.sys
09:57:04.0593 1580  CNG - ok
09:57:04.0624 1580  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
09:57:04.0624 1580  Compbatt - ok
09:57:04.0655 1580  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
09:57:04.0655 1580  CompositeBus - ok
09:57:04.0655 1580  COMSysApp - ok
09:57:04.0749 1580  [ 453A8D09DB02EB0DF64709B1603EAA2C ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
09:57:04.0842 1580  cphs - ok
09:57:04.0873 1580  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
09:57:04.0873 1580  crcdisk - ok
09:57:04.0920 1580  [ 15597883FBE9B056F276ADA3AD87D9AF ] CryptSvc        C:\Windows\system32\cryptsvc.dll
09:57:04.0920 1580  CryptSvc - ok
09:57:05.0092 1580  [ 461A0688205D088D2A2EBEEDEE81622E ] DCDhcpService  C:\Program Files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe
09:57:05.0092 1580  DCDhcpService - ok
09:57:05.0123 1580  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
09:57:05.0139 1580  DcomLaunch - ok
09:57:05.0154 1580  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
09:57:05.0154 1580  defragsvc - ok
09:57:05.0185 1580  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
09:57:05.0185 1580  DfsC - ok
09:57:05.0232 1580  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
09:57:05.0232 1580  Dhcp - ok
09:57:05.0232 1580  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
09:57:05.0232 1580  discache - ok
09:57:05.0295 1580  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
09:57:05.0295 1580  Disk - ok
09:57:05.0310 1580  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
09:57:05.0310 1580  Dnscache - ok
09:57:05.0341 1580  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
09:57:05.0341 1580  dot3svc - ok
09:57:05.0341 1580  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
09:57:05.0357 1580  DPS - ok
09:57:05.0404 1580  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
09:57:05.0404 1580  drmkaud - ok
09:57:05.0435 1580  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
09:57:05.0451 1580  DXGKrnl - ok
09:57:05.0466 1580  [ 50AD8FC1DC800FF36087994C8F7FDFF2 ] e1yexpress      C:\Windows\system32\DRIVERS\e1y60x64.sys
09:57:05.0466 1580  e1yexpress - ok
09:57:05.0497 1580  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
09:57:05.0497 1580  EapHost - ok
09:57:05.0560 1580  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\drivers\evbda.sys
09:57:05.0622 1580  ebdrv - ok
09:57:05.0685 1580  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
09:57:05.0685 1580  EFS - ok
09:57:05.0763 1580  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
09:57:05.0763 1580  ehRecvr - ok
09:57:05.0778 1580  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
09:57:05.0778 1580  ehSched - ok
09:57:05.0841 1580  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
09:57:05.0841 1580  elxstor - ok
09:57:05.0872 1580  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
09:57:05.0872 1580  ErrDev - ok
09:57:05.0903 1580  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
09:57:05.0919 1580  EventSystem - ok
09:57:05.0934 1580  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
09:57:05.0950 1580  exfat - ok
09:57:05.0950 1580  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
09:57:05.0950 1580  fastfat - ok
09:57:05.0997 1580  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
09:57:05.0997 1580  Fax - ok
09:57:06.0028 1580  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\drivers\fdc.sys
09:57:06.0028 1580  fdc - ok
09:57:06.0043 1580  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
09:57:06.0043 1580  fdPHost - ok
09:57:06.0059 1580  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
09:57:06.0059 1580  FDResPub - ok
09:57:06.0075 1580  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
09:57:06.0075 1580  FileInfo - ok
09:57:06.0090 1580  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
09:57:06.0090 1580  Filetrace - ok
09:57:06.0106 1580  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
09:57:06.0106 1580  flpydisk - ok
09:57:06.0121 1580  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
09:57:06.0121 1580  FltMgr - ok
09:57:06.0184 1580  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
09:57:06.0199 1580  FontCache - ok
09:57:06.0231 1580  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
09:57:06.0231 1580  FontCache3.0.0.0 - ok
09:57:06.0262 1580  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
09:57:06.0262 1580  FsDepends - ok
09:57:06.0262 1580  [ E95EF8547DE20CF0603557C0CF7A9462 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
09:57:06.0262 1580  Fs_Rec - ok
09:57:06.0277 1580  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
09:57:06.0277 1580  fvevol - ok
09:57:06.0309 1580  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
09:57:06.0309 1580  gagp30kx - ok
09:57:06.0355 1580  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
09:57:06.0355 1580  gpsvc - ok
09:57:06.0387 1580  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
09:57:06.0387 1580  hcw85cir - ok
09:57:06.0418 1580  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
09:57:06.0418 1580  HdAudAddService - ok
09:57:06.0465 1580  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
09:57:06.0465 1580  HDAudBus - ok
09:57:06.0496 1580  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
09:57:06.0496 1580  HidBatt - ok
09:57:06.0511 1580  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
09:57:06.0511 1580  HidBth - ok
09:57:06.0543 1580  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\drivers\hidir.sys
09:57:06.0543 1580  HidIr - ok
09:57:06.0558 1580  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
09:57:06.0558 1580  hidserv - ok
09:57:06.0605 1580  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
09:57:06.0605 1580  HidUsb - ok
09:57:06.0636 1580  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
09:57:06.0636 1580  hkmsvc - ok
09:57:06.0652 1580  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
09:57:06.0652 1580  HomeGroupListener - ok
09:57:06.0683 1580  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
09:57:06.0683 1580  HomeGroupProvider - ok
09:57:06.0714 1580  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
09:57:06.0714 1580  HpSAMD - ok
09:57:06.0745 1580  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
09:57:06.0761 1580  HTTP - ok
09:57:06.0761 1580  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
09:57:06.0761 1580  hwpolicy - ok
09:57:06.0808 1580  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
09:57:06.0808 1580  i8042prt - ok
09:57:06.0839 1580  [ C224331A54571C8C9162F7714400BBBD ] iaStor          C:\Windows\system32\drivers\iaStor.sys
09:57:06.0855 1580  iaStor - ok
09:57:06.0964 1580  [ 7D4B9A48430ED57ACA6373B71D5904CA ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
09:57:06.0964 1580  IAStorDataMgrSvc - ok
09:57:07.0011 1580  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
09:57:07.0026 1580  iaStorV - ok
09:57:07.0120 1580  [ 3CC7B3BB1A9EA201A040883EDFAA67A0 ] IconMan_R      C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
09:57:07.0135 1580  IconMan_R - ok
09:57:07.0182 1580  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
09:57:07.0198 1580  idsvc - ok
09:57:07.0447 1580  [ 54E37A4E66B2CA1C38E9728FAD5F9822 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
09:57:07.0681 1580  igfx - ok
09:57:07.0728 1580  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
09:57:07.0728 1580  iirsp - ok
09:57:07.0759 1580  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
09:57:07.0775 1580  IKEEXT - ok
09:57:07.0900 1580  [ 602788BF364D43E5878AA1B4F85C232B ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
09:57:07.0978 1580  IntcAzAudAddService - ok
09:57:08.0009 1580  [ 6C9FFFECA9FED31347D211C5D1FFBD2D ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
09:57:08.0009 1580  IntcDAud - ok
09:57:08.0056 1580  [ 832CE330DD987227B7DEA8C03F22AEFA ] Intel(R) Capability Licensing Service Interface c:\Program Files\Intel\iCLS Client\HeciServer.exe
09:57:08.0071 1580  Intel(R) Capability Licensing Service Interface - ok
09:57:08.0118 1580  [ 9571D8BDB56EBC52280E8020574508E6 ] Intel(R) ME Service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
09:57:08.0118 1580  Intel(R) ME Service - ok
09:57:08.0149 1580  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
09:57:08.0149 1580  intelide - ok
09:57:08.0181 1580  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\drivers\intelppm.sys
09:57:08.0181 1580  intelppm - ok
09:57:08.0196 1580  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
09:57:08.0196 1580  IPBusEnum - ok
09:57:08.0212 1580  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
09:57:08.0212 1580  IpFilterDriver - ok
09:57:08.0243 1580  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
09:57:08.0243 1580  iphlpsvc - ok
09:57:08.0274 1580  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
09:57:08.0274 1580  IPMIDRV - ok
09:57:08.0305 1580  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
09:57:08.0305 1580  IPNAT - ok
09:57:08.0321 1580  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
09:57:08.0321 1580  IRENUM - ok
09:57:08.0321 1580  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
09:57:08.0321 1580  isapnp - ok
09:57:08.0352 1580  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
09:57:08.0352 1580  iScsiPrt - ok
09:57:08.0383 1580  [ 6BCEF45131C8B8E1C558BE540B190B3C ] iusb3hcs        C:\Windows\system32\drivers\iusb3hcs.sys
09:57:08.0383 1580  iusb3hcs - ok
09:57:08.0415 1580  [ F080EADA8715F811B58BD35BB774F2F9 ] iusb3hub        C:\Windows\system32\drivers\iusb3hub.sys
09:57:08.0415 1580  iusb3hub - ok
09:57:08.0446 1580  [ 0F1756D9396740F053221FA6260FCE66 ] iusb3xhc        C:\Windows\system32\drivers\iusb3xhc.sys
09:57:08.0461 1580  iusb3xhc - ok
09:57:08.0493 1580  [ DBD76BC1D498FE368F2C8CB76C3E00A4 ] jhi_service    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
09:57:08.0508 1580  jhi_service - ok
09:57:08.0539 1580  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
09:57:08.0539 1580  kbdclass - ok
09:57:08.0586 1580  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
09:57:08.0586 1580  kbdhid - ok
09:57:08.0602 1580  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
09:57:08.0602 1580  KeyIso - ok
09:57:08.0633 1580  [ DA1E991A61CFDD755A589E206B97644B ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
09:57:08.0633 1580  KSecDD - ok
09:57:08.0633 1580  [ 7E33198D956943A4F11A5474C1E9106F ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
09:57:08.0633 1580  KSecPkg - ok
09:57:08.0649 1580  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
09:57:08.0649 1580  ksthunk - ok
09:57:08.0680 1580  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
09:57:08.0680 1580  KtmRm - ok
09:57:08.0711 1580  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
09:57:08.0711 1580  LanmanServer - ok
09:57:08.0742 1580  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
09:57:08.0742 1580  LanmanWorkstation - ok
09:57:08.0789 1580  [ 6CE0F55287EB8E8E472656E84DDCF4EA ] lehidmini      C:\Windows\system32\drivers\leath_hid.sys
09:57:08.0789 1580  lehidmini - ok
09:57:08.0820 1580  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
09:57:08.0820 1580  lltdio - ok
09:57:08.0836 1580  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
09:57:08.0836 1580  lltdsvc - ok
09:57:08.0836 1580  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
09:57:08.0836 1580  lmhosts - ok
09:57:08.0883 1580  [ 86E4CC39C953D11EF57CF54C4DC78238 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
09:57:08.0883 1580  LMS - ok
09:57:08.0914 1580  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
09:57:08.0914 1580  LSI_FC - ok
09:57:08.0961 1580  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
09:57:08.0961 1580  LSI_SAS - ok
09:57:08.0961 1580  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
09:57:08.0961 1580  LSI_SAS2 - ok
09:57:08.0992 1580  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
09:57:08.0992 1580  LSI_SCSI - ok
09:57:09.0007 1580  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
09:57:09.0023 1580  luafv - ok
09:57:09.0039 1580  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
09:57:09.0039 1580  Mcx2Svc - ok
09:57:09.0070 1580  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\drivers\megasas.sys
09:57:09.0070 1580  megasas - ok
09:57:09.0101 1580  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
09:57:09.0101 1580  MegaSR - ok
09:57:09.0132 1580  [ 6B01B7414A105B9E51652089A03027CF ] MEIx64          C:\Windows\system32\drivers\HECIx64.sys
09:57:09.0132 1580  MEIx64 - ok
09:57:09.0288 1580  [ FAFE367D032ED82E9332B4C741A20216 ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
09:57:09.0304 1580  Microsoft Office Groove Audit Service - ok
09:57:09.0335 1580  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
09:57:09.0335 1580  MMCSS - ok
09:57:09.0351 1580  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
09:57:09.0351 1580  Modem - ok
09:57:09.0382 1580  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
09:57:09.0382 1580  monitor - ok
09:57:09.0397 1580  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
09:57:09.0397 1580  mouclass - ok
09:57:09.0413 1580  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
09:57:09.0413 1580  mouhid - ok
09:57:09.0429 1580  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
09:57:09.0429 1580  mountmgr - ok
09:57:09.0444 1580  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
09:57:09.0444 1580  mpio - ok
09:57:09.0460 1580  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
09:57:09.0460 1580  mpsdrv - ok
09:57:09.0491 1580  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
09:57:09.0507 1580  MpsSvc - ok
09:57:09.0522 1580  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
09:57:09.0522 1580  MRxDAV - ok
09:57:09.0522 1580  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
09:57:09.0538 1580  mrxsmb - ok
09:57:09.0538 1580  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
09:57:09.0553 1580  mrxsmb10 - ok
09:57:09.0553 1580  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
09:57:09.0553 1580  mrxsmb20 - ok
09:57:09.0585 1580  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
09:57:09.0585 1580  msahci - ok
09:57:09.0600 1580  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
09:57:09.0600 1580  msdsm - ok
09:57:09.0616 1580  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
09:57:09.0616 1580  MSDTC - ok
09:57:09.0678 1580  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
09:57:09.0678 1580  Msfs - ok
09:57:09.0694 1580  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
09:57:09.0694 1580  mshidkmdf - ok
09:57:09.0709 1580  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
09:57:09.0709 1580  msisadrv - ok
09:57:09.0725 1580  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
09:57:09.0725 1580  MSiSCSI - ok
09:57:09.0741 1580  msiserver - ok
09:57:09.0772 1580  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
09:57:09.0772 1580  MSKSSRV - ok
09:57:09.0772 1580  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
09:57:09.0772 1580  MSPCLOCK - ok
09:57:09.0772 1580  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
09:57:09.0772 1580  MSPQM - ok
09:57:09.0772 1580  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
09:57:09.0787 1580  MsRPC - ok
09:57:09.0803 1580  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
09:57:09.0819 1580  mssmbios - ok
09:57:09.0834 1580  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
09:57:09.0834 1580  MSTEE - ok
09:57:09.0850 1580  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
09:57:09.0850 1580  MTConfig - ok
09:57:09.0865 1580  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
09:57:09.0865 1580  Mup - ok
09:57:09.0897 1580  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
09:57:09.0912 1580  napagent - ok
09:57:09.0959 1580  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
09:57:09.0959 1580  NativeWifiP - ok
09:57:09.0990 1580  [ 79B47FD40D9A817E932F9D26FAC0A81C ] NDIS            C:\Windows\system32\drivers\ndis.sys
09:57:10.0006 1580  NDIS - ok
09:57:10.0006 1580  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
09:57:10.0006 1580  NdisCap - ok
09:57:10.0037 1580  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
09:57:10.0037 1580  NdisTapi - ok
09:57:10.0053 1580  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
09:57:10.0053 1580  Ndisuio - ok
09:57:10.0068 1580  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
09:57:10.0068 1580  NdisWan - ok
09:57:10.0068 1580  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
09:57:10.0068 1580  NDProxy - ok
09:57:10.0084 1580  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
09:57:10.0084 1580  NetBIOS - ok
09:57:10.0099 1580  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
09:57:10.0099 1580  NetBT - ok
09:57:10.0115 1580  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
09:57:10.0115 1580  Netlogon - ok
09:57:10.0177 1580  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
09:57:10.0177 1580  Netman - ok
09:57:10.0224 1580  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:57:10.0255 1580  NetMsmqActivator - ok
09:57:10.0255 1580  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:57:10.0255 1580  NetPipeActivator - ok
09:57:10.0271 1580  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
09:57:10.0287 1580  netprofm - ok
09:57:10.0302 1580  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:57:10.0302 1580  NetTcpActivator - ok
09:57:10.0302 1580  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:57:10.0302 1580  NetTcpPortSharing - ok
09:57:10.0333 1580  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
09:57:10.0333 1580  nfrd960 - ok
09:57:10.0365 1580  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\Windows\System32\nlasvc.dll
09:57:10.0380 1580  NlaSvc - ok
09:57:10.0396 1580  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
09:57:10.0396 1580  Npfs - ok
09:57:10.0411 1580  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
09:57:10.0411 1580  nsi - ok
09:57:10.0411 1580  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
09:57:10.0411 1580  nsiproxy - ok
09:57:10.0474 1580  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
09:57:10.0489 1580  Ntfs - ok
09:57:10.0521 1580  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
09:57:10.0521 1580  Null - ok
09:57:10.0708 1580  [ DD81FBC57AB9134CDDC5CE90880BFD80 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
09:57:10.0911 1580  nvlddmkm - ok
09:57:10.0942 1580  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
09:57:10.0942 1580  nvraid - ok
09:57:10.0957 1580  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
09:57:10.0957 1580  nvstor - ok
09:57:10.0989 1580  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
09:57:10.0989 1580  nv_agp - ok
09:57:11.0051 1580  [ 7C3BE2E60DF8FA35525591884E6DEDD7 ] Oasis2Service  C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe
09:57:11.0051 1580  Oasis2Service - ok
09:57:11.0176 1580  [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
09:57:11.0191 1580  odserv - ok
09:57:11.0207 1580  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
09:57:11.0207 1580  ohci1394 - ok
09:57:11.0269 1580  [ 5A432A042DAE460ABE7199B758E8606C ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
09:57:11.0285 1580  ose - ok
09:57:11.0332 1580  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
09:57:11.0332 1580  p2pimsvc - ok
09:57:11.0347 1580  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
09:57:11.0363 1580  p2psvc - ok
09:57:11.0394 1580  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\drivers\parport.sys
09:57:11.0394 1580  Parport - ok
09:57:11.0394 1580  [ 871EADAC56B0A4C6512BBE32753CCF79 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
09:57:11.0410 1580  partmgr - ok
09:57:11.0425 1580  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
09:57:11.0441 1580  PcaSvc - ok
09:57:11.0488 1580  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
09:57:11.0488 1580  pci - ok
09:57:11.0488 1580  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
09:57:11.0503 1580  pciide - ok
09:57:11.0519 1580  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
09:57:11.0519 1580  pcmcia - ok
09:57:11.0550 1580  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
09:57:11.0550 1580  pcw - ok
09:57:11.0550 1580  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
09:57:11.0566 1580  PEAUTH - ok
09:57:11.0644 1580  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
09:57:11.0706 1580  PerfHost - ok
09:57:11.0753 1580  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
09:57:11.0769 1580  pla - ok
09:57:11.0800 1580  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
09:57:11.0800 1580  PlugPlay - ok
09:57:11.0893 1580  [ 9C4D0DE187CBC24F658C52EFC93B1C73 ] PMBDeviceInfoProvider c:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
09:57:11.0925 1580  PMBDeviceInfoProvider - ok
09:57:11.0956 1580  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
09:57:11.0956 1580  PNRPAutoReg - ok
09:57:11.0956 1580  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
09:57:11.0956 1580  PNRPsvc - ok
09:57:12.0003 1580  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
09:57:12.0003 1580  PolicyAgent - ok
09:57:12.0034 1580  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
09:57:12.0034 1580  Power - ok
09:57:12.0065 1580  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
09:57:12.0065 1580  PptpMiniport - ok
09:57:12.0096 1580  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\drivers\processr.sys
09:57:12.0096 1580  Processor - ok
09:57:12.0159 1580  [ 5C78838B4D166D1A27DB3A8A820C799A ] ProfSvc        C:\Windows\system32\profsvc.dll
09:57:12.0159 1580  ProfSvc - ok
09:57:12.0174 1580  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
09:57:12.0174 1580  ProtectedStorage - ok
09:57:12.0190 1580  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
09:57:12.0190 1580  Psched - ok
09:57:12.0237 1580  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
09:57:12.0252 1580  ql2300 - ok
09:57:12.0268 1580  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
09:57:12.0268 1580  ql40xx - ok
09:57:12.0299 1580  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
09:57:12.0299 1580  QWAVE - ok
09:57:12.0315 1580  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
09:57:12.0315 1580  QWAVEdrv - ok
09:57:12.0315 1580  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
09:57:12.0315 1580  RasAcd - ok
09:57:12.0346 1580  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
09:57:12.0346 1580  RasAgileVpn - ok
09:57:12.0361 1580  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
09:57:12.0361 1580  RasAuto - ok
09:57:12.0377 1580  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
09:57:12.0377 1580  Rasl2tp - ok
09:57:12.0393 1580  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
09:57:12.0408 1580  RasMan - ok
09:57:12.0424 1580  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
09:57:12.0424 1580  RasPppoe - ok
09:57:12.0455 1580  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
09:57:12.0455 1580  RasSstp - ok
09:57:12.0455 1580  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
09:57:12.0455 1580  rdbss - ok
09:57:12.0471 1580  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\drivers\rdpbus.sys
09:57:12.0471 1580  rdpbus - ok
09:57:12.0471 1580  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
09:57:12.0471 1580  RDPCDD - ok
09:57:12.0486 1580  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
09:57:12.0486 1580  RDPENCDD - ok
09:57:12.0486 1580  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
09:57:12.0486 1580  RDPREFMP - ok
09:57:12.0502 1580  [ 15B66C206B5CB095BAB980553F38ED23 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
09:57:12.0502 1580  RDPWD - ok
09:57:12.0517 1580  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
09:57:12.0517 1580  rdyboost - ok
09:57:12.0533 1580  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
09:57:12.0533 1580  RemoteAccess - ok
09:57:12.0549 1580  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
09:57:12.0564 1580  RemoteRegistry - ok
09:57:12.0611 1580  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
09:57:12.0611 1580  RFCOMM - ok
09:57:12.0642 1580  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
09:57:12.0642 1580  RpcEptMapper - ok
09:57:12.0673 1580  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
09:57:12.0673 1580  RpcLocator - ok
09:57:12.0689 1580  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
09:57:12.0689 1580  RpcSs - ok
09:57:12.0705 1580  [ 9BD6DEBC9862FBE0C0467F0633B34962 ] RSPCIESTOR      C:\Windows\system32\DRIVERS\RtsPStor.sys
09:57:12.0720 1580  RSPCIESTOR - ok
09:57:12.0751 1580  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
09:57:12.0751 1580  rspndr - ok
09:57:12.0798 1580  [ EB8EA1C4C5E076D9EA61FB59960C5830 ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
09:57:12.0798 1580  RTL8167 - ok
09:57:12.0829 1580  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
09:57:12.0829 1580  SamSs - ok
09:57:12.0861 1580  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
09:57:12.0861 1580  sbp2port - ok
09:57:12.0892 1580  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
09:57:12.0892 1580  SCardSvr - ok
09:57:12.0923 1580  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
09:57:12.0923 1580  scfilter - ok
09:57:12.0954 1580  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
09:57:12.0970 1580  Schedule - ok
09:57:12.0985 1580  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
09:57:12.0985 1580  SCPolicySvc - ok
09:57:13.0001 1580  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus          C:\Windows\system32\DRIVERS\sdbus.sys
09:57:13.0017 1580  sdbus - ok
09:57:13.0032 1580  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
09:57:13.0032 1580  SDRSVC - ok
09:57:13.0048 1580  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
09:57:13.0048 1580  secdrv - ok
09:57:13.0063 1580  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
09:57:13.0063 1580  seclogon - ok
09:57:13.0079 1580  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
09:57:13.0079 1580  SENS - ok
09:57:13.0126 1580  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
09:57:13.0126 1580  SensrSvc - ok
09:57:13.0141 1580  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\drivers\serenum.sys
09:57:13.0141 1580  Serenum - ok
09:57:13.0173 1580  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\drivers\serial.sys
09:57:13.0173 1580  Serial - ok
09:57:13.0188 1580  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
09:57:13.0188 1580  sermouse - ok
09:57:13.0219 1580  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
09:57:13.0219 1580  SessionEnv - ok
09:57:13.0266 1580  [ 85D0F874734C105D02280B39BF0AD23F ] SFEP            C:\Windows\system32\drivers\SFEP.sys
09:57:13.0266 1580  SFEP - ok
09:57:13.0282 1580  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
09:57:13.0282 1580  sffdisk - ok
09:57:13.0313 1580  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
09:57:13.0313 1580  sffp_mmc - ok
09:57:13.0329 1580  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
09:57:13.0329 1580  sffp_sd - ok
09:57:13.0360 1580  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
09:57:13.0360 1580  sfloppy - ok
09:57:13.0391 1580  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
09:57:13.0391 1580  SharedAccess - ok
09:57:13.0422 1580  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
09:57:13.0422 1580  ShellHWDetection - ok
09:57:13.0453 1580  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
09:57:13.0453 1580  SiSRaid2 - ok
09:57:13.0469 1580  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
09:57:13.0469 1580  SiSRaid4 - ok
09:57:13.0500 1580  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
09:57:13.0500 1580  Smb - ok
09:57:13.0531 1580  [ AA17A14DA3B572C886D8064C72E9CC50 ] SmbDrv          C:\Windows\system32\drivers\Smb_driver.sys
09:57:13.0531 1580  SmbDrv - ok
09:57:13.0563 1580  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
09:57:13.0563 1580  SNMPTRAP - ok
09:57:13.0625 1580  [ 4AEA7A1C3CA06D95D6966C34D13C0D8B ] SOHCImp        C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
09:57:13.0625 1580  SOHCImp - ok
09:57:13.0641 1580  [ 16FD95781117E13107D477AE36219E6F ] SOHDs          C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
09:57:13.0641 1580  SOHDs - ok
09:57:13.0672 1580  [ 3BB48F7E33C2B76184DDF233000C09CD ] Sony SCSI Helper Service C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
09:57:13.0672 1580  Sony SCSI Helper Service - ok
09:57:13.0765 1580  [ C03E480E63A80D73FABE28D24D3B6B47 ] SpfService      C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe
09:57:13.0765 1580  SpfService - ok
09:57:13.0781 1580  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
09:57:13.0781 1580  spldr - ok
09:57:13.0828 1580  [ B96C17B5DC1424D56EEA3A99E97428CD ] Spooler        C:\Windows\System32\spoolsv.exe
09:57:13.0828 1580  Spooler - ok
09:57:13.0890 1580  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
09:57:13.0953 1580  sppsvc - ok
09:57:13.0953 1580  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
09:57:13.0968 1580  sppuinotify - ok
09:57:13.0984 1580  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
09:57:13.0999 1580  srv - ok
09:57:14.0015 1580  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
09:57:14.0015 1580  srv2 - ok
09:57:14.0031 1580  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
09:57:14.0031 1580  srvnet - ok
09:57:14.0062 1580  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
09:57:14.0062 1580  SSDPSRV - ok
09:57:14.0077 1580  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
09:57:14.0077 1580  SstpSvc - ok
09:57:14.0093 1580  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
09:57:14.0093 1580  stexstor - ok
09:57:14.0124 1580  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
09:57:14.0124 1580  stisvc - ok
09:57:14.0155 1580  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
09:57:14.0155 1580  swenum - ok
09:57:14.0187 1580  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
09:57:14.0202 1580  swprv - ok
09:57:14.0249 1580  [ 321EA1320771419C0956DE50F270C3E5 ] SynTP          C:\Windows\system32\drivers\SynTP.sys
09:57:14.0249 1580  SynTP - ok
09:57:14.0296 1580  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
09:57:14.0311 1580  SysMain - ok
09:57:14.0327 1580  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
09:57:14.0327 1580  TabletInputService - ok
09:57:14.0358 1580  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
09:57:14.0358 1580  TapiSrv - ok
09:57:14.0374 1580  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
09:57:14.0374 1580  TBS - ok
09:57:14.0436 1580  [ FC62769E7BFF2896035AEED399108162 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
09:57:14.0452 1580  Tcpip - ok
09:57:14.0514 1580  [ FC62769E7BFF2896035AEED399108162 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
09:57:14.0530 1580  TCPIP6 - ok
09:57:14.0530 1580  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
09:57:14.0530 1580  tcpipreg - ok
09:57:14.0545 1580  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
09:57:14.0545 1580  TDPIPE - ok
09:57:14.0545 1580  [ E4245BDA3190A582D55ED09E137401A9 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
09:57:14.0545 1580  TDTCP - ok
09:57:14.0561 1580  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
09:57:14.0561 1580  tdx - ok
09:57:14.0592 1580  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
09:57:14.0592 1580  TermDD - ok
09:57:14.0623 1580  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
09:57:14.0623 1580  TermService - ok
09:57:14.0639 1580  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
09:57:14.0639 1580  Themes - ok
09:57:14.0655 1580  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
09:57:14.0670 1580  THREADORDER - ok
09:57:14.0701 1580  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
09:57:14.0701 1580  TrkWks - ok
09:57:14.0748 1580  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
09:57:14.0764 1580  TrustedInstaller - ok
09:57:14.0764 1580  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
09:57:14.0764 1580  tssecsrv - ok
09:57:14.0795 1580  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
09:57:14.0795 1580  TsUsbFlt - ok
09:57:14.0795 1580  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
09:57:14.0795 1580  TsUsbGD - ok
09:57:14.0826 1580  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
09:57:14.0826 1580  tunnel - ok
09:57:14.0842 1580  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
09:57:14.0842 1580  uagp35 - ok
09:57:14.0889 1580  [ 1FE69F3C1CA1CF4B7EC7E2E9090FFFDC ] uCamMonitor    C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
09:57:14.0889 1580  uCamMonitor - ok
09:57:14.0920 1580  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
09:57:14.0920 1580  udfs - ok
09:57:14.0935 1580  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
09:57:14.0935 1580  UI0Detect - ok
09:57:14.0967 1580  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
09:57:14.0967 1580  uliagpkx - ok
09:57:14.0998 1580  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
09:57:14.0998 1580  umbus - ok
09:57:15.0013 1580  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
09:57:15.0013 1580  UmPass - ok
09:57:15.0091 1580  [ D80B1075B69B57A3AB78F750CE463ECE ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
09:57:15.0091 1580  UNS - ok
09:57:15.0123 1580  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
09:57:15.0123 1580  upnphost - ok
09:57:15.0154 1580  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\drivers\usbccgp.sys
09:57:15.0154 1580  usbccgp - ok
09:57:15.0185 1580  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
09:57:15.0185 1580  usbcir - ok
09:57:15.0201 1580  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\drivers\usbehci.sys
09:57:15.0201 1580  usbehci - ok
09:57:15.0232 1580  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\drivers\usbhub.sys
09:57:15.0232 1580  usbhub - ok
09:57:15.0263 1580  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
09:57:15.0263 1580  usbohci - ok
09:57:15.0294 1580  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\drivers\usbprint.sys
09:57:15.0294 1580  usbprint - ok
09:57:15.0325 1580  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
09:57:15.0325 1580  USBSTOR - ok
09:57:15.0341 1580  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
09:57:15.0341 1580  usbuhci - ok
09:57:15.0388 1580  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
09:57:15.0388 1580  usbvideo - ok
09:57:15.0403 1580  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
09:57:15.0419 1580  UxSms - ok
09:57:15.0450 1580  [ 203FD19D70549A2939E1AE3A36608151 ] VAIO Event Service C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
09:57:15.0466 1580  VAIO Event Service - ok
09:57:15.0544 1580  [ 59308CD511A5F3EE33595FFD46F76B31 ] VAIO Power Management C:\Program Files\Sony\VAIO Power Management\SPMService.exe
09:57:15.0559 1580  VAIO Power Management - ok
09:57:15.0575 1580  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
09:57:15.0575 1580  VaultSvc - ok
09:57:15.0653 1580  [ ADD5A5BA64D0710E1C764A8D4DAD510E ] VCFw            C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
09:57:15.0653 1580  VCFw - ok
09:57:15.0700 1580  [ EEE5AD6FB40B35F7867C3A49B98BB4EF ] VcmIAlzMgr      C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
09:57:15.0700 1580  VcmIAlzMgr - ok
09:57:15.0731 1580  [ FD5BD55C1854208BC9C51DBCFC3C1941 ] VcmINSMgr      C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
09:57:15.0747 1580  VcmINSMgr - ok
09:57:15.0778 1580  [ 9BC1F203C5604C24F345BCFCD6956BAE ] VcmXmlIfHelper  C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe
09:57:15.0778 1580  VcmXmlIfHelper - ok
09:57:15.0825 1580  [ D076011ECD0D1310E879F32EBF3B4886 ] VCService      C:\Program Files\Sony\VAIO Care\VCService.exe
09:57:15.0825 1580  VCService - ok
09:57:15.0856 1580  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
09:57:15.0856 1580  vdrvroot - ok
09:57:15.0887 1580  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
09:57:15.0887 1580  vds - ok
09:57:15.0918 1580  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
09:57:15.0918 1580  vga - ok
09:57:15.0934 1580  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
09:57:15.0934 1580  VgaSave - ok
09:57:15.0949 1580  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
09:57:15.0949 1580  vhdmp - ok
09:57:15.0965 1580  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
09:57:15.0965 1580  viaide - ok
09:57:15.0996 1580  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
09:57:15.0996 1580  volmgr - ok
09:57:16.0012 1580  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
09:57:16.0012 1580  volmgrx - ok
09:57:16.0043 1580  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
09:57:16.0043 1580  volsnap - ok
09:57:16.0090 1580  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
09:57:16.0090 1580  vsmraid - ok
09:57:16.0183 1580  [ 596E65BDEE804CC6658A39756CC61849 ] VSNService      C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
09:57:16.0199 1580  VSNService - ok
09:57:16.0246 1580  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
09:57:16.0261 1580  VSS - ok
09:57:16.0324 1580  [ FB4A1695D2D74F9C92CA5E84795CDBE1 ] VUAgent        C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
09:57:16.0339 1580  VUAgent - ok
09:57:16.0355 1580  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
09:57:16.0355 1580  vwifibus - ok
09:57:16.0371 1580  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
09:57:16.0371 1580  vwififlt - ok
09:57:16.0386 1580  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
09:57:16.0386 1580  W32Time - ok
09:57:16.0417 1580  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
09:57:16.0417 1580  WacomPen - ok
09:57:16.0464 1580  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
09:57:16.0464 1580  WANARP - ok
09:57:16.0464 1580  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
09:57:16.0464 1580  Wanarpv6 - ok
09:57:16.0527 1580  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
09:57:16.0542 1580  wbengine - ok
09:57:16.0542 1580  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
09:57:16.0542 1580  WbioSrvc - ok
09:57:16.0558 1580  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
09:57:16.0558 1580  wcncsvc - ok
09:57:16.0558 1580  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
09:57:16.0558 1580  WcsPlugInService - ok
09:57:16.0589 1580  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
09:57:16.0589 1580  Wd - ok
09:57:16.0620 1580  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
09:57:16.0636 1580  Wdf01000 - ok
09:57:16.0636 1580  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
09:57:16.0636 1580  WdiServiceHost - ok
09:57:16.0651 1580  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
09:57:16.0651 1580  WdiSystemHost - ok
09:57:16.0683 1580  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
09:57:16.0683 1580  WebClient - ok
09:57:16.0698 1580  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
09:57:16.0698 1580  Wecsvc - ok
09:57:16.0698 1580  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
09:57:16.0714 1580  wercplsupport - ok
09:57:16.0745 1580  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
09:57:16.0745 1580  WerSvc - ok
09:57:16.0776 1580  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
09:57:16.0776 1580  WfpLwf - ok
09:57:16.0776 1580  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
09:57:16.0776 1580  WIMMount - ok
09:57:16.0792 1580  WinDefend - ok
09:57:16.0807 1580  WinHttpAutoProxySvc - ok
09:57:16.0854 1580  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
09:57:16.0854 1580  Winmgmt - ok
09:57:16.0917 1580  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
09:57:16.0932 1580  WinRM - ok
09:57:16.0979 1580  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
09:57:16.0979 1580  Wlansvc - ok
09:57:17.0026 1580  [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
09:57:17.0026 1580  wlcrasvc - ok
09:57:17.0119 1580  [ 2BACD71123F42CEA603F4E205E1AE337 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
09:57:17.0135 1580  wlidsvc - ok
09:57:17.0166 1580  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
09:57:17.0166 1580  WmiAcpi - ok
09:57:17.0197 1580  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
09:57:17.0197 1580  wmiApSrv - ok
09:57:17.0229 1580  WMPNetworkSvc - ok
09:57:17.0260 1580  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
09:57:17.0260 1580  WPCSvc - ok
09:57:17.0260 1580  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
09:57:17.0260 1580  WPDBusEnum - ok
09:57:17.0291 1580  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
09:57:17.0291 1580  ws2ifsl - ok
09:57:17.0307 1580  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
09:57:17.0307 1580  wscsvc - ok
09:57:17.0307 1580  WSearch - ok
09:57:17.0353 1580  [ 9DF12EDBC698B0BC353B3EF84861E430 ] wuauserv        C:\Windows\system32\wuaueng.dll
09:57:17.0385 1580  wuauserv - ok
09:57:17.0416 1580  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
09:57:17.0416 1580  WudfPf - ok
09:57:17.0431 1580  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
09:57:17.0431 1580  WUDFRd - ok
09:57:17.0447 1580  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
09:57:17.0463 1580  wudfsvc - ok
09:57:17.0478 1580  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
09:57:17.0478 1580  WwanSvc - ok
09:57:17.0541 1580  [ A5B25E310678175F4779499FFF7D0994 ] ZAtheros Bt&Wlan Coex Agent C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
09:57:17.0541 1580  ZAtheros Bt&Wlan Coex Agent - ok
09:57:17.0556 1580  ================ Scan global ===============================
09:57:17.0587 1580  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
09:57:17.0603 1580  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
09:57:17.0619 1580  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
09:57:17.0650 1580  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
09:57:17.0665 1580  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
09:57:17.0665 1580  [Global] - ok
09:57:17.0665 1580  ================ Scan MBR ==================================
09:57:17.0681 1580  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
09:57:17.0931 1580  \Device\Harddisk0\DR0 - ok
09:57:17.0931 1580  ================ Scan VBR ==================================
09:57:17.0931 1580  [ 50CF4C218C6EE6E744361D558F4BEE8A ] \Device\Harddisk0\DR0\Partition1
09:57:17.0931 1580  \Device\Harddisk0\DR0\Partition1 - ok
09:57:17.0946 1580  [ 75AEE81E7CF921024854961CBD7B9140 ] \Device\Harddisk0\DR0\Partition2
09:57:17.0946 1580  \Device\Harddisk0\DR0\Partition2 - ok
09:57:17.0946 1580  ============================================================
09:57:17.0946 1580  Scan finished
09:57:17.0946 1580  ============================================================
09:57:17.0962 0636  Detected object count: 0
09:57:17.0962 0636  Actual detected object count: 0
09:57:28.0617 1528  Deinitialize success
DANKE!!!

M-K-D-B 07.10.2012 19:11
Servus,


bitte führe dieses Tool auch im abgesicherten Modus mit Netzwerkunterstützung aus.



Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

edlgrafix 08.10.2012 16:51
Hier das Logfile von Combofix:

Code:
ComboFix 12-10-08.02 - Ana Aimee 10/08/2012  9:43.1.4 - x64 NETWORK
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.1.1033.18.6044.5335 [GMT -6:00]
Running from: c:\users\Ana Aimee\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ijhrohwo.exe
c:\users\Ana Aimee\0.9733233090621961.exe
.
.
(((((((((((((((((((((((((  Files Created from 2012-09-08 to 2012-10-08  )))))))))))))))))))))))))))))))
.
.
2012-10-08 15:47 . 2012-10-08 15:47        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-10-04 19:25 . 2012-10-04 19:25        --------        d-----w-        c:\programdata\xwxzwyecydufcde
2012-09-18 16:28 . 2012-09-18 16:28        --------        d-----w-        c:\program files (x86)\Microsoft Works
2012-09-18 16:26 . 2012-09-18 16:26        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 8
2012-09-18 16:25 . 2012-09-18 16:30        --------        d-----w-        c:\programdata\Microsoft Help
2012-09-18 16:24 . 2012-09-18 16:24        --------        d-----r-        C:\MSOCache
2012-09-18 16:23 . 2011-12-07 17:32        216064        ----a-w-        c:\windows\SysWow64\lagarith.dll
2012-09-18 16:23 . 2011-06-24 14:44        243200        ----a-w-        c:\windows\SysWow64\xvidvfw.dll
2012-09-18 16:23 . 2011-06-24 14:28        650752        ----a-w-        c:\windows\SysWow64\xvidcore.dll
2012-09-18 16:23 . 2012-06-09 17:21        178688        ----a-w-        c:\windows\SysWow64\unrar.dll
2012-09-18 16:23 . 2011-12-21 17:14        151552        ----a-w-        c:\windows\SysWow64\ac3acm.acm
2012-09-18 16:23 . 2012-08-17 18:00        112640        ----a-w-        c:\windows\SysWow64\ff_vfw.dll
2012-09-18 16:23 . 2012-09-18 16:23        --------        d-----w-        c:\program files (x86)\K-Lite Codec Pack
2012-09-18 04:30 . 2012-09-18 04:30        --------        d-----w-        c:\programdata\CyberLink
2012-09-18 04:25 . 2012-09-18 04:25        --------        d-----w-        c:\program files (x86)\Avira
2012-09-18 04:11 . 2012-09-18 04:11        --------        d-----w-        c:\windows\SysWow64\VAIO Startup Setting Tool
2012-09-18 04:08 . 2012-10-08 15:46        --------        d-----w-        c:\users\Ana Aimee
.
.
.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-01 02:33 . 2012-04-27 13:34        73136        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-01 02:33 . 2012-04-27 13:34        696240        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-18 04:09 . 2011-03-29 01:36        19720        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-22 291608]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-09-20 60552]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe" [2012-02-21 693608]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2012-02-23 106144]
R2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-07-13 249648]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592]
R2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-02-08 2429544]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-02-03 628448]
R2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-03-13 128280]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-03-13 161560]
R2 Oasis2Service;Oasis2Service;c:\program files (x86)\DDNi\Oasis2Service\Oasis2Service.exe [2011-12-05 51200]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [2012-02-21 473960]
R2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-12-01 260768]
R2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2011-02-23 105024]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-03-13 363800]
R2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2012-03-26 978056]
R2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2012-02-24 158880]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-01 250288]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2012-02-23 36000]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys [2012-02-23 51872]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-09-15 195320]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2012-02-23 339616]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2012-02-23 110752]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\drivers\btath_hcrp.sys [2012-02-23 167584]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2012-02-24 68256]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\drivers\btath_rcp.sys [2012-02-24 280992]
R3 BTATH_VDP;Bluetooth VDP Driver;c:\windows\system32\drivers\btath_vdp.sys [2012-02-24 421664]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2012-02-24 550560]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-03-14 274200]
R3 DCDhcpService;DCDhcpService;c:\program files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [2012-03-22 112256]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2012-03-14 331264]
R3 lehidmini;Bluetooth Low Energy Hid Device;c:\windows\system32\drivers\leath_hid.sys [2012-02-24 36128]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2012-02-08 339048]
R3 SmbDrv;SmbDrv;c:\windows\system32\drivers\Smb_driver.sys [2012-03-13 21264]
R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2012-01-06 138392]
R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2012-01-06 74904]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-12-01 289952]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2012-01-10 535688]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-12-29 960160]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-12-21 550128]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2011-12-21 382720]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-08-27 101600]
R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2012-01-20 54432]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys [2012-02-22 16152]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\drivers\btath_bus.sys [2012-02-23 30368]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\drivers\iusb3hub.sys [2012-02-22 356120]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys [2012-02-22 787736]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\drivers\HECIx64.sys [2012-03-13 60184]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-02-13 675432]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2012-01-16 14336]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-27 02:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-03-13 1156712]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2012-02-23 1020576]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2012-02-23 800416]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-14 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-14 398104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-14 440600]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com.gt/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 195.58.160.194 195.58.161.122
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-ijhrohwoykdolll - c:\programdata\ijhrohwo.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"&_\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\%C3 &_ Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-10-08  09:48:36
ComboFix-quarantined-files.txt  2012-10-08 15:48
.
Pre-Run: 573,917,343,744 bytes free
Post-Run: 573,884,182,528 bytes free
.
- - End Of File - - EDE9700DCE321FCEE4CE25C4C44C60BF
Danke!

M-K-D-B 08.10.2012 18:29
Servus,



So, und jetzt im normalen Modus folgendes:



Hinweis für Mitleser:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm vom folgenden Download-Spiegel neu herunter:
BleepingComputer.com
und speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!

Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK

Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
Code:
Folder::
c:\programdata\xwxzwyecydufcde
Speichere dies als CFScript.txt auf Deinem Desktop.

Wichtig:
  • Stelle deine Anti Viren Software temprär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein.
    Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Schließe alle laufenden Programme. Gehe sicher das ComboFix ungehindert arbeiten kann.
  • Mache nichts am PC solange ComboFix läuft.
http://i266.photobucket.com/albums/i.../CFScriptB.gif
  • In Bezug auf obiges Bild, ziehe CFScript.txt in die ComboFix.exe
  • Wenn ComboFix fertig ist, wird es ein Log erstellen, C:\ComboFix.txt. Bitte füge es hier als Antwort ein.
Falls im Skript die Anweisung Suspect:: oder Collect:: enthalten ist, wird eine Message-Box erscheinen, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen.

edlgrafix 08.10.2012 20:20
Hier das Logfile:

Code:
ComboFix 12-10-08.03 - Ana Aimee 10/08/2012  13:11:04.2.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.1.1033.18.6044.4379 [GMT -6:00]
Running from: c:\users\Ana Aimee\Desktop\ComboFix.exe
Command switches used :: c:\users\Ana Aimee\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\xwxzwyecydufcde
c:\programdata\xwxzwyecydufcde\at-flag.png
c:\programdata\xwxzwyecydufcde\at-image.png
c:\programdata\xwxzwyecydufcde\btn-green.png
c:\programdata\xwxzwyecydufcde\corners-btn.png
c:\programdata\xwxzwyecydufcde\corners1.png
c:\programdata\xwxzwyecydufcde\corners2.png
c:\programdata\xwxzwyecydufcde\corners3.png
c:\programdata\xwxzwyecydufcde\corners4.png
c:\programdata\xwxzwyecydufcde\ie6-7.css
c:\programdata\xwxzwyecydufcde\jquery.main.js
c:\programdata\xwxzwyecydufcde\main.html
c:\programdata\xwxzwyecydufcde\McAfee.png
c:\programdata\xwxzwyecydufcde\pay17.png
c:\programdata\xwxzwyecydufcde\steps-de.png
c:\programdata\xwxzwyecydufcde\steps-en.png
c:\programdata\xwxzwyecydufcde\style.css
c:\programdata\xwxzwyecydufcde\tabs.png
c:\programdata\xwxzwyecydufcde\wait.html
.
.
(((((((((((((((((((((((((  Files Created from 2012-09-08 to 2012-10-08  )))))))))))))))))))))))))))))))
.
.
2012-10-08 19:15 . 2012-10-08 19:15        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-09-18 16:28 . 2012-09-18 16:28        --------        d-----w-        c:\program files (x86)\Microsoft Works
2012-09-18 16:26 . 2012-09-18 16:26        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 8
2012-09-18 16:25 . 2012-09-18 16:30        --------        d-----w-        c:\programdata\Microsoft Help
2012-09-18 16:24 . 2012-09-18 16:24        --------        d-----r-        C:\MSOCache
2012-09-18 16:23 . 2011-12-07 17:32        216064        ----a-w-        c:\windows\SysWow64\lagarith.dll
2012-09-18 16:23 . 2011-06-24 14:44        243200        ----a-w-        c:\windows\SysWow64\xvidvfw.dll
2012-09-18 16:23 . 2011-06-24 14:28        650752        ----a-w-        c:\windows\SysWow64\xvidcore.dll
2012-09-18 16:23 . 2012-06-09 17:21        178688        ----a-w-        c:\windows\SysWow64\unrar.dll
2012-09-18 16:23 . 2011-12-21 17:14        151552        ----a-w-        c:\windows\SysWow64\ac3acm.acm
2012-09-18 16:23 . 2012-08-17 18:00        112640        ----a-w-        c:\windows\SysWow64\ff_vfw.dll
2012-09-18 16:23 . 2012-09-18 16:23        --------        d-----w-        c:\program files (x86)\K-Lite Codec Pack
2012-09-18 04:30 . 2012-09-18 04:30        --------        d-----w-        c:\programdata\CyberLink
2012-09-18 04:11 . 2012-09-18 04:11        --------        d-----w-        c:\windows\SysWow64\VAIO Startup Setting Tool
2012-09-18 04:08 . 2012-10-08 15:46        --------        d-----w-        c:\users\Ana Aimee
.
.
.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-01 02:33 . 2012-04-27 13:34        73136        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-01 02:33 . 2012-04-27 13:34        696240        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-09-18 04:09 . 2011-03-29 01:36        19720        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-22 291608]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-09-20 60552]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe" [2012-02-21 693608]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-01 250288]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2012-02-23 36000]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys [2012-02-23 51872]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2012-02-23 339616]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2012-02-23 110752]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\drivers\btath_hcrp.sys [2012-02-23 167584]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2012-02-24 68256]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\drivers\btath_rcp.sys [2012-02-24 280992]
R3 BTATH_VDP;Bluetooth VDP Driver;c:\windows\system32\drivers\btath_vdp.sys [2012-02-24 421664]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2012-02-24 550560]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-03-14 274200]
R3 DCDhcpService;DCDhcpService;c:\program files\Sony\VAIO Smart Network\WFDA\DCDhcpService.exe [2012-03-22 112256]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys [2009-06-10 281088]
R3 lehidmini;Bluetooth Low Energy Hid Device;c:\windows\system32\drivers\leath_hid.sys [2012-02-24 36128]
R3 SmbDrv;SmbDrv;c:\windows\system32\drivers\Smb_driver.sys [2012-03-13 21264]
R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2012-01-06 138392]
R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2012-01-06 74904]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-12-01 289952]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2012-01-10 535688]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-12-29 960160]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-12-21 550128]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2011-12-21 382720]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-08-27 101600]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys [2012-02-22 16152]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2012-02-23 106144]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-07-13 249648]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-02-08 2429544]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-02-03 628448]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-03-13 128280]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-03-13 161560]
S2 Oasis2Service;Oasis2Service;c:\program files (x86)\DDNi\Oasis2Service\Oasis2Service.exe [2011-12-05 51200]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [2012-02-21 473960]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-12-01 260768]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2011-02-23 105024]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-03-13 363800]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2012-03-26 978056]
S2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2012-02-24 158880]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2009-05-26 19968]
S3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-09-15 195320]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\drivers\btath_bus.sys [2012-02-23 30368]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2012-03-14 331264]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\drivers\iusb3hub.sys [2012-02-22 356120]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys [2012-02-22 787736]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\drivers\HECIx64.sys [2012-03-13 60184]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2012-02-08 339048]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-02-13 675432]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2012-01-16 14336]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2012-01-20 54432]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-10-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-27 02:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-03-13 1156712]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2012-02-23 1020576]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2012-02-23 800416]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-14 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-14 398104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-14 440600]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com.gt/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1 195.58.160.194 195.58.161.122
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"&_\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\%C3 &_ Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_278.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-10-08  13:16:29
ComboFix-quarantined-files.txt  2012-10-08 19:16
ComboFix2.txt  2012-10-08 15:48
.
Pre-Run: 573,924,188,160 bytes free
Post-Run: 573,861,498,880 bytes free
.
- - End Of File - - D61381D90BFD59ED608C57AD4BD022CB
Danke!

M-K-D-B 09.10.2012 09:30
Servus,


sieht schon besser aus. :)

Bevor wir weitermachen:

Wie läuft dein Rechner derzeit?
Gibt es noch irgendwelche Prbleme? Wenn ja, welche?

edlgrafix 09.10.2012 09:37
Ja, super! Danke!
Nein, mir sind keine Probleme aufgefallen, hab aber jetzt auch noch nicht damit gearbeitet, nur gestern Combofix laufen lassen, aber es hat alles so weit normal funktioniert!

M-K-D-B 09.10.2012 13:27
Servus,



Schritt 1
Downloade Dir bitte Malwarebytes
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.





Schritt 2

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset







Schritt 3
Downloade Dir bitte SecurityCheck
  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Wenn der Scan beendet wurde sollte sich ein Textdokument ( checkup.txt ) öffnen.
Poste den Inhalt bitte hier.





Bitte poste mit deiner nächsten Antwort
  • die Logdatei von MBAM,
  • die Logdatei von ESET,
  • die Logdatei von SecurityCheck.

edlgrafix 09.10.2012 20:00
Hier die Log files:
Malware byte:
Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.10.09.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Ana Aimee :: ANAAIMEE-VAIO [Administrator]

10/9/2012 9:54:26 AM
mbam-log-2012-10-09 (09-54-26).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 204172
Laufzeit: 2 Minute(n), 27 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Eset:
Code:
C:\Qoobox\Quarantine\C\ProgramData\ijhrohwo.exe.vir        Win32/Weelsof.B trojan        cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\ProgramData\xwxzwyecydufcde\main.html.vir        HTML/Ransom.B trojan        cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Ana Aimee\0.9733233090621961.exe.vir        Win32/Weelsof.B trojan        cleaned by deleting - quarantined
Checkup:
Code:
Results of screen317's Security Check version 0.99.51 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled! 
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.65.0.1400 
 Java(TM) 7 Update 1 
 Java version out of Date!
 Adobe Flash Player 11.4.402.287 
````````Process Check: objlist.exe by Laurent```````` 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````
DANKE!

M-K-D-B 09.10.2012 20:08
Servus,



Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

Hast du kürzlich dein AntiViren Programm deinstalliert? Wenn ja, bitte installiere ein neues Programm. Zu Beginn war AntiVir noch installiert, aber das sehe ich jetzt nicht mehr.



Schritt 1
Ich sehe in den Logfiles keine laufende Anti Viren Software.

Das ist gefährlich. Manchmal bemerkt man Malware durch PopUps oder Google-Umleitungen etc, aber meisten läuft diese unbemerkt im Hintergrund. Ein AVP kann Dir helfen, Malware zu finden. Bitte downloade und Installiere Dir eines der folgenden AVPs.




Schritt 2
Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 7 ) herunter laden.
  • Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
  • Klicke erneut OK.





Schritt 3
Starte DeFogger und klicke auf Re-enable.
Gegebenenfalls muss dein Rechner neu gestartet werden.





Schritt 4
Ich würde dir empfehlen, 1 mal pro Woche auch mit diesem Scanner dein System zu prüfen.
Möchtest Du ESET denoch deinstallieren,
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.
Code:
"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\OnlineScannerUninstaller.exe"
und drücke OK.





Schritt 5
Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.
Code:
Combofix /Uninstall
http://larusso.trojaner-board.de/Images/CFuninstall.jpg

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.





Schritt 6
Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.





Schritt 7
Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.



Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich diesen Thread aus meinen Abos löschen kann.

edlgrafix 10.10.2012 18:30
Super, vielen Dank!!!!
Ich habe Avira deinstalliert, weil ich es nicht temporaer abschalten konnte - es war abgeschaltet, trotzdem kam eine Meldung, dass es eingeschaltet ist.
Ist Avast besser als Avira, empfiehlst du das eher (ich habe jetzt Avast installiert)

M-K-D-B 10.10.2012 19:00
Servus,


ich empfehle Avast oder MSE.
Avira kann ich nicht mehr empfehlen, seitdem dabei die unnütze Ask-Toolbar mit installiert wird.

Wichtiger als ein AV Programm ist den eigenen Computer alias Gehirn beim Surfen zu benutzen. ;)



Ich bin froh, dass wir helfen konnten :abklatsch:

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:00 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131