Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Skype-Trojaner (https://www.trojaner-board.de/127092-skype-trojaner.html)

Theta 16.11.2012 14:05
Skype-Trojaner
 
Ich hab mir den Skype-Trojaner eingefangen:
Ich habe folgende Nachricht erhalten und geöffnet (auch das exe file):

Code:
moin, kaum zu glauben was für schöne fotos von dir auf deinem profil? hxxp://goo.gl/gdASg?img=eva.kalvoda
Dann habe ich mit File assasin nach der anleitung von folgendem Link das .exe file unter C:\Users\tamim\AppData\Roaming gelöscht. hxxp://www.computerhilfen.de/news/skype-virus-hallo-sag-mal-ehrlich-sind-das-deine-fotos-101856.html

Kasperski hat folgende Files beim hochstarten automatisch gelöscht:
Code:
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: F:\urDrive.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: F:\Modellbildung UE.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: F:\client.xp.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: F:\Modellbildung VO.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: F:\Tagungen.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: F:\03 presentations.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: F:\04 ReDrop.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: I:\$RECYCLE.BIN.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: I:\2012 11 15 Video.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: I:\Sicherung 25.Mai2012.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: I:\Sicherung 4.November 2012.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: I:\Sicherung ALT.lnk        ICVT09\efa        localhost
gelöscht: Virus Worm.Win32.AutoRun.hxw        Die Datei: I:\System Volume Information.lnk        ICVT09\efa        localhost
Ich hab jetzt einen Voll-Scan mit Malwarebytes Anti-Malware laufen lassen. Wie es aussieht ist auf der externen Festplatte und dem usb-stick noch etwas.
Code:
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.16.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
efa :: ICVT09 [Administrator]

16.11.2012 12:38:02
mbam-log-2012-11-16 (13-58-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 693239
Laufzeit: 1 Stunde(n), 19 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
F:\RECYCLER\e621ca05.exe (Trojan.Ransom) -> Keine Aktion durchgeführt.
I:\RECYCLER\e621ca05.exe (Trojan.Ransom) -> Keine Aktion durchgeführt.
I:\Sicherung 4.November 2012\Uni\Material Science\CloneDVD.exe (PUP.AdBundler) -> Keine Aktion durchgeführt.
I:\Sicherung ALT\Uni\Material Science\CloneDVD.exe (PUP.AdBundler) -> Keine Aktion durchgeführt.

(Ende)
Was mache ich jetzt mit den e621ca05.exe files?

cosinus 18.11.2012 00:36
Hallo und :hallo:

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehlalarm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

Theta 19.11.2012 11:54
Danke für die Antwort!!

aswMBR.exe hat nach Neustart und auswählen von "AV scan" (none) folgendes txt-File ausgegeben:
Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-19 11:45:17
-----------------------------
11:45:17.847    OS Version: Windows x64 6.1.7601 Service Pack 1
11:45:17.847    Number of processors: 4 586 0x3A09
11:45:17.847    ComputerName: ****  UserName: ***
11:45:18.327    Initialize success
11:45:22.919    AVAST engine defs: 12111900
11:45:26.460    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
11:45:26.460    Disk 0 Vendor: ST500DM002-1BD142 HP73 Size: 476940MB BusType: 11
11:45:26.491    Disk 0 MBR read successfully
11:45:26.491    Disk 0 MBR scan
11:45:26.491    Disk 0 Windows 7 default MBR code
11:45:26.507    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
11:45:26.507    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      176838 MB offset 206848
11:45:26.523    Disk 0 scanning C:\Windows\system32\drivers
11:45:35.929    Service scanning
11:45:55.585    Modules scanning
11:45:55.585    Disk 0 trace - called modules:
11:45:55.648    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
11:45:55.663    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800d7a6060]
11:45:56.163    3 CLASSPNP.SYS[fffff88001bba43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800d1bc550]
11:45:56.163    Scan finished successfully
11:46:10.234    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"
11:46:10.234    The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt"
Der TDSS-Killer hat folgenden report ausgegeben:
Code:
11:47:45.0083 6904  TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
11:47:45.0317 6904  ============================================================
11:47:45.0317 6904  Current date / time: 2012/11/19 11:47:45.0317
11:47:45.0317 6904  SystemInfo:
11:47:45.0317 6904 
11:47:45.0317 6904  OS Version: 6.1.7601 ServicePack: 1.0
11:47:45.0317 6904  Product type: Workstation
11:47:45.0317 6904  ComputerName: ****
11:47:45.0317 6904  UserName: ***
11:47:45.0317 6904  Windows directory: C:\Windows
11:47:45.0317 6904  System windows directory: C:\Windows
11:47:45.0317 6904  Running under WOW64
11:47:45.0317 6904  Processor architecture: Intel x64
11:47:45.0317 6904  Number of processors: 4
11:47:45.0317 6904  Page size: 0x1000
11:47:45.0317 6904  Boot type: Normal boot
11:47:45.0317 6904  ============================================================
11:47:45.0910 6904  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
11:47:45.0925 6904  ============================================================
11:47:45.0925 6904  \Device\Harddisk0\DR0:
11:47:45.0925 6904  MBR partitions:
11:47:45.0925 6904  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
11:47:45.0925 6904  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x15963000
11:47:45.0925 6904  ============================================================
11:47:45.0972 6904  C: <-> \Device\Harddisk0\DR0\Partition2
11:47:45.0972 6904  ============================================================
11:47:45.0972 6904  Initialize success
11:47:45.0972 6904  ============================================================
11:48:03.0694 1240  ============================================================
11:48:03.0694 1240  Scan started
11:48:03.0694 1240  Mode: Manual; SigCheck; TDLFS;
11:48:03.0694 1240  ============================================================
11:48:04.0037 1240  ================ Scan system memory ========================
11:48:04.0037 1240  System memory - ok
11:48:04.0037 1240  ================ Scan services =============================
11:48:04.0333 1240  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
11:48:04.0411 1240  1394ohci - ok
11:48:04.0427 1240  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
11:48:04.0443 1240  ACPI - ok
11:48:04.0443 1240  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
11:48:04.0458 1240  AcpiPmi - ok
11:48:04.0552 1240  [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
11:48:04.0567 1240  AdobeARMservice - ok
11:48:04.0645 1240  [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
11:48:04.0661 1240  AdobeFlashPlayerUpdateSvc - ok
11:48:04.0692 1240  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
11:48:04.0723 1240  adp94xx - ok
11:48:04.0739 1240  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
11:48:04.0755 1240  adpahci - ok
11:48:04.0755 1240  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
11:48:04.0770 1240  adpu320 - ok
11:48:04.0786 1240  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
11:48:04.0817 1240  AeLookupSvc - ok
11:48:04.0879 1240  [ D1E343BC00136CE03C4D403194D06A80 ] AERTFilters    C:\Program Files\Realtek\Audio\HDA\AERTSr64.EXE
11:48:04.0895 1240  AERTFilters - ok
11:48:04.0942 1240  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
11:48:04.0973 1240  AFD - ok
11:48:04.0989 1240  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
11:48:05.0004 1240  agp440 - ok
11:48:05.0020 1240  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
11:48:05.0035 1240  ALG - ok
11:48:05.0051 1240  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
11:48:05.0067 1240  aliide - ok
11:48:05.0067 1240  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
11:48:05.0082 1240  amdide - ok
11:48:05.0098 1240  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
11:48:05.0113 1240  AmdK8 - ok
11:48:05.0113 1240  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
11:48:05.0145 1240  AmdPPM - ok
11:48:05.0176 1240  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
11:48:05.0191 1240  amdsata - ok
11:48:05.0191 1240  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
11:48:05.0207 1240  amdsbs - ok
11:48:05.0223 1240  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
11:48:05.0223 1240  amdxata - ok
11:48:05.0238 1240  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
11:48:05.0269 1240  AppID - ok
11:48:05.0285 1240  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
11:48:05.0301 1240  AppIDSvc - ok
11:48:05.0316 1240  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
11:48:05.0347 1240  Appinfo - ok
11:48:05.0347 1240  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt        C:\Windows\System32\appmgmts.dll
11:48:05.0363 1240  AppMgmt - ok
11:48:05.0394 1240  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\drivers\arc.sys
11:48:05.0410 1240  arc - ok
11:48:05.0410 1240  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
11:48:05.0410 1240  arcsas - ok
11:48:05.0519 1240  [ D6153F483ECEACDEB4F11E8C0CCD7C31 ] Aspen Remote Simulation Service V7.2 C:\Program Files (x86)\AspenTech\Aspen Remote Simulation Service V7.2\AspenTech.AspenCxs.RemotingSvc.exe
11:48:05.0519 1240  Aspen Remote Simulation Service V7.2 ( UnsignedFile.Multi.Generic ) - warning
11:48:05.0519 1240  Aspen Remote Simulation Service V7.2 - detected UnsignedFile.Multi.Generic (1)
11:48:05.0535 1240  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
11:48:05.0581 1240  AsyncMac - ok
11:48:05.0597 1240  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
11:48:05.0613 1240  atapi - ok
11:48:05.0644 1240  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:48:05.0691 1240  AudioEndpointBuilder - ok
11:48:05.0706 1240  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
11:48:05.0722 1240  AudioSrv - ok
11:48:05.0784 1240  [ 5E3F0AAEA4642BF184DEEA311C7201DE ] AVP            C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe
11:48:05.0815 1240  AVP - ok
11:48:05.0831 1240  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
11:48:05.0862 1240  AxInstSV - ok
11:48:05.0878 1240  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
11:48:05.0893 1240  b06bdrv - ok
11:48:05.0925 1240  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
11:48:05.0940 1240  b57nd60a - ok
11:48:05.0971 1240  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
11:48:06.0003 1240  BDESVC - ok
11:48:06.0018 1240  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
11:48:06.0049 1240  Beep - ok
11:48:06.0065 1240  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
11:48:06.0096 1240  BFE - ok
11:48:06.0143 1240  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
11:48:06.0221 1240  BITS - ok
11:48:06.0252 1240  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
11:48:06.0268 1240  blbdrive - ok
11:48:06.0299 1240  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
11:48:06.0315 1240  bowser - ok
11:48:06.0330 1240  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
11:48:06.0377 1240  BrFiltLo - ok
11:48:06.0377 1240  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
11:48:06.0393 1240  BrFiltUp - ok
11:48:06.0439 1240  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
11:48:06.0455 1240  Browser - ok
11:48:06.0455 1240  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
11:48:06.0486 1240  Brserid - ok
11:48:06.0502 1240  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
11:48:06.0517 1240  BrSerWdm - ok
11:48:06.0517 1240  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
11:48:06.0549 1240  BrUsbMdm - ok
11:48:06.0549 1240  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
11:48:06.0564 1240  BrUsbSer - ok
11:48:06.0564 1240  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
11:48:06.0580 1240  BTHMODEM - ok
11:48:06.0595 1240  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
11:48:06.0627 1240  bthserv - ok
11:48:06.0642 1240  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
11:48:06.0673 1240  cdfs - ok
11:48:06.0689 1240  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
11:48:06.0705 1240  cdrom - ok
11:48:06.0720 1240  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
11:48:06.0751 1240  CertPropSvc - ok
11:48:06.0751 1240  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
11:48:06.0767 1240  circlass - ok
11:48:06.0783 1240  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
11:48:06.0783 1240  CLFS - ok
11:48:06.0845 1240  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:48:06.0861 1240  clr_optimization_v2.0.50727_32 - ok
11:48:06.0876 1240  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
11:48:06.0892 1240  clr_optimization_v2.0.50727_64 - ok
11:48:06.0970 1240  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:48:06.0985 1240  clr_optimization_v4.0.30319_32 - ok
11:48:07.0001 1240  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
11:48:07.0017 1240  clr_optimization_v4.0.30319_64 - ok
11:48:07.0048 1240  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
11:48:07.0063 1240  CmBatt - ok
11:48:07.0079 1240  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
11:48:07.0095 1240  cmdide - ok
11:48:07.0141 1240  [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG            C:\Windows\system32\Drivers\cng.sys
11:48:07.0173 1240  CNG - ok
11:48:07.0188 1240  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
11:48:07.0188 1240  Compbatt - ok
11:48:07.0219 1240  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
11:48:07.0235 1240  CompositeBus - ok
11:48:07.0235 1240  COMSysApp - ok
11:48:07.0297 1240  [ D2922F17645DE78906BE7880F59914E4 ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
11:48:07.0313 1240  cphs - ok
11:48:07.0313 1240  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
11:48:07.0329 1240  crcdisk - ok
11:48:07.0375 1240  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll
11:48:07.0407 1240  CryptSvc - ok
11:48:07.0422 1240  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC            C:\Windows\system32\drivers\csc.sys
11:48:07.0453 1240  CSC - ok
11:48:07.0485 1240  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll
11:48:07.0516 1240  CscService - ok
11:48:07.0531 1240  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
11:48:07.0594 1240  DcomLaunch - ok
11:48:07.0609 1240  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
11:48:07.0641 1240  defragsvc - ok
11:48:07.0656 1240  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
11:48:07.0672 1240  DfsC - ok
11:48:07.0703 1240  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
11:48:07.0734 1240  Dhcp - ok
11:48:07.0750 1240  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
11:48:07.0797 1240  discache - ok
11:48:07.0828 1240  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
11:48:07.0843 1240  Disk - ok
11:48:07.0843 1240  [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc          C:\Windows\system32\drivers\dmvsc.sys
11:48:07.0859 1240  dmvsc - ok
11:48:07.0890 1240  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
11:48:07.0906 1240  Dnscache - ok
11:48:07.0937 1240  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
11:48:07.0984 1240  dot3svc - ok
11:48:07.0984 1240  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
11:48:08.0015 1240  DPS - ok
11:48:08.0031 1240  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
11:48:08.0062 1240  drmkaud - ok
11:48:08.0093 1240  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
11:48:08.0124 1240  DXGKrnl - ok
11:48:08.0311 1240  [ 03F4C5C12FC1C69F838DA723475EF650 ] e1cexpress      C:\Windows\system32\DRIVERS\e1c62x64.sys
11:48:08.0327 1240  e1cexpress - ok
11:48:08.0374 1240  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
11:48:08.0405 1240  EapHost - ok
11:48:08.0499 1240  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\drivers\evbda.sys
11:48:08.0561 1240  ebdrv - ok
11:48:08.0608 1240  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
11:48:08.0623 1240  EFS - ok
11:48:08.0670 1240  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
11:48:08.0717 1240  ehRecvr - ok
11:48:08.0717 1240  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
11:48:08.0733 1240  ehSched - ok
11:48:08.0764 1240  [ 9A47AC3DFCF81D30922CDAAF1C2D579F ] ElbyCDIO        C:\Windows\system32\Drivers\ElbyCDIO.sys
11:48:08.0779 1240  ElbyCDIO - ok
11:48:08.0811 1240  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
11:48:08.0842 1240  elxstor - ok
11:48:08.0842 1240  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
11:48:08.0857 1240  ErrDev - ok
11:48:08.0889 1240  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
11:48:08.0951 1240  EventSystem - ok
11:48:08.0967 1240  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
11:48:08.0998 1240  exfat - ok
11:48:09.0013 1240  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
11:48:09.0045 1240  fastfat - ok
11:48:09.0060 1240  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
11:48:09.0091 1240  Fax - ok
11:48:09.0091 1240  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\drivers\fdc.sys
11:48:09.0107 1240  fdc - ok
11:48:09.0123 1240  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
11:48:09.0138 1240  fdPHost - ok
11:48:09.0154 1240  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
11:48:09.0169 1240  FDResPub - ok
11:48:09.0185 1240  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
11:48:09.0201 1240  FileInfo - ok
11:48:09.0201 1240  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
11:48:09.0232 1240  Filetrace - ok
11:48:09.0232 1240  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
11:48:09.0247 1240  flpydisk - ok
11:48:09.0263 1240  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
11:48:09.0263 1240  FltMgr - ok
11:48:09.0310 1240  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
11:48:09.0357 1240  FontCache - ok
11:48:09.0419 1240  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
11:48:09.0419 1240  FontCache3.0.0.0 - ok
11:48:09.0450 1240  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
11:48:09.0466 1240  FsDepends - ok
11:48:09.0481 1240  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
11:48:09.0497 1240  Fs_Rec - ok
11:48:09.0513 1240  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
11:48:09.0528 1240  fvevol - ok
11:48:09.0544 1240  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
11:48:09.0559 1240  gagp30kx - ok
11:48:09.0575 1240  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
11:48:09.0606 1240  gpsvc - ok
11:48:09.0622 1240  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
11:48:09.0637 1240  hcw85cir - ok
11:48:09.0669 1240  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
11:48:09.0700 1240  HdAudAddService - ok
11:48:09.0715 1240  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
11:48:09.0747 1240  HDAudBus - ok
11:48:09.0747 1240  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
11:48:09.0762 1240  HidBatt - ok
11:48:09.0762 1240  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
11:48:09.0778 1240  HidBth - ok
11:48:09.0793 1240  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\drivers\hidir.sys
11:48:09.0809 1240  HidIr - ok
11:48:09.0825 1240  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
11:48:09.0856 1240  hidserv - ok
11:48:09.0887 1240  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
11:48:09.0903 1240  HidUsb - ok
11:48:09.0903 1240  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
11:48:09.0934 1240  hkmsvc - ok
11:48:09.0949 1240  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
11:48:09.0965 1240  HomeGroupListener - ok
11:48:09.0996 1240  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
11:48:10.0027 1240  HomeGroupProvider - ok
11:48:10.0027 1240  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
11:48:10.0043 1240  HpSAMD - ok
11:48:10.0074 1240  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
11:48:10.0121 1240  HTTP - ok
11:48:10.0137 1240  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
11:48:10.0137 1240  hwpolicy - ok
11:48:10.0137 1240  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
11:48:10.0152 1240  i8042prt - ok
11:48:10.0199 1240  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
11:48:10.0215 1240  iaStorV - ok
11:48:10.0308 1240  [ DAF66902F08796F9C694901660E5A64A ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
11:48:10.0308 1240  IDriverT ( UnsignedFile.Multi.Generic ) - warning
11:48:10.0308 1240  IDriverT - detected UnsignedFile.Multi.Generic (1)
11:48:10.0355 1240  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
11:48:10.0386 1240  idsvc - ok
11:48:10.0589 1240  [ 3FB253E8059A1AAC3A8B83A31D094CC5 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
11:48:10.0823 1240  igfx - ok
11:48:10.0839 1240  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
11:48:10.0854 1240  iirsp - ok
11:48:10.0885 1240  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
11:48:10.0932 1240  IKEEXT - ok
11:48:11.0010 1240  [ 9CC645EB9697AA4F2D5A39835C80A0A2 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
11:48:11.0057 1240  IntcAzAudAddService - ok
11:48:11.0104 1240  [ 6C9FFFECA9FED31347D211C5D1FFBD2D ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
11:48:11.0135 1240  IntcDAud - ok
11:48:11.0244 1240  [ B353F1834FCD36D77BE3F74992C147D4 ] Intel(R) Capability Licensing Service Interface c:\Program Files\Intel\iCLS Client\HeciServer.exe
11:48:11.0275 1240  Intel(R) Capability Licensing Service Interface - ok
11:48:11.0307 1240  [ 4A9EB8AC8959C580ADCADDBDBBEBE033 ] Intel(R) PROSet Monitoring Service C:\Windows\system32\IProsetMonitor.exe
11:48:11.0322 1240  Intel(R) PROSet Monitoring Service - ok
11:48:11.0338 1240  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
11:48:11.0338 1240  intelide - ok
11:48:11.0353 1240  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
11:48:11.0385 1240  intelppm - ok
11:48:11.0400 1240  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
11:48:11.0431 1240  IPBusEnum - ok
11:48:11.0431 1240  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:48:11.0463 1240  IpFilterDriver - ok
11:48:11.0494 1240  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
11:48:11.0541 1240  iphlpsvc - ok
11:48:11.0541 1240  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
11:48:11.0556 1240  IPMIDRV - ok
11:48:11.0572 1240  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
11:48:11.0603 1240  IPNAT - ok
11:48:11.0619 1240  [ 7BEF7A76B13D38658CBC8D5D8425C384 ] iprntsrv        C:\Windows\system32\iprntsrv.exe
11:48:11.0634 1240  iprntsrv ( UnsignedFile.Multi.Generic ) - warning
11:48:11.0634 1240  iprntsrv - detected UnsignedFile.Multi.Generic (1)
11:48:11.0650 1240  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
11:48:11.0681 1240  IRENUM - ok
11:48:11.0697 1240  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
11:48:11.0697 1240  isapnp - ok
11:48:11.0712 1240  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
11:48:11.0728 1240  iScsiPrt - ok
11:48:11.0759 1240  [ 6BCEF45131C8B8E1C558BE540B190B3C ] iusb3hcs        C:\Windows\system32\DRIVERS\iusb3hcs.sys
11:48:11.0775 1240  iusb3hcs - ok
11:48:11.0790 1240  [ F080EADA8715F811B58BD35BB774F2F9 ] iusb3hub        C:\Windows\system32\DRIVERS\iusb3hub.sys
11:48:11.0806 1240  iusb3hub - ok
11:48:11.0821 1240  [ 0F1756D9396740F053221FA6260FCE66 ] iusb3xhc        C:\Windows\system32\DRIVERS\iusb3xhc.sys
11:48:11.0837 1240  iusb3xhc - ok
11:48:11.0931 1240  [ 5B7DE9D87B9D2713BDD6A53678DC2A49 ] jhi_service    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
11:48:11.0946 1240  jhi_service - ok
11:48:11.0977 1240  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
11:48:11.0993 1240  kbdclass - ok
11:48:11.0993 1240  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
11:48:12.0024 1240  kbdhid - ok
11:48:12.0040 1240  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
11:48:12.0055 1240  KeyIso - ok
11:48:12.0087 1240  [ 5D470398AA182E502C520E48E7A09FA5 ] kl1            C:\Windows\system32\DRIVERS\kl1.sys
11:48:12.0102 1240  kl1 - ok
11:48:12.0149 1240  [ E03C26D496AA103856B3439F43085A35 ] KLIF            C:\Windows\system32\DRIVERS\klif.sys
11:48:12.0165 1240  KLIF - ok
11:48:12.0211 1240  [ B86A7B6A99AE9738ABC299BB4E8D26D7 ] klnagent        C:\Program Files (x86)\Kaspersky Lab\NetworkAgent 8\klnagent.exe
11:48:12.0227 1240  klnagent - ok
11:48:12.0243 1240  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
11:48:12.0258 1240  KSecDD - ok
11:48:12.0305 1240  [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
11:48:12.0321 1240  KSecPkg - ok
11:48:12.0352 1240  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
11:48:12.0399 1240  ksthunk - ok
11:48:12.0414 1240  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
11:48:12.0445 1240  KtmRm - ok
11:48:12.0492 1240  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
11:48:12.0523 1240  LanmanServer - ok
11:48:12.0539 1240  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:48:12.0570 1240  LanmanWorkstation - ok
11:48:12.0586 1240  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
11:48:12.0617 1240  lltdio - ok
11:48:12.0617 1240  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
11:48:12.0648 1240  lltdsvc - ok
11:48:12.0679 1240  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
11:48:12.0695 1240  lmhosts - ok
11:48:12.0742 1240  [ E70FD0D2C95F559A17321D831875593D ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
11:48:12.0757 1240  LMS - ok
11:48:12.0789 1240  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
11:48:12.0804 1240  LSI_FC - ok
11:48:12.0820 1240  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
11:48:12.0835 1240  LSI_SAS - ok
11:48:12.0835 1240  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
11:48:12.0851 1240  LSI_SAS2 - ok
11:48:12.0851 1240  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
11:48:12.0867 1240  LSI_SCSI - ok
11:48:12.0882 1240  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
11:48:12.0913 1240  luafv - ok
11:48:12.0929 1240  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
11:48:12.0945 1240  Mcx2Svc - ok
11:48:12.0960 1240  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\drivers\megasas.sys
11:48:12.0960 1240  megasas - ok
11:48:12.0960 1240  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
11:48:12.0976 1240  MegaSR - ok
11:48:13.0023 1240  [ D71FD7A4FDB01C554AE144037B688DF1 ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
11:48:13.0038 1240  MEIx64 - ok
11:48:13.0101 1240  Microsoft SharePoint Workspace Audit Service - ok
11:48:13.0132 1240  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
11:48:13.0163 1240  MMCSS - ok
11:48:13.0179 1240  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
11:48:13.0225 1240  Modem - ok
11:48:13.0241 1240  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
11:48:13.0272 1240  monitor - ok
11:48:13.0288 1240  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
11:48:13.0288 1240  mouclass - ok
11:48:13.0303 1240  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
11:48:13.0319 1240  mouhid - ok
11:48:13.0350 1240  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
11:48:13.0350 1240  mountmgr - ok
11:48:13.0397 1240  [ 8BE15F71DE6FF33FC56DCDE7B2B9EFE8 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
11:48:13.0413 1240  MozillaMaintenance - ok
11:48:13.0428 1240  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
11:48:13.0459 1240  mpio - ok
11:48:13.0459 1240  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
11:48:13.0491 1240  mpsdrv - ok
11:48:13.0506 1240  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
11:48:13.0537 1240  MpsSvc - ok
11:48:13.0553 1240  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
11:48:13.0569 1240  MRxDAV - ok
11:48:13.0600 1240  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
11:48:13.0615 1240  mrxsmb - ok
11:48:13.0631 1240  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:48:13.0647 1240  mrxsmb10 - ok
11:48:13.0662 1240  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:48:13.0678 1240  mrxsmb20 - ok
11:48:13.0693 1240  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
11:48:13.0693 1240  msahci - ok
11:48:13.0709 1240  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
11:48:13.0709 1240  msdsm - ok
11:48:13.0725 1240  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
11:48:13.0740 1240  MSDTC - ok
11:48:13.0771 1240  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
11:48:13.0787 1240  Msfs - ok
11:48:13.0818 1240  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
11:48:13.0865 1240  mshidkmdf - ok
11:48:13.0881 1240  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
11:48:13.0881 1240  msisadrv - ok
11:48:13.0912 1240  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
11:48:13.0943 1240  MSiSCSI - ok
11:48:13.0943 1240  msiserver - ok
11:48:13.0959 1240  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
11:48:13.0990 1240  MSKSSRV - ok
11:48:14.0005 1240  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
11:48:14.0037 1240  MSPCLOCK - ok
11:48:14.0037 1240  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
11:48:14.0068 1240  MSPQM - ok
11:48:14.0083 1240  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
11:48:14.0083 1240  MsRPC - ok
11:48:14.0099 1240  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
11:48:14.0099 1240  mssmbios - ok
11:48:14.0177 1240  MSSQL$SQLEXPRESS - ok
11:48:14.0208 1240  [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe
11:48:14.0224 1240  MSSQLServerADHelper - ok
11:48:14.0255 1240  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
11:48:14.0302 1240  MSTEE - ok
11:48:14.0302 1240  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
11:48:14.0317 1240  MTConfig - ok
11:48:14.0333 1240  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
11:48:14.0349 1240  Mup - ok
11:48:14.0364 1240  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
11:48:14.0411 1240  napagent - ok
11:48:14.0427 1240  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
11:48:14.0442 1240  NativeWifiP - ok
11:48:14.0473 1240  [ 779D0FDF086B4F8283A54746200C96F7 ] NCFilter        C:\Windows\system32\DRIVERS\NCFilter.sys
11:48:14.0473 1240  NCFilter - ok
11:48:14.0536 1240  [ C80385731664EEBEE0DA9C8553ED6EAB ] NCFSD          C:\Program Files\Novell\Client\XTier\Drivers\ncfsd.sys
11:48:14.0551 1240  NCFSD - ok
11:48:14.0567 1240  [ 08F4627B97E22E331C65B63AB452042F ] NCIOCTL        C:\Program Files\Novell\Client\XTier\Drivers\ncioctl.sys
11:48:14.0567 1240  NCIOCTL - ok
11:48:14.0583 1240  [ FE41234831B9CC2552404E5DB9C4067E ] NCRecognizer    C:\Windows\system32\DRIVERS\NCRecognizer.sys
11:48:14.0583 1240  NCRecognizer - ok
11:48:14.0598 1240  [ FBCFA160A001D27FCEA53017EB9EFAEE ] NCUncFilter    C:\Windows\system32\DRIVERS\NCUncFilter.sys
11:48:14.0614 1240  NCUncFilter - ok
11:48:14.0661 1240  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
11:48:14.0676 1240  NDIS - ok
11:48:14.0707 1240  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
11:48:14.0754 1240  NdisCap - ok
11:48:14.0754 1240  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
11:48:14.0785 1240  NdisTapi - ok
11:48:14.0785 1240  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
11:48:14.0817 1240  Ndisuio - ok
11:48:14.0832 1240  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
11:48:14.0848 1240  NdisWan - ok
11:48:14.0863 1240  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
11:48:14.0895 1240  NDProxy - ok
11:48:14.0895 1240  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
11:48:14.0941 1240  NetBIOS - ok
11:48:14.0941 1240  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
11:48:14.0973 1240  NetBT - ok
11:48:14.0988 1240  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
11:48:14.0988 1240  Netlogon - ok
11:48:15.0019 1240  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
11:48:15.0051 1240  Netman - ok
11:48:15.0066 1240  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
11:48:15.0097 1240  netprofm - ok
11:48:15.0113 1240  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:48:15.0129 1240  NetTcpPortSharing - ok
11:48:15.0160 1240  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
11:48:15.0160 1240  nfrd960 - ok
11:48:15.0191 1240  [ BB7E5D19E2565BA797CE0BCC20EDB74C ] NICM            C:\Program Files\Novell\Client\XTier\Drivers\nicm.sys
11:48:15.0207 1240  NICM - ok
11:48:15.0238 1240  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll
11:48:15.0253 1240  NlaSvc - ok
11:48:15.0269 1240  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
11:48:15.0300 1240  Npfs - ok
11:48:15.0331 1240  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
11:48:15.0347 1240  nsi - ok
11:48:15.0363 1240  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
11:48:15.0378 1240  nsiproxy - ok
11:48:15.0441 1240  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
11:48:15.0503 1240  Ntfs - ok
11:48:15.0519 1240  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
11:48:15.0550 1240  Null - ok
11:48:15.0565 1240  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
11:48:15.0565 1240  nvraid - ok
11:48:15.0581 1240  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
11:48:15.0597 1240  nvstor - ok
11:48:15.0612 1240  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
11:48:15.0612 1240  nv_agp - ok
11:48:15.0628 1240  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
11:48:15.0659 1240  ohci1394 - ok
11:48:15.0721 1240  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:48:15.0737 1240  ose - ok
11:48:15.0846 1240  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
11:48:15.0955 1240  osppsvc - ok
11:48:15.0971 1240  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
11:48:16.0002 1240  p2pimsvc - ok
11:48:16.0018 1240  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
11:48:16.0018 1240  p2psvc - ok
11:48:16.0049 1240  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\drivers\parport.sys
11:48:16.0065 1240  Parport - ok
11:48:16.0080 1240  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
11:48:16.0096 1240  partmgr - ok
11:48:16.0096 1240  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
11:48:16.0111 1240  PcaSvc - ok
11:48:16.0127 1240  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci            C:\Windows\system32\drivers\pci.sys
11:48:16.0143 1240  pci - ok
11:48:16.0158 1240  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
11:48:16.0158 1240  pciide - ok
11:48:16.0174 1240  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
11:48:16.0189 1240  pcmcia - ok
11:48:16.0205 1240  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
11:48:16.0205 1240  pcw - ok
11:48:16.0221 1240  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
11:48:16.0236 1240  PEAUTH - ok
11:48:16.0267 1240  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
11:48:16.0314 1240  PeerDistSvc - ok
11:48:16.0361 1240  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
11:48:16.0377 1240  PerfHost - ok
11:48:16.0423 1240  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
11:48:16.0486 1240  pla - ok
11:48:16.0533 1240  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
11:48:16.0564 1240  PlugPlay - ok
11:48:16.0579 1240  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
11:48:16.0611 1240  PNRPAutoReg - ok
11:48:16.0626 1240  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
11:48:16.0626 1240  PNRPsvc - ok
11:48:16.0657 1240  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
11:48:16.0720 1240  PolicyAgent - ok
11:48:16.0735 1240  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
11:48:16.0767 1240  Power - ok
11:48:16.0782 1240  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
11:48:16.0813 1240  PptpMiniport - ok
11:48:16.0813 1240  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\drivers\processr.sys
11:48:16.0829 1240  Processor - ok
11:48:16.0876 1240  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
11:48:16.0876 1240  ProfSvc - ok
11:48:16.0891 1240  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
11:48:16.0907 1240  ProtectedStorage - ok
11:48:16.0923 1240  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
11:48:16.0954 1240  Psched - ok
11:48:17.0001 1240  [ 543A4EF0923BF70D126625B034EF25AF ] PSI_SVC_2      c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
11:48:17.0016 1240  PSI_SVC_2 - ok
11:48:17.0063 1240  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
11:48:17.0110 1240  ql2300 - ok
11:48:17.0125 1240  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
11:48:17.0125 1240  ql40xx - ok
11:48:17.0157 1240  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
11:48:17.0157 1240  QWAVE - ok
11:48:17.0172 1240  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
11:48:17.0188 1240  QWAVEdrv - ok
11:48:17.0203 1240  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
11:48:17.0235 1240  RasAcd - ok
11:48:17.0266 1240  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
11:48:17.0281 1240  RasAgileVpn - ok
11:48:17.0297 1240  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
11:48:17.0328 1240  RasAuto - ok
11:48:17.0344 1240  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
11:48:17.0375 1240  Rasl2tp - ok
11:48:17.0406 1240  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
11:48:17.0422 1240  RasMan - ok
11:48:17.0437 1240  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
11:48:17.0469 1240  RasPppoe - ok
11:48:17.0469 1240  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
11:48:17.0500 1240  RasSstp - ok
11:48:17.0515 1240  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
11:48:17.0531 1240  rdbss - ok
11:48:17.0562 1240  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
11:48:17.0562 1240  rdpbus - ok
11:48:17.0578 1240  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
11:48:17.0609 1240  RDPCDD - ok
11:48:17.0609 1240  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
11:48:17.0625 1240  RDPDR - ok
11:48:17.0640 1240  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
11:48:17.0671 1240  RDPENCDD - ok
11:48:17.0671 1240  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
11:48:17.0687 1240  RDPREFMP - ok
11:48:17.0718 1240  [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
11:48:17.0734 1240  RdpVideoMiniport - ok
11:48:17.0781 1240  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
11:48:17.0796 1240  RDPWD - ok
11:48:17.0812 1240  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
11:48:17.0827 1240  rdyboost - ok
11:48:17.0843 1240  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
11:48:17.0874 1240  RemoteAccess - ok
11:48:17.0890 1240  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
11:48:17.0921 1240  RemoteRegistry - ok
11:48:17.0937 1240  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
11:48:17.0952 1240  RpcEptMapper - ok
11:48:17.0968 1240  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
11:48:17.0983 1240  RpcLocator - ok
11:48:17.0999 1240  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
11:48:18.0015 1240  RpcSs - ok
11:48:18.0030 1240  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
11:48:18.0061 1240  rspndr - ok
11:48:18.0077 1240  [ E60C0A09F997826C7627B244195AB581 ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
11:48:18.0093 1240  s3cap - ok
11:48:18.0093 1240  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
11:48:18.0108 1240  SamSs - ok
11:48:18.0124 1240  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
11:48:18.0124 1240  sbp2port - ok
11:48:18.0139 1240  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
11:48:18.0155 1240  SCardSvr - ok
11:48:18.0171 1240  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
11:48:18.0202 1240  scfilter - ok
11:48:18.0217 1240  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
11:48:18.0280 1240  Schedule - ok
11:48:18.0295 1240  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
11:48:18.0311 1240  SCPolicySvc - ok
11:48:18.0327 1240  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
11:48:18.0342 1240  SDRSVC - ok
11:48:18.0358 1240  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
11:48:18.0405 1240  secdrv - ok
11:48:18.0405 1240  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
11:48:18.0436 1240  seclogon - ok
11:48:18.0436 1240  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
11:48:18.0467 1240  SENS - ok
11:48:18.0498 1240  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
11:48:18.0529 1240  SensrSvc - ok
11:48:18.0561 1240  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
11:48:18.0607 1240  Serenum - ok
11:48:18.0623 1240  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
11:48:18.0654 1240  Serial - ok
11:48:18.0670 1240  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
11:48:18.0701 1240  sermouse - ok
11:48:18.0717 1240  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
11:48:18.0748 1240  SessionEnv - ok
11:48:18.0763 1240  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
11:48:18.0779 1240  sffdisk - ok
11:48:18.0779 1240  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
11:48:18.0795 1240  sffp_mmc - ok
11:48:18.0795 1240  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
11:48:18.0810 1240  sffp_sd - ok
11:48:18.0810 1240  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
11:48:18.0810 1240  sfloppy - ok
11:48:18.0841 1240  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
11:48:18.0873 1240  SharedAccess - ok
11:48:18.0888 1240  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:48:18.0919 1240  ShellHWDetection - ok
11:48:18.0935 1240  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
11:48:18.0951 1240  SiSRaid2 - ok
11:48:18.0966 1240  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
11:48:18.0966 1240  SiSRaid4 - ok
11:48:19.0029 1240  [ B866E8C5ED1DCBEA72285BA4107892C2 ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
11:48:19.0044 1240  SkypeUpdate - ok
11:48:19.0060 1240  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
11:48:19.0107 1240  Smb - ok
11:48:19.0122 1240  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
11:48:19.0153 1240  SNMPTRAP - ok
11:48:19.0153 1240  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
11:48:19.0169 1240  spldr - ok
11:48:19.0185 1240  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
11:48:19.0216 1240  Spooler - ok
11:48:19.0294 1240  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
11:48:19.0403 1240  sppsvc - ok
11:48:19.0403 1240  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
11:48:19.0434 1240  sppuinotify - ok
11:48:19.0434 1240  [ 86EBD8B1F23E743AAD21F4D5B4D40985 ] SQLBrowser      c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
11:48:19.0450 1240  SQLBrowser - ok
11:48:19.0512 1240  [ 3C432A96363097870995E2A3C8B66ABD ] SQLWriter      c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
11:48:19.0528 1240  SQLWriter - ok
11:48:19.0559 1240  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
11:48:19.0590 1240  srv - ok
11:48:19.0590 1240  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
11:48:19.0621 1240  srv2 - ok
11:48:19.0637 1240  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
11:48:19.0653 1240  srvnet - ok
11:48:19.0668 1240  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
11:48:19.0699 1240  SSDPSRV - ok
11:48:19.0699 1240  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
11:48:19.0731 1240  SstpSvc - ok
11:48:19.0746 1240  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
11:48:19.0762 1240  stexstor - ok
11:48:19.0777 1240  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
11:48:19.0809 1240  stisvc - ok
11:48:19.0824 1240  [ 7785DC213270D2FC066538DAF94087E7 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
11:48:19.0824 1240  storflt - ok
11:48:19.0855 1240  [ C40841817EF57D491F22EB103DA587CC ] StorSvc        C:\Windows\system32\storsvc.dll
11:48:19.0871 1240  StorSvc - ok
11:48:19.0887 1240  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
11:48:19.0887 1240  storvsc - ok
11:48:19.0902 1240  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
11:48:19.0902 1240  swenum - ok
11:48:19.0918 1240  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
11:48:19.0965 1240  swprv - ok
11:48:19.0965 1240  [ C3A39C4079305480972D29C44B868C78 ] Synth3dVsc      C:\Windows\system32\drivers\synth3dvsc.sys
11:48:19.0980 1240  Synth3dVsc - ok
11:48:20.0011 1240  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain        C:\Windows\system32\sysmain.dll
11:48:20.0058 1240  SysMain - ok
11:48:20.0074 1240  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
11:48:20.0089 1240  TabletInputService - ok
11:48:20.0105 1240  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
11:48:20.0136 1240  TapiSrv - ok
11:48:20.0152 1240  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
11:48:20.0167 1240  TBS - ok
11:48:20.0230 1240  [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
11:48:20.0277 1240  Tcpip - ok
11:48:20.0339 1240  [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
11:48:20.0370 1240  TCPIP6 - ok
11:48:20.0386 1240  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
11:48:20.0386 1240  tcpipreg - ok
11:48:20.0417 1240  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
11:48:20.0417 1240  TDPIPE - ok
11:48:20.0448 1240  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
11:48:20.0479 1240  TDTCP - ok
11:48:20.0495 1240  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
11:48:20.0542 1240  tdx - ok
11:48:20.0635 1240  [ C9B9373A0A430C11F0213E359D0772B2 ] TeamViewer7    C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
11:48:20.0667 1240  TeamViewer7 - ok
11:48:20.0682 1240  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
11:48:20.0682 1240  TermDD - ok
11:48:20.0698 1240  [ EF4469AB69EB15E5D3754E6AEAFBCD3D ] terminpt        C:\Windows\system32\drivers\terminpt.sys
11:48:20.0713 1240  terminpt - ok
11:48:20.0729 1240  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
11:48:20.0760 1240  TermService - ok
11:48:20.0776 1240  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
11:48:20.0791 1240  Themes - ok
11:48:20.0807 1240  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
11:48:20.0823 1240  THREADORDER - ok
11:48:20.0854 1240  [ DBCC20C02E8A3E43B03C304A4E40A84F ] TPM            C:\Windows\system32\drivers\tpm.sys
11:48:20.0869 1240  TPM - ok
11:48:20.0869 1240  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
11:48:20.0901 1240  TrkWks - ok
11:48:20.0947 1240  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:48:20.0994 1240  TrustedInstaller - ok
11:48:21.0010 1240  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
11:48:21.0041 1240  tssecsrv - ok
11:48:21.0057 1240  [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
11:48:21.0088 1240  TsUsbFlt - ok
11:48:21.0103 1240  [ AD64450A4ABE076F5CB34CC08EEACB07 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
11:48:21.0119 1240  TsUsbGD - ok
11:48:21.0135 1240  [ E1748D04AE40118B62BC18AC86032192 ] tsusbhub        C:\Windows\system32\drivers\tsusbhub.sys
11:48:21.0150 1240  tsusbhub - ok
11:48:21.0306 1240  [ 811A229718C85356BC81EB20F35EB7F6 ] TuneUp.UtilitiesSvc C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
11:48:21.0384 1240  TuneUp.UtilitiesSvc - ok
11:48:21.0400 1240  [ DCC94C51D27C7EC0DADECA8F64C94FCF ] TuneUpUtilitiesDrv C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys
11:48:21.0400 1240  TuneUpUtilitiesDrv - ok
11:48:21.0447 1240  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
11:48:21.0478 1240  tunnel - ok
11:48:21.0493 1240  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
11:48:21.0509 1240  uagp35 - ok
11:48:21.0509 1240  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
11:48:21.0540 1240  udfs - ok
11:48:21.0556 1240  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
11:48:21.0571 1240  UI0Detect - ok
11:48:21.0571 1240  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
11:48:21.0587 1240  uliagpkx - ok
11:48:21.0603 1240  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
11:48:21.0618 1240  umbus - ok
11:48:21.0618 1240  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
11:48:21.0634 1240  UmPass - ok
11:48:21.0649 1240  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll
11:48:21.0665 1240  UmRdpService - ok
11:48:21.0743 1240  [ C485FB802F6C4A306B8F89BA087E5CA2 ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
11:48:21.0774 1240  UNS - ok
11:48:21.0790 1240  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
11:48:21.0852 1240  upnphost - ok
11:48:21.0883 1240  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp        C:\Windows\system32\drivers\usbccgp.sys
11:48:21.0899 1240  usbccgp - ok
11:48:21.0930 1240  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
11:48:21.0961 1240  usbcir - ok
11:48:21.0977 1240  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci        C:\Windows\system32\drivers\usbehci.sys
11:48:21.0993 1240  usbehci - ok
11:48:22.0008 1240  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
11:48:22.0039 1240  usbhub - ok
11:48:22.0055 1240  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
11:48:22.0071 1240  usbohci - ok
11:48:22.0086 1240  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\drivers\usbprint.sys
11:48:22.0117 1240  usbprint - ok
11:48:22.0133 1240  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:48:22.0149 1240  USBSTOR - ok
11:48:22.0164 1240  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
11:48:22.0195 1240  usbuhci - ok
11:48:22.0211 1240  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
11:48:22.0258 1240  UxSms - ok
11:48:22.0289 1240  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
11:48:22.0289 1240  VaultSvc - ok
11:48:22.0336 1240  [ 84BB306B7863883018D7F3EB0C453BD5 ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
11:48:22.0351 1240  VClone - ok
11:48:22.0367 1240  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
11:48:22.0383 1240  vdrvroot - ok
11:48:22.0414 1240  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
11:48:22.0461 1240  vds - ok
11:48:22.0476 1240  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
11:48:22.0476 1240  vga - ok
11:48:22.0492 1240  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
11:48:22.0507 1240  VgaSave - ok
11:48:22.0523 1240  VGPU - ok
11:48:22.0539 1240  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
11:48:22.0539 1240  vhdmp - ok
11:48:22.0554 1240  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
11:48:22.0570 1240  viaide - ok
11:48:22.0570 1240  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus          C:\Windows\system32\drivers\vmbus.sys
11:48:22.0585 1240  vmbus - ok
11:48:22.0601 1240  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
11:48:22.0617 1240  VMBusHID - ok
11:48:22.0617 1240  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
11:48:22.0632 1240  volmgr - ok
11:48:22.0632 1240  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
11:48:22.0648 1240  volmgrx - ok
11:48:22.0648 1240  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
11:48:22.0663 1240  volsnap - ok
11:48:22.0695 1240  [ ABD9B4A7E2D0AE51A3B8DF1AF3152D61 ] vpcbus          C:\Windows\system32\DRIVERS\vpchbus.sys
11:48:22.0710 1240  vpcbus - ok
11:48:22.0741 1240  [ 8ACDA395841538CE9713A67FE8B2A3EB ] vpcnfltr        C:\Windows\system32\DRIVERS\vpcnfltr.sys
11:48:22.0757 1240  vpcnfltr - ok
11:48:22.0773 1240  [ 31924E31BC315773E6D149B157DB46D5 ] vpcusb          C:\Windows\system32\DRIVERS\vpcusb.sys
11:48:22.0788 1240  vpcusb - ok
11:48:22.0835 1240  [ C5B651E52540E6F46DA66574C74B4898 ] vpcvmm          C:\Windows\system32\drivers\vpcvmm.sys
11:48:22.0866 1240  vpcvmm - ok
11:48:22.0866 1240  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
11:48:22.0882 1240  vsmraid - ok
11:48:22.0929 1240  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
11:48:22.0975 1240  VSS - ok
11:48:22.0991 1240  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
11:48:23.0007 1240  vwifibus - ok
11:48:23.0038 1240  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
11:48:23.0069 1240  W32Time - ok
11:48:23.0085 1240  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
11:48:23.0100 1240  WacomPen - ok
11:48:23.0116 1240  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
11:48:23.0147 1240  WANARP - ok
11:48:23.0147 1240  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
11:48:23.0163 1240  Wanarpv6 - ok
11:48:23.0209 1240  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc    C:\Windows\system32\Wat\WatAdminSvc.exe
11:48:23.0272 1240  WatAdminSvc - ok
11:48:23.0303 1240  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
11:48:23.0365 1240  wbengine - ok
11:48:23.0381 1240  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
11:48:23.0397 1240  WbioSrvc - ok
11:48:23.0397 1240  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
11:48:23.0428 1240  wcncsvc - ok
11:48:23.0443 1240  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:48:23.0459 1240  WcsPlugInService - ok
11:48:23.0475 1240  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
11:48:23.0490 1240  Wd - ok
11:48:23.0521 1240  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
11:48:23.0553 1240  Wdf01000 - ok
11:48:23.0568 1240  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
11:48:23.0599 1240  WdiServiceHost - ok
11:48:23.0631 1240  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
11:48:23.0646 1240  WdiSystemHost - ok
11:48:23.0662 1240  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
11:48:23.0677 1240  WebClient - ok
11:48:23.0693 1240  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
11:48:23.0724 1240  Wecsvc - ok
11:48:23.0740 1240  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
11:48:23.0771 1240  wercplsupport - ok
11:48:23.0802 1240  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
11:48:23.0818 1240  WerSvc - ok
11:48:23.0833 1240  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
11:48:23.0849 1240  WfpLwf - ok
11:48:23.0865 1240  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
11:48:23.0865 1240  WIMMount - ok
11:48:23.0880 1240  WinDefend - ok
11:48:23.0880 1240  WinHttpAutoProxySvc - ok
11:48:23.0927 1240  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
11:48:23.0958 1240  Winmgmt - ok
11:48:24.0005 1240  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
11:48:24.0067 1240  WinRM - ok
11:48:24.0099 1240  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
11:48:24.0145 1240  Wlansvc - ok
11:48:24.0161 1240  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\DRIVERS\wmiacpi.sys
11:48:24.0177 1240  WmiAcpi - ok
11:48:24.0192 1240  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
11:48:24.0208 1240  wmiApSrv - ok
11:48:24.0208 1240  WMPNetworkSvc - ok
11:48:24.0223 1240  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
11:48:24.0239 1240  WPCSvc - ok
11:48:24.0255 1240  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
11:48:24.0255 1240  WPDBusEnum - ok
11:48:24.0270 1240  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
11:48:24.0301 1240  ws2ifsl - ok
11:48:24.0317 1240  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
11:48:24.0348 1240  wscsvc - ok
11:48:24.0348 1240  WSearch - ok
11:48:24.0426 1240  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
11:48:24.0504 1240  wuauserv - ok
11:48:24.0520 1240  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
11:48:24.0551 1240  WudfPf - ok
11:48:24.0567 1240  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
11:48:24.0582 1240  WUDFRd - ok
11:48:24.0613 1240  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
11:48:24.0629 1240  wudfsvc - ok
11:48:24.0660 1240  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
11:48:24.0676 1240  WwanSvc - ok
11:48:24.0707 1240  XTSvcMgr - ok
11:48:24.0707 1240  ================ Scan global ===============================
11:48:24.0738 1240  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
11:48:24.0769 1240  [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll
11:48:24.0769 1240  [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll
11:48:24.0785 1240  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
11:48:24.0816 1240  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
11:48:24.0816 1240  [Global] - ok
11:48:24.0816 1240  ================ Scan MBR ==================================
11:48:24.0832 1240  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
11:48:25.0035 1240  \Device\Harddisk0\DR0 - ok
11:48:25.0035 1240  ================ Scan VBR ==================================
11:48:25.0050 1240  [ 8487A859575EAEAA67EE732BD9920FBE ] \Device\Harddisk0\DR0\Partition1
11:48:25.0050 1240  \Device\Harddisk0\DR0\Partition1 - ok
11:48:25.0066 1240  [ ADABF8D5663EAC56F98CB4F2467C0A12 ] \Device\Harddisk0\DR0\Partition2
11:48:25.0081 1240  \Device\Harddisk0\DR0\Partition2 - ok
11:48:25.0081 1240  ============================================================
11:48:25.0081 1240  Scan finished
11:48:25.0081 1240  ============================================================
11:48:25.0081 6112  Detected object count: 3
11:48:25.0081 6112  Actual detected object count: 3
11:49:16.0062 6112  Aspen Remote Simulation Service V7.2 ( UnsignedFile.Multi.Generic ) - skipped by user
11:49:16.0062 6112  Aspen Remote Simulation Service V7.2 ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:49:16.0062 6112  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
11:49:16.0062 6112  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:49:16.0062 6112  iprntsrv ( UnsignedFile.Multi.Generic ) - skipped by user
11:49:16.0062 6112  iprntsrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 19.11.2012 13:05
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Theta 19.11.2012 13:36
Das log-file von combofix lautet:

[code]
Combofix Logfile:
Code:
ComboFix 12-11-16.02 - efa 19.11.2012  13:12:55.1.4 - x64
Microsoft Windows 7 Enterprise  6.1.7601.1.1252.43.1031.18.16259.14030 [GMT 1:00]
ausgeführt von:: c:\users\efa\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
SP: Kaspersky Anti-Virus *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Betreuer\AppData\Roaming\unins000.exe
c:\users\Betreuer\Desktop\Internet Explorer.lnk
c:\windows\SysWow64\ccrpTmr6.dll
c:\windows\SysWow64\lsprst7.dll
c:\windows\TEMP\kladminkit\a97981a2-6bc9-4020-af5a-cfee830149cd.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-10-19 bis 2012-11-19  ))))))))))))))))))))))))))))))
.
.
2012-11-19 12:01 . 2012-11-19 12:01        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2012-11-19 12:01 . 2012-11-19 12:01        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2012-11-19 12:01 . 2012-11-19 12:01        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2012-11-19 12:01 . 2012-11-19 12:01        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2012-11-19 12:01 . 2012-11-19 12:01        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2012-11-19 12:01 . 2012-11-19 12:01        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2012-11-19 12:01 . 2012-11-19 12:01        159744        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2012-11-19 12:00 . 2012-11-19 12:01        --------        d-----w-        c:\program files (x86)\QuickTime
2012-11-19 12:00 . 2012-11-19 12:00        --------        d-----w-        c:\programdata\Apple Computer
2012-11-19 12:00 . 2012-11-19 12:00        --------        d-----w-        c:\program files (x86)\Common Files\Apple
2012-11-19 12:00 . 2012-11-19 12:00        --------        d-----w-        c:\programdata\Apple
2012-11-19 12:00 . 2012-11-19 12:00        --------        d-----w-        c:\program files (x86)\Apple Software Update
2012-11-16 14:42 . 2012-07-26 07:46        2560        ----a-w-        c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2012-11-16 14:42 . 2012-07-26 04:55        785512        ----a-w-        c:\windows\system32\drivers\Wdf01000.sys
2012-11-16 14:42 . 2012-07-26 04:55        54376        ----a-w-        c:\windows\system32\drivers\WdfLdr.sys
2012-11-16 14:42 . 2012-07-26 02:36        9728        ----a-w-        c:\windows\system32\Wdfres.dll
2012-11-16 14:37 . 2012-07-26 03:08        84992        ----a-w-        c:\windows\system32\WUDFSvc.dll
2012-11-16 14:37 . 2012-07-26 02:26        87040        ----a-w-        c:\windows\system32\drivers\WUDFPf.sys
2012-11-16 14:37 . 2012-07-26 02:26        198656        ----a-w-        c:\windows\system32\drivers\WUDFRd.sys
2012-11-16 14:37 . 2012-07-26 03:08        229888        ----a-w-        c:\windows\system32\WUDFHost.exe
2012-11-16 14:37 . 2012-07-26 03:08        744448        ----a-w-        c:\windows\system32\WUDFx.dll
2012-11-16 14:37 . 2012-07-26 03:08        45056        ----a-w-        c:\windows\system32\WUDFCoinstaller.dll
2012-11-16 14:37 . 2012-07-26 03:08        194048        ----a-w-        c:\windows\system32\WUDFPlatform.dll
2012-11-16 10:16 . 2012-11-16 10:16        --------        d-----w-        c:\program files (x86)\Malwarebytes
2012-11-16 10:16 . 2012-11-16 10:16        --------        d-----w-        c:\programdata\Malwarebytes
2012-11-16 10:16 . 2012-09-29 18:54        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-11-16 10:11 . 2012-05-29 12:09        34656        ----a-w-        c:\windows\system32\TURegOpt.exe
2012-11-16 10:11 . 2012-05-29 12:09        25952        ----a-w-        c:\windows\system32\authuitu.dll
2012-11-16 10:11 . 2012-05-29 12:09        21344        ----a-w-        c:\windows\SysWow64\authuitu.dll
2012-11-16 10:11 . 2012-11-16 10:11        --------        d-----w-        c:\program files (x86)\TuneUp Utilities 2012
2012-11-16 10:10 . 2012-11-16 10:11        --------        d-----w-        c:\programdata\TuneUp Software
2012-11-16 10:10 . 2012-11-16 10:10        --------        d-sh--w-        c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-11-16 10:10 . 2012-11-16 10:10        --------        d--h--w-        c:\programdata\Common Files
2012-11-06 13:23 . 2012-11-06 13:23        --------        d-----w-        c:\program files\PDF Split And Merge Basic
2012-11-06 13:18 . 2012-11-06 13:18        --------        d-----w-        c:\program files (x86)\pdfsam
2012-11-06 10:01 . 2012-11-06 10:01        --------        d-----w-        c:\program files\Windows XP Mode
2012-11-06 09:56 . 2009-09-23 01:48        3584        ----a-w-        c:\windows\system32\drivers\de-DE\vpchbus.sys.mui
2012-10-31 15:10 . 2012-10-31 15:10        --------        d-----w-        c:\program files (x86)\Mendeley Desktop
2012-10-31 14:13 . 2012-10-31 14:13        --------        d-----w-        c:\programdata\Protexis
2012-10-25 11:56 . 2012-10-25 11:56        --------        d-----w-        c:\program files (x86)\Common Files\Skype
2012-10-25 11:56 . 2012-10-25 11:56        --------        d-----r-        c:\program files (x86)\Skype
2012-10-25 11:55 . 2012-10-25 11:56        --------        d-----w-        c:\programdata\Skype
2012-10-25 06:34 . 2012-11-06 13:38        --------        d-----w-        c:\users\efa
2012-10-25 02:12 . 2012-10-25 02:12        94208        ----a-w-        c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12        69632        ----a-w-        c:\windows\SysWow64\QuickTime.qts
2012-10-24 09:07 . 2012-10-24 09:07        --------        d-----w-        c:\users\admin
2012-10-24 08:55 . 2012-10-24 08:55        --------        d-----w-        c:\users\Betreuer\AppData\Local\OriginLab
2012-10-24 08:53 . 2012-10-24 08:53        --------        d-----w-        c:\users\Betreuer\AppData\Roaming\Subversion
2012-10-24 08:53 . 2012-10-24 08:53        --------        d-----w-        c:\users\Betreuer\AppData\Roaming\MathWorks
2012-10-24 08:51 . 2012-10-24 08:51        --------        d-----w-        c:\programdata\OriginLab
2012-10-24 08:48 . 2012-10-24 08:48        --------        d-----w-        c:\program files\OriginLab
2012-10-24 08:47 . 2012-10-24 08:47        --------        d-----w-        c:\users\Betreuer\AppData\Roaming\InstallShield
2012-10-24 07:57 . 2012-10-24 07:57        --------        d-----w-        c:\program files\MATLAB
2012-10-24 07:45 . 2012-11-19 04:53        --------        d-----w-        C:\NDPS
2012-10-24 07:36 . 2012-10-24 07:36        --------        d-----w-        c:\windows\SysWow64\novell
2012-10-24 07:36 . 2009-03-30 09:45        823296        ------w-        c:\windows\SysWow64\ccsw32.dll
2012-10-24 07:36 . 2008-06-12 06:34        614532        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
2012-10-24 07:36 . 2001-09-05 02:18        77824        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2012-10-24 07:36 . 2001-09-05 02:18        225280        ------w-        c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2012-10-24 07:36 . 2001-09-05 02:14        176128        ------w-        c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2012-10-24 07:36 . 2001-09-05 02:13        32768        ------w-        c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2012-10-24 07:36 . 2012-10-24 07:36        --------        d-----w-        c:\programdata\Novell
2012-10-24 07:36 . 2012-10-24 07:36        --------        d-----w-        c:\windows\SysWow64\nls
2012-10-24 07:36 . 2012-10-24 07:37        --------        d-----w-        c:\program files\Novell
2012-10-24 07:36 . 2012-10-24 07:37        --------        d-----w-        c:\program files (x86)\Novell
2012-10-24 07:36 . 2012-10-24 07:36        --------        d-----w-        c:\windows\system32\nls
2012-10-24 07:31 . 2012-10-24 07:31        27736        ----a-w-        c:\windows\system32\drivers\klim6.sys
2012-10-24 07:29 . 2012-10-24 07:29        --------        d-----w-        c:\users\Betreuer\AppData\Roaming\TeamViewer
2012-10-24 07:27 . 2012-10-24 07:27        --------        d-----w-        c:\program files (x86)\TeamViewer
2012-10-23 13:01 . 2012-11-19 09:49        --------        d-----w-        c:\programdata\Kaspersky Lab
2012-10-23 13:01 . 2012-10-24 07:31        268376        ----a-w-        c:\windows\system32\drivers\klif.sys
2012-10-23 13:00 . 2012-10-23 13:01        --------        d-----w-        c:\program files (x86)\Kaspersky Lab
2012-10-23 13:00 . 2012-10-23 13:00        --------        d-----w-        c:\program files (x86)\Common Files\Kaspersky Lab
2012-10-23 13:00 . 2012-10-23 13:00        --------        d-----w-        c:\program files (x86)\Common Files\Cisco Systems
2012-10-23 13:00 . 2012-10-23 13:00        32768        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\7\Intel 32\objps7.dll
2012-10-23 13:00 . 2012-10-23 13:00        233472        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\7\Intel 32\IScript7.dll
2012-10-23 13:00 . 2012-10-23 13:00        335872        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\7\Intel 32\ISRT.dll
2012-10-23 13:00 . 2012-10-23 13:00        188416        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\7\Intel 32\IUser7.dll
2012-10-23 13:00 . 2012-10-23 13:00        626688        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe
2012-10-23 13:00 . 2012-10-23 13:00        290816        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Driver\7\Intel 32\_ISRES1033.dll
2012-10-23 12:59 . 2012-10-23 12:59        --------        d-----w-        c:\users\Betreuer\AppData\Roaming\vlc
2012-10-23 12:59 . 2012-10-23 12:59        --------        d-----w-        c:\program files (x86)\VideoLAN
2012-10-23 12:54 . 2012-10-23 12:54        --------        d-----w-        c:\program files (x86)\Common Files\Corel
2012-10-23 12:42 . 2012-10-23 12:44        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 9.0
2012-10-23 12:42 . 2012-10-23 12:42        --------        d-----w-        c:\program files (x86)\Microsoft SDKs
2012-10-23 12:42 . 2012-10-23 12:42        --------        d-----w-        c:\program files (x86)\Common Files\Protexis
2012-10-23 12:42 . 2012-10-23 12:42        --------        d-----w-        c:\programdata\Corel
2012-10-23 12:40 . 2012-10-23 12:40        --------        d-----w-        c:\program files (x86)\Corel
2012-10-23 10:46 . 2012-10-23 10:46        --------        d-----w-        c:\program files (x86)\MSXML 4.0
2012-10-23 10:34 . 2012-10-23 10:34        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2012-10-23 10:22 . 2012-10-23 10:22        --------        d-sh--we        c:\windows\SysWow64\config\systemprofile\Vorlagen
2012-10-23 10:22 . 2012-10-23 10:22        --------        d-sh--we        c:\windows\SysWow64\config\systemprofile\Startmenü
2012-10-23 10:22 . 2012-10-23 10:22        --------        d-sh--we        c:\windows\SysWow64\config\systemprofile\Netzwerkumgebung
2012-10-23 10:22 . 2012-10-23 10:22        --------        d-sh--we        c:\windows\SysWow64\config\systemprofile\Lokale Einstellungen
2012-10-23 10:22 . 2012-10-23 10:22        --------        d-sh--we        c:\windows\SysWow64\config\systemprofile\Eigene Dateien
2012-10-23 10:22 . 2012-10-23 10:22        --------        d-sh--we        c:\windows\SysWow64\config\systemprofile\Druckumgebung
2012-10-23 10:22 . 2012-10-23 10:22        --------        d-sh--we        c:\windows\SysWow64\config\systemprofile\Anwendungsdaten
2012-10-23 10:17 . 2012-10-23 10:17        1025        ----a-w-        c:\windows\SysWow64\sysprs7.dll
2012-10-23 10:14 . 2012-10-23 10:14        --------        d-----w-        c:\users\Betreuer\AppData\Local\Adobe
2012-10-23 10:12 . 2012-10-23 10:15        --------        d-----w-        c:\program files\Microsoft SQL Server
2012-10-23 10:11 . 2012-10-23 10:49        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server
2012-10-23 09:08 . 2012-10-23 09:08        --------        d-----w-        c:\program files (x86)\Microsoft Synchronization Services
2012-10-23 09:08 . 2012-10-23 09:08        --------        d-----w-        c:\windows\PCHEALTH
2012-10-23 09:08 . 2012-10-23 09:08        --------        d-----w-        c:\program files (x86)\Microsoft Sync Framework
2012-10-23 09:08 . 2012-10-23 09:08        --------        d-----w-        c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-10-23 09:07 . 2012-10-23 09:07        --------        d-----w-        C:\IDE
2012-10-23 09:07 . 2012-10-23 09:07        --------        d-----w-        c:\program files (x86)\Microsoft Visual Studio 8
2012-10-23 09:07 . 2012-10-23 09:07        --------        d-----w-        c:\program files\Microsoft Office
2012-10-23 09:07 . 2012-10-23 09:07        --------        d-----w-        c:\program files (x86)\Microsoft Analysis Services
2012-10-23 09:07 . 2012-10-23 09:07        --------        d-----w-        c:\users\Betreuer\AppData\Local\Microsoft Help
2012-10-23 09:07 . 2012-11-16 14:45        --------        d-----w-        c:\programdata\Microsoft Help
2012-10-23 09:06 . 2012-10-23 09:06        --------        d-----r-        C:\MSOCache
2012-10-23 09:03 . 2012-10-23 09:03        --------        d-----w-        c:\program files (x86)\Elaborate Bytes
2012-10-23 09:03 . 2012-10-23 09:03        916456        ----a-w-        c:\windows\system32\deployJava1.dll
2012-10-23 09:03 . 2012-10-23 09:03        289768        ----a-w-        c:\windows\system32\javaws.exe
2012-10-23 09:03 . 2012-10-23 09:03        1034216        ----a-w-        c:\windows\system32\npDeployJava1.dll
2012-10-23 09:03 . 2012-10-23 09:03        189416        ----a-w-        c:\windows\system32\javaw.exe
2012-10-23 09:03 . 2012-10-23 09:03        188904        ----a-w-        c:\windows\system32\java.exe
2012-10-23 09:03 . 2012-10-23 09:03        108008        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll
2012-10-23 09:03 . 2012-10-23 09:03        --------        d-----w-        c:\program files\Java
2012-10-23 09:02 . 2012-10-23 09:02        --------        d-----w-        c:\users\Betreuer\AppData\Roaming\FreePDF
2012-10-23 09:02 . 2012-10-23 09:02        --------        d-----w-        c:\program files (x86)\FreePDF_XP
2012-10-23 09:02 . 2010-06-17 19:56        87040        ----a-w-        c:\windows\system32\redmonnt.dll
2012-10-23 09:02 . 2010-06-17 19:56        46080        ----a-w-        c:\windows\system32\unredmon.exe
2012-10-23 09:01 . 2012-10-23 09:01        --------        d-----w-        c:\program files\gs
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-16 14:37 . 2012-10-19 12:41        66395536        ----a-w-        c:\windows\system32\MRT.exe
2012-10-18 10:31 . 2012-10-18 10:31        89088        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2012-10-18 10:31 . 2012-10-18 10:31        86528        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2012-10-18 10:31 . 2012-10-18 10:31        76800        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2012-10-18 10:31 . 2012-10-18 10:31        74752        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-10-18 10:31 . 2012-10-18 10:31        74752        ----a-w-        c:\windows\SysWow64\iesetup.dll
2012-10-18 10:31 . 2012-10-18 10:31        65024        ----a-w-        c:\windows\system32\pngfilt.dll
2012-10-18 10:31 . 2012-10-18 10:31        63488        ----a-w-        c:\windows\SysWow64\tdc.ocx
2012-10-18 10:31 . 2012-10-18 10:31        49664        ----a-w-        c:\windows\system32\imgutil.dll
2012-10-18 10:31 . 2012-10-18 10:31        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2012-10-18 10:31 . 2012-10-18 10:31        367104        ----a-w-        c:\windows\SysWow64\html.iec
2012-10-18 10:31 . 2012-10-18 10:31        35840        ----a-w-        c:\windows\SysWow64\imgutil.dll
2012-10-18 10:31 . 2012-10-18 10:31        267776        ----a-w-        c:\windows\system32\ieaksie.dll
2012-10-18 10:31 . 2012-10-18 10:31        23552        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2012-10-18 10:31 . 2012-10-18 10:31        222208        ----a-w-        c:\windows\system32\msls31.dll
2012-10-18 10:31 . 2012-10-18 10:31        197120        ----a-w-        c:\windows\system32\msrating.dll
2012-10-18 10:31 . 2012-10-18 10:31        163840        ----a-w-        c:\windows\system32\ieakui.dll
2012-10-18 10:31 . 2012-10-18 10:31        161792        ----a-w-        c:\windows\SysWow64\msls31.dll
2012-10-18 10:31 . 2012-10-18 10:31        152064        ----a-w-        c:\windows\SysWow64\wextract.exe
2012-10-18 10:31 . 2012-10-18 10:31        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2012-10-18 10:31 . 2012-10-18 10:31        149504        ----a-w-        c:\windows\system32\occache.dll
2012-10-18 10:31 . 2012-10-18 10:31        12288        ----a-w-        c:\windows\system32\mshta.exe
2012-10-18 10:31 . 2012-10-18 10:31        11776        ----a-w-        c:\windows\SysWow64\mshta.exe
2012-10-18 10:31 . 2012-10-18 10:31        114176        ----a-w-        c:\windows\system32\admparse.dll
2012-10-18 10:31 . 2012-10-18 10:31        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2012-10-18 10:31 . 2012-10-18 10:31        101888        ----a-w-        c:\windows\SysWow64\admparse.dll
2012-10-18 10:31 . 2012-10-18 10:31        145920        ----a-w-        c:\windows\system32\iepeers.dll
2012-10-18 10:31 . 2012-10-18 10:31        91648        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2012-10-18 10:31 . 2012-10-18 10:31        89088        ----a-w-        c:\windows\system32\ie4uinit.exe
2012-10-18 10:31 . 2012-10-18 10:31        85504        ----a-w-        c:\windows\system32\iesetup.dll
2012-10-18 10:31 . 2012-10-18 10:31        82432        ----a-w-        c:\windows\system32\icardie.dll
2012-10-18 10:31 . 2012-10-18 10:31        76800        ----a-w-        c:\windows\system32\tdc.ocx
2012-10-18 10:31 . 2012-10-18 10:31        55296        ----a-w-        c:\windows\system32\msfeedsbs.dll
2012-10-18 10:31 . 2012-10-18 10:31        534528        ----a-w-        c:\windows\system32\ieapfltr.dll
2012-10-18 10:31 . 2012-10-18 10:31        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2012-10-18 10:31 . 2012-10-18 10:31        452608        ----a-w-        c:\windows\system32\dxtmsft.dll
2012-10-18 10:31 . 2012-10-18 10:31        448512        ----a-w-        c:\windows\system32\html.iec
2012-10-18 10:31 . 2012-10-18 10:31        403248        ----a-w-        c:\windows\system32\iedkcs32.dll
2012-10-18 10:31 . 2012-10-18 10:31        39936        ----a-w-        c:\windows\system32\iernonce.dll
2012-10-18 10:31 . 2012-10-18 10:31        3695416        ----a-w-        c:\windows\system32\ieapfltr.dat
2012-10-18 10:31 . 2012-10-18 10:31        30720        ----a-w-        c:\windows\system32\licmgr10.dll
2012-10-18 10:31 . 2012-10-18 10:31        282112        ----a-w-        c:\windows\system32\dxtrans.dll
2012-10-18 10:31 . 2012-10-18 10:31        249344        ----a-w-        c:\windows\system32\webcheck.dll
2012-10-18 10:31 . 2012-10-18 10:31        165888        ----a-w-        c:\windows\system32\iexpress.exe
2012-10-18 10:31 . 2012-10-18 10:31        160256        ----a-w-        c:\windows\system32\wextract.exe
2012-10-18 10:31 . 2012-10-18 10:31        160256        ----a-w-        c:\windows\system32\ieakeng.dll
2012-10-18 10:31 . 2012-10-18 10:31        135168        ----a-w-        c:\windows\system32\IEAdvpack.dll
2012-10-18 10:31 . 2012-10-18 10:31        111616        ----a-w-        c:\windows\system32\iesysprep.dll
2012-10-18 10:31 . 2012-10-18 10:31        10752        ----a-w-        c:\windows\system32\msfeedssync.exe
2012-10-18 10:31 . 2012-10-18 10:31        103936        ----a-w-        c:\windows\system32\inseng.dll
2012-09-14 19:19 . 2012-10-19 12:38        2048        ----a-w-        c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-19 12:38        2048        ----a-w-        c:\windows\SysWow64\tzres.dll
2012-08-31 18:19 . 2012-10-19 12:38        1659760        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2012-08-30 18:03 . 2012-10-19 11:32        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-08-30 17:12 . 2012-10-19 11:32        3968880        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-19 11:32        3914096        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-08-24 18:05 . 2012-10-19 12:38        220160        ----a-w-        c:\windows\system32\wintrust.dll
2012-08-24 16:57 . 2012-10-19 12:38        172544        ----a-w-        c:\windows\SysWow64\wintrust.dll
2012-08-22 18:12 . 2012-10-19 12:38        950128        ----a-w-        c:\windows\system32\drivers\ndis.sys
2012-08-22 18:12 . 2012-10-19 12:38        376688        ----a-w-        c:\windows\system32\drivers\netio.sys
2012-08-22 18:12 . 2012-10-19 12:38        288624        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-21 21:01 . 2012-10-19 12:38        245760        ----a-w-        c:\windows\system32\OxpsConverter.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-10-19 17875120]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-27 291608]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2012-07-20 133440]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe" [2010-03-12 311680]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          scecli iPrntWinCredMan
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-10-19 160944]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-21 88960]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2012-08-23 29696]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-10-19 1255736]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-01-27 16152]
S0 NCFilter;Novell UNC Filter - Filter;c:\windows\system32\DRIVERS\NCFilter.sys [2012-05-12 112216]
S0 NCRecognizer;Novell UNC Filter - Recognizer;c:\windows\system32\DRIVERS\NCRecognizer.sys [2012-05-12 119896]
S0 NCUncFilter;Novell UNC Filter - UNC Filter;c:\windows\system32\DRIVERS\NCUncFilter.sys [2012-05-12 26200]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.EXE [2009-11-17 98208]
S2 Aspen Remote Simulation Service V7.2;Aspen Remote Simulation Service V7.2;c:\program files (x86)\AspenTech\Aspen Remote Simulation Service V7.2\AspenTech.AspenCxs.RemotingSvc.exe [2010-05-04 76800]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-06-19 634632]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2011-11-09 189608]
S2 iprntsrv;Novell iPrint Service;c:\windows\system32\iprntsrv.exe [2011-11-04 55296]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-07-20 166720]
S2 klnagent;Kaspersky Lab Network Agent;c:\program files (x86)\Kaspersky Lab\NetworkAgent 8\klnagent.exe [2010-03-10 136352]
S2 NCFSD;Novell Client File System Redirector;c:\program files\Novell\Client\XTier\Drivers\ncfsd.sys [2012-05-12 108632]
S2 NCIOCTL;Novell Xplat IoCtl Driver;c:\program files\Novell\Client\XTier\Drivers\ncioctl.sys [2012-05-12 90200]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-10-23 2848168]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2012-05-29 2143072]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-07-20 365376]
S2 XTSvcMgr;Novell XTier Service Manager;c:\program files\Novell\Client\XTier\Services\XTSvcMgr.exe [2012-05-12 19544]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-01-27 356120]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-01-27 787736]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [2012-05-08 11856]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - nciom
*Deregistered* - ncp
*Deregistered* - ncpl
*Deregistered* - ndm
*Deregistered* - ndmndap
*Deregistered* - niam
*Deregistered* - nipctl
*Deregistered* - nscm
*Deregistered* - nsns
*Deregistered* - nsvccost
*Deregistered* - xtxplat
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-23 16:38]
.
2012-11-19 c:\windows\Tasks\MATLAB R2012b Startup Accelerator.job
- c:\program files\MATLAB\R2012b\bin\win64\MATLABStartupAccelerator.exe [2012-10-24 17:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-12 6548112]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-05-23 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-05-23 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-05-23 439104]
"NWTRAY"="NWTRAY.EXE" [2012-05-12 37976]
"iPrint Tray"="c:\windows\system32\iprntctl.exe" [2011-11-04 66136]
"iPrint Event Monitor"="c:\windows\system32\iprntlgn.exe" [2011-11-04 69720]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: Interfaces\{04B11463-11E5-4D7E-8AD4-F9DD0479F912}: NameServer = 129.27.2.3,129.27.3.3
FF - ProfilePath - c:\users\efa\AppData\Roaming\Mozilla\Firefox\Profiles\fm31a453.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Pqwiwx - c:\users\efa\AppData\Roaming\Pqwiwx.exe
AddRemove-{CBCFD97D-FE82-43F4-A978-996CACF71E6B}_is1 - c:\users\Betreuer\AppData\Roaming\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-11-19  13:25:18 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-11-19 12:25
.
Vor Suchlauf: 11 Verzeichnis(se), 91.023.192.064 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 91.188.502.528 Bytes frei
.
- - End Of File - - 73D933FD5868CF5862A2ECC767069C00
--- --- ---

cosinus 19.11.2012 14:12
Code:
Microsoft Windows 7 Enterprise  6.1.7601.1.1252.43.1031.18.16259.14030 [GMT 1:00]
Ist das rein zufällig ein Büro-/Firmen-PC? Oder ein Uni-Rechner?

Theta 19.11.2012 14:36
Ja, warum?

cosinus 19.11.2012 15:26
Firmenrechner werden hier eigentlich nicht bereinigt

Siehe => http://www.trojaner-board.de/108422-...-anfragen.html

Zitat:
3. Grundsätzlich bereinigen wir keine gewerblich genutzten Rechner. Dafür ist die IT Abteilung eurer Firma zuständig.

Bei Kleinunternehmen, welche keinen IT Support haben, machen wir da eine Ausnahme und helfen gerne ( kleine Spende hilft auch uns ).
Voraussetzung: Ihr teilt uns dies in eurer ersten Antwort mit.
Bedenkt jedoch, dass Logfiles viele heikle Informationen enthalten können ( Kundendaten, Bankdaten, etc ) sowie das Malware die Möglichkeit besitzt, diese auszuspähen und zu missbrauchen. Hier legen wir euch ein Formatieren und Neuaufsetzen nahe.

Theta 19.11.2012 15:34
Sorry, wusste ich nicht... unser EDV-Beauftragter wusste auch nicht weiter...

Vielen Dank jedenfalls für die Mühe!!

cosinus 19.11.2012 18:52
Was habt ihr denn für einen EDV-ler? :wtf:
Ich meine Schädlinge vernünftig per Bereingung muss man nicht unbedingt als Admin können, aber dann zumindest sollte man wissen wie man Datensichert, und das Gerät komplett neu installiert oder besser, man hat vorgesorgt und noch ein enigermaßen aktuelles Images von diesem Rechner

Oder habt ihr keine echte EDV-Abteilung, nur eine Person, die sich mehr so nebenbei darum kümmert?

Theta 20.11.2012 16:54
wir haben eine Person, die sich nebenbei kümmert und beim Kollegen war der Trojaner nach dem neu aufsetzen noch da...

cosinus 20.11.2012 18:16
Dann muss er aber ziemlich viel falsch gemacht haben...

Theta 29.11.2012 14:43
Ja, anscheinend...
Naja, danke jedenfalls vielmals für diene Hilfe!! Ich hoffe, jetzt ist alles weg...


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:31 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19