Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   [Windows 7 64Bit] Maus bleibt hängen und bewegt sich dann nur noch stockend (https://www.trojaner-board.de/167664-windows-7-64bit-maus-bleibt-haengen-bewegt-dann-nur-noch-stockend.html)

Large1337 07.06.2015 10:09
[Windows 7 64Bit] Maus bleibt hängen und bewegt sich dann nur noch stockend
 
Hallo,
Ich habe seit ca. 3 Tagen das Problem das meine Maus nach ca. 0.5-2h PC Nutzung einfriert. Nach ein paar Sekunden springt die Maus einen Schritt weiter und friert wieder ein. Dieser Vorgang wiederholt sich solange bis ich meinen PC neu starte. Manchmal erscheint auch das Ladesymbol von Windows 7. Warten nützt leider nichts...
Das habe ich bisher gemacht:
- virtuellen Arbeitsspeicher unter Windows eingestellt (Habe 4gb normalen Arbeitsspeicher):
Anfangsgröße: 4096 mb
Maximale Größe: 8192 mb
- adwcleaner_4.202 einmal durchlaufen lassen. Leider habe ich hierzu die LOG nicht mehr. Da ich vor diesem Post gescannt habe. Es wurde dort 3 Einträge angezeigt unter der REG. (Präzise Aussage :kloppen:)

Ich habe wie in der Anleitung für den ersten Post die Logs generiert. Da diese für den Post zu groß waren, habe ich sie gezippt.


Vielen Dank für die Hilfe und freundliche Grüße,
Marvin

schrauber 07.06.2015 10:45
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Large1337 07.06.2015 11:29
FRST:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015
Ran by Marvin (administrator) on MARVIN-PC on 07-06-2015 10:31:33
Running from C:\Users\Marvin\Downloads
Loaded Profiles: Marvin & postgres (Available Profiles: Marvin & postgres)
Platform: Windows 7 Professional N Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Dropbox, Inc.) C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
() C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\postgreSQL\bin\postgres.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicatorCom.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\Marvin\Downloads\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2013-12-13] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-03-30] (LogMeIn Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\Run: [SurfEasy] => C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe [13421936 2015-01-17] ()
HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\Run: [HP Photosmart 7520 series (NET)] => C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3632472 2015-06-06] (Electronic Arts)
HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\MountPoints2: J - J:\SETUP.EXE
HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\MountPoints2: {bd820c7c-7a37-11e4-b8dc-001a4d4c7236} - J:\SETUP.EXE
HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\MountPoints2: {cb1407a1-eab1-11e4-b71e-806e6f6e6963} - J:\SETUP.EXE
HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\MountPoints2: {da7b09f8-eb1e-11e4-a671-001a4d4c7236} - L:\SETUP.EXE
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk [2015-01-03]
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe ()
Startup: C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-11-30]
ShortcutTarget: Dropbox.lnk -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 7520 series (Netzwerk).lnk [2015-02-04]
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 7520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-926302194-777514634-3206159580-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: PDF Architect Helper -> {691B33B0-B86E-47F3-81C7-56E4FE3B929C} -> C:\Program Files (x86)\PDF Architect 2\creator-ie-helper.dll [2014-10-10] (pdfforge GmbH)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {DEEB13D7-CEA9-45FB-B77C-E039BEC85221} - C:\Program Files (x86)\PDF Architect 2\creator-ie-plugin.dll [2014-10-10] (pdfforge GmbH)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-10-15] (Microsoft Corporation)
Hosts: 127.0.0.1 on4u3.buhl.de

FireFox:
========
FF ProfilePath: C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\gzaw39ex.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-31] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-31] ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-10-10] (pdfforge GmbH)
FF Extension: Flash Video Downloader - YouTube HD Downloader [4K] - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\gzaw39ex.default\Extensions\artur.dubovoy@gmail.com [2015-05-30]
FF Extension: Ghostery - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\gzaw39ex.default\Extensions\firefox@ghostery.com.xpi [2015-01-03]
FF Extension: NoScript - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\gzaw39ex.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-10-02]
FF Extension: YouTube High Definition - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\gzaw39ex.default\Extensions\{7b1bf0b6-a1b9-42b0-b75d-252036438bdc}.xpi [2015-01-03]
FF Extension: Adblock Plus - C:\Users\Marvin\AppData\Roaming\Mozilla\Firefox\Profiles\gzaw39ex.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-02]
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_2_conv@pdfarchitect.org] - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension
FF Extension: PDF Architect 2 Creator - C:\Program Files (x86)\PDF Architect 2\resources\pdfarchitect2firefoxextension [2014-12-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-03-30] (LogMeIn, Inc.)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1997168 2015-06-06] (Electronic Arts)
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-10-10] (pdfforge GmbH)
R2 PDF Architect 2 Creator; C:\Program Files (x86)\PDF Architect 2\creator-ws.exe [738856 2014-10-10] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-10-10] (pdfforge GmbH)
R2 postgresql-8.4; c:\postgreSQL\bin\pg_ctl.exe [66048 2014-02-18] (PostgreSQL Global Development Group) [File not signed]
R2 SurfEasyVPN; C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe [3272048 2015-01-17] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5448976 2015-04-17] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 Envy24HFS; C:\Windows\System32\drivers\Envy24HF.sys [228080 2010-10-25] (VIA - IC Ensemble, Inc.)
S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13536 2015-05-27] ()
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-04-24] (Duplex Secure Ltd.)
R3 tapse01; C:\Windows\System32\DRIVERS\tapse01.sys [39048 2015-01-17] (The OpenVPN Project)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-12-13] (Cisco Systems, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-07 10:26 - 2015-06-07 10:26 - 00050477 _____ C:\Users\Marvin\Downloads\Defogger.exe
2015-06-07 10:26 - 2015-06-07 10:26 - 00000584 _____ C:\Users\Marvin\Downloads\defogger_disable.log
2015-06-07 10:26 - 2015-06-07 10:26 - 00000020 _____ C:\Users\Marvin\defogger_reenable
2015-06-07 10:10 - 2015-06-07 10:10 - 00380416 _____ C:\Users\Marvin\Downloads\Gmer-19357.exe
2015-06-07 09:57 - 2015-06-07 10:31 - 00000000 ____D C:\Users\Marvin\Desktop\logs FRST
2015-06-07 09:51 - 2015-06-07 09:51 - 00042493 _____ C:\Users\Marvin\Downloads\Addition.txt
2015-06-07 09:50 - 2015-06-07 10:31 - 00014841 _____ C:\Users\Marvin\Downloads\FRST.txt
2015-06-07 09:50 - 2015-06-07 10:31 - 00000000 ____D C:\FRST
2015-06-07 09:50 - 2015-06-07 09:50 - 02108928 _____ (Farbar) C:\Users\Marvin\Downloads\FRST64.exe
2015-06-07 09:45 - 2015-06-07 09:47 - 00000000 ____D C:\Program Files (x86)\RivaTuner Statistics Server
2015-06-07 09:45 - 2015-06-07 09:46 - 00000000 ____D C:\Program Files (x86)\MSI Afterburner
2015-06-07 09:45 - 2015-06-07 09:45 - 00001086 _____ C:\Users\Marvin\Desktop\MSI Afterburner.lnk
2015-06-07 09:45 - 2015-06-07 09:45 - 00000000 ____D C:\Windows\SysWOW64\directx
2015-06-07 09:45 - 2015-06-07 09:45 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RivaTuner Statistics Server
2015-06-07 09:45 - 2015-06-07 09:45 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MSI Afterburner
2015-06-07 09:44 - 2015-06-07 09:44 - 36485976 _____ C:\Users\Marvin\Downloads\MSIAfterburnerSetup411.exe
2015-06-05 22:18 - 2015-06-05 22:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bwin Poker
2015-06-04 22:00 - 2015-06-06 11:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-05-31 21:47 - 2015-05-31 21:22 - 01226800 _____ C:\Users\Marvin\Desktop\Ergebnis_Übung_2_Hier Stand ein Name, Marvin Version 2.pptx
2015-05-31 16:12 - 2015-05-31 21:22 - 00000000 ____D C:\Users\Marvin\Documents\MSR Übungen Bilder
2015-05-31 13:43 - 2015-05-31 13:44 - 58710384 _____ C:\Users\Marvin\Downloads\Methods_in_Services_Research-Neue_Dokumente.zip
2015-05-31 13:16 - 2015-05-31 22:50 - 00000000 ____D C:\Users\Marvin\Downloads\Dateiordner_Übung_2
2015-05-31 13:15 - 2015-05-31 13:16 - 29339174 _____ C:\Users\Marvin\Downloads\Dateiordner_Übung_2.zip
2015-05-31 13:04 - 2015-05-31 13:04 - 00000000 ____D C:\Users\Marvin\Documents\IBM
2015-05-31 12:59 - 2015-05-31 12:59 - 00000000 ____D C:\Users\Marvin\AppData\Local\javasharedresources
2015-05-31 12:59 - 2015-05-31 12:59 - 00000000 ____D C:\Users\Marvin\.spss
2015-05-31 12:40 - 2015-05-31 12:40 - 00003556 _____ C:\Windows\System32\Tasks\HP AR Program Upload - 44684f70d59e44f895b634c2e1e129369db10c18c69b4dcaa8ff37fd55338f88
2015-05-31 12:25 - 2015-05-31 12:25 - 00000411 _____ C:\Users\Marvin\Documents\urlaub.txt
2015-05-31 12:23 - 2015-05-31 12:23 - 00000000 ____D C:\Users\Marvin\AppData\Local\IBM
2015-05-31 12:23 - 2015-05-31 12:23 - 00000000 ____D C:\ProgramData\SPSS
2015-05-31 12:23 - 2015-05-31 12:23 - 00000000 ____D C:\ProgramData\SafeNet Sentinel
2015-05-31 12:23 - 2015-05-31 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics
2015-05-31 12:23 - 2015-05-31 12:23 - 00000000 ____D C:\Program Files\IBM
2015-05-31 12:23 - 2015-05-31 12:23 - 00000000 ____D C:\Program Files\Common Files\IBM
2015-05-31 12:22 - 2015-05-31 12:22 - 00001025 _____ C:\Windows\SysWOW64\sysprs7.tgz
2015-05-31 12:22 - 2015-05-31 12:22 - 00001025 _____ C:\Windows\SysWOW64\sysprs7.dll
2015-05-31 12:22 - 2015-05-31 12:22 - 00000219 _____ C:\Windows\SysWOW64\lsprst7.tgz
2015-05-31 12:22 - 2015-05-31 12:22 - 00000205 _____ C:\Windows\SysWOW64\lsprst7.dll
2015-05-31 12:22 - 2015-05-31 12:22 - 00000016 ____H C:\Windows\SysWOW64\servdat.slm
2015-05-31 12:04 - 2015-05-31 12:05 - 01169086 _____ C:\Users\Marvin\Downloads\Übung 2.pptx
2015-05-31 12:02 - 2015-05-31 12:15 - 812131760 _____ (IBM Corp) C:\Users\Marvin\Downloads\SPSS_Statistics_22_win64_.exe
2015-05-23 19:56 - 2015-06-05 22:18 - 00001489 _____ C:\ProgramData\Microsoft\Windows\Start Menu\bwin Poker.lnk
2015-05-23 19:56 - 2015-06-05 22:18 - 00001483 _____ C:\Users\Marvin\Desktop\bwin Poker.lnk
2015-05-23 19:56 - 2015-05-23 19:56 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\cef-cache
2015-05-23 19:56 - 2015-05-23 19:56 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\bwincom
2015-05-23 19:55 - 2015-05-23 19:55 - 00782256 _____ C:\Users\Marvin\Downloads\bwincomPokerSetup.exe
2015-05-19 10:16 - 2015-05-19 10:16 - 04614158 _____ C:\Users\Marvin\Downloads\Customer_Relationship_Management-Dokumente.zip
2015-05-19 10:16 - 2015-05-19 10:16 - 00000000 ____D C:\Users\Marvin\Downloads\Customer_Relationship_Management-Dokumente
2015-05-17 10:50 - 2015-05-17 11:13 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-05-17 10:50 - 2015-05-17 10:50 - 00001043 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-05-17 10:50 - 2015-05-17 10:50 - 00001031 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-05-17 10:49 - 2015-05-17 10:50 - 07970528 _____ (TeamViewer GmbH) C:\Users\Marvin\Downloads\TeamViewer_Setup_de.exe
2015-05-15 11:33 - 2015-05-15 11:33 - 00000026 _____ C:\Users\Marvin\AppData\Local\isoworkshop.ini
2015-05-15 11:33 - 2015-05-15 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glorylogic
2015-05-15 11:33 - 2015-05-15 11:33 - 00000000 ____D C:\Program Files (x86)\Glorylogic
2015-05-15 11:32 - 2015-05-15 11:32 - 02775552 _____ (Glorylogic ) C:\Users\Marvin\Downloads\isoworkshop_5.9.exe
2015-05-15 11:25 - 2015-05-15 11:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
2015-05-15 11:25 - 2015-05-15 11:25 - 00000000 ____D C:\Program Files (x86)\Elaborate Bytes
2015-05-15 11:24 - 2015-05-15 11:24 - 01640984 _____ C:\Users\Marvin\Downloads\SetupVirtualCloneDrive547.exe
2015-05-15 11:20 - 2015-05-15 11:20 - 02347384 _____ (ESET) C:\Users\Marvin\Downloads\esetsmartinstaller_deu.exe
2015-05-15 11:20 - 2015-05-15 11:20 - 00000000 ____D C:\Program Files (x86)\ESET
2015-05-15 11:16 - 2015-05-15 11:52 - 00000000 ____D C:\Users\Marvin\Downloads\Teamprojekt_Informationsmanagement_-_Sustainable_City_Game-Dokumente
2015-05-15 11:16 - 2015-05-15 11:16 - 00743912 _____ (Soft ) C:\Users\Marvin\Downloads\downloader_for_Alcohol120_FE_2.0.3.7612.exe
2015-05-15 11:15 - 2015-05-15 11:16 - 44326489 _____ C:\Users\Marvin\Downloads\Teamprojekt_Informationsmanagement_-_Sustainable_City_Game-Dokumente.zip
2015-05-12 20:52 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-12 20:52 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-12 20:10 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-12 20:10 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-12 20:10 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-12 20:10 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-12 20:09 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-12 20:09 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-12 20:09 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-12 20:09 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-12 20:09 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-12 20:09 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-12 20:09 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-12 20:09 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-12 20:09 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-12 20:09 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-12 20:09 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-12 20:09 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-12 20:09 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-12 20:09 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-12 20:09 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-12 20:09 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-12 20:09 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-12 20:09 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-12 20:09 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-12 20:09 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-12 20:09 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-12 20:09 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-12 20:09 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-12 20:09 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-12 20:09 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-12 20:09 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-12 20:09 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-12 20:09 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-12 20:09 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-12 20:09 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-12 20:09 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-12 20:09 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-12 20:09 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-12 20:09 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-12 20:09 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-12 20:09 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-12 20:09 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-12 20:09 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-12 20:09 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-12 20:09 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-12 20:09 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-12 20:09 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-12 20:09 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-12 20:09 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-12 20:09 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-12 20:09 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-12 20:09 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-12 20:09 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-12 20:09 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-12 20:09 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-12 20:09 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-12 20:09 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-12 20:09 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-12 20:09 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-12 20:09 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-12 20:09 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-12 20:09 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-12 20:09 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-12 20:09 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-12 20:09 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-12 20:08 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-12 20:08 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-12 20:08 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-12 20:08 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-12 20:08 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-12 20:08 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-12 20:08 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-12 20:08 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-12 20:08 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-12 20:08 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-12 20:08 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-12 20:08 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-12 20:08 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-12 20:08 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-12 20:08 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-12 20:08 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-12 20:08 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-12 20:08 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-12 20:08 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-12 20:08 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-12 20:08 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-12 20:08 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-12 20:08 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-12 20:08 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-12 20:08 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-12 20:08 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-12 20:08 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-12 20:08 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-12 20:08 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-12 20:08 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-12 20:08 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-12 20:08 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-12 20:08 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-12 20:08 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-12 20:08 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-12 20:08 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-12 20:08 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-12 20:08 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-12 20:08 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-12 20:08 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-12 20:08 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-12 20:08 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-12 20:08 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-12 20:06 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-12 20:06 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-12 20:06 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-12 20:06 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-12 20:06 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-12 20:06 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-12 20:06 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-09 10:53 - 2015-05-09 10:56 - 00001139 _____ C:\Users\Marvin\Desktop\window - Kopie.lnk
2015-05-08 11:26 - 2015-05-08 11:26 - 02045967 _____ C:\Users\Marvin\Downloads\sammeldownload_20150508_112612.zip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-07 10:30 - 2014-09-27 22:30 - 01123122 _____ C:\Windows\WindowsUpdate.log
2015-06-07 10:27 - 2015-03-15 16:31 - 00000000 ____D C:\ProgramData\Origin
2015-06-07 10:27 - 2015-01-01 15:24 - 00000000 ____D C:\Users\Marvin\AppData\Local\LogMeIn Hamachi
2015-06-07 10:27 - 2014-11-30 17:27 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\Dropbox
2015-06-07 10:27 - 2014-10-02 12:04 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-07 10:27 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-07 10:27 - 2009-07-14 06:56 - 00758252 _____ C:\Windows\setupact.log
2015-06-07 10:26 - 2014-09-27 22:30 - 00000000 ____D C:\Users\Marvin
2015-06-07 10:13 - 2009-07-14 06:50 - 00028176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-07 10:13 - 2009-07-14 06:50 - 00028176 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-07 10:09 - 2011-04-12 10:14 - 00699092 _____ C:\Windows\system32\perfh007.dat
2015-06-07 10:09 - 2011-04-12 10:14 - 00149232 _____ C:\Windows\system32\perfc007.dat
2015-06-07 10:09 - 2009-07-14 07:12 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-07 10:04 - 2015-02-07 20:01 - 00000000 ____D C:\AdwCleaner
2015-06-07 10:01 - 2015-04-15 14:27 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-06 13:46 - 2015-03-15 16:33 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\Origin
2015-06-06 13:45 - 2015-03-15 16:31 - 00000000 ____D C:\Program Files (x86)\Origin
2015-06-06 12:30 - 2015-02-01 19:01 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\Audacity
2015-06-06 11:09 - 2014-09-27 22:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-06 11:09 - 2010-11-21 05:47 - 00021134 _____ C:\Windows\PFRO.log
2015-06-05 23:07 - 2014-12-16 13:41 - 00000000 ____D C:\Users\Marvin\AppData\Local\PokerStars.EU
2015-06-05 22:18 - 2009-07-14 07:38 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-05 21:51 - 2015-03-29 13:01 - 00000000 ____D C:\Users\postgres
2015-06-04 21:52 - 2014-10-04 15:59 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\Skype
2015-05-31 19:55 - 2015-01-28 17:17 - 00000000 ____D C:\Users\Marvin\AppData\Local\com.surfeasy.se0200
2015-05-31 14:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-05-31 12:27 - 2015-04-15 14:27 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-31 12:27 - 2014-10-02 11:59 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-31 12:27 - 2014-10-02 11:59 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-31 12:27 - 2014-10-02 11:58 - 00000000 ____D C:\Users\Marvin\AppData\Local\Adobe
2015-05-23 20:25 - 2014-09-27 23:18 - 00000000 ____D C:\Users\Marvin\Steam
2015-05-20 20:44 - 2015-04-05 19:06 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-20 20:44 - 2015-04-05 19:06 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-17 18:54 - 2014-10-02 12:18 - 00087208 _____ C:\Users\Marvin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-05-17 16:28 - 2009-07-14 06:50 - 00364536 _____ C:\Windows\system32\FNTCACHE.DAT
2015-05-15 13:05 - 2014-12-16 13:21 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\vlc
2015-05-15 11:31 - 2015-04-24 20:44 - 00000000 ____D C:\Program Files (x86)\Alcohol Soft
2015-05-14 18:03 - 2014-12-02 18:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-05-14 18:03 - 2014-11-23 17:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-05-13 11:26 - 2011-04-12 10:24 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-13 11:26 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-12 20:57 - 2014-09-27 22:58 - 00000000 ____D C:\Windows\system32\MRT
2015-05-12 20:55 - 2014-09-27 22:58 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-12 20:12 - 2014-11-23 17:30 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-12 19:29 - 2014-11-30 17:28 - 00000000 ____D C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-10 01:01 - 2014-12-16 13:41 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2015-05-09 18:40 - 2015-02-07 19:37 - 00000992 _____ C:\Users\Marvin\Desktop\Core Temp.lnk
2015-05-09 10:00 - 2014-10-04 15:59 - 00000000 ____D C:\ProgramData\Skype

==================== Files in the root of some directories =======

2015-05-15 11:33 - 2015-05-15 11:33 - 0000026 _____ () C:\Users\Marvin\AppData\Local\isoworkshop.ini
2015-02-04 22:22 - 2015-02-04 22:22 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-03-29 13:31 - 2015-03-29 13:31 - 0004939 _____ () C:\ProgramData\flwjycbm.bab

Some files in TEMP:
====================
C:\Users\Marvin\AppData\Local\Temp\AxSFADownloader.exe
C:\Users\Marvin\AppData\Local\Temp\bitool.dll
C:\Users\Marvin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpiop7mq.dll
C:\Users\Marvin\AppData\Local\Temp\f4f2a446-6cf6-458d-b85a-dcb16e8ac472.exe
C:\Users\Marvin\AppData\Local\Temp\ose00000.exe
C:\Users\Marvin\AppData\Local\Temp\PidGenX.dll
C:\Users\Marvin\AppData\Local\Temp\Quarantine.exe
C:\Users\Marvin\AppData\Local\Temp\setup.exe
C:\Users\Marvin\AppData\Local\Temp\SIInvoker.exe
C:\Users\Marvin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Marvin\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-05 23:48

==================== End of log ============================
--- --- ---






Addition
[CODE]
Additional
FRST Logfile:
Code:
scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by Marvin at 2015-06-07 10:31:57
Running from C:\Users\Marvin\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-926302194-777514634-3206159580-500 - Administrator - Disabled)
Gast (S-1-5-21-926302194-777514634-3206159580-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-926302194-777514634-3206159580-1006 - Limited - Enabled)
Marvin (S-1-5-21-926302194-777514634-3206159580-1000 - Administrator - Enabled) => C:\Users\Marvin
postgres (S-1-5-21-926302194-777514634-3206159580-1004 - Limited - Enabled) => C:\Users\postgres

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
bwin Poker (HKLM-x32\...\bwincomPoker) (Version:  - bwincom)
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version:  - Canon Inc.)
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.05152 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.05152 - Cisco Systems, Inc.) Hidden
Command & Conquer™ Red Alert 2 and Yuri’s Revenge (HKLM-x32\...\{F5275D1C-D133-486D-8F07-D6C571F0A8EC}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
Dropbox (HKU\S-1-5-21-926302194-777514634-3206159580-1000\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Free Audio Converter version 5.0.56.128 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.56.128 - DVDVideoSoft Ltd.)
Holdem Manager 2 (HKLM-x32\...\HoldemManager2) (Version:  - )
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Photosmart 7520 series - Grundlegende Software für das Gerät (HKLM\...\{62883BA5-32F6-44D0-AF9D-9CBED778F36F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Photosmart 7520 series Hilfe (HKLM-x32\...\{2230C40A-ADE0-4231-98EC-7AAFC14BC7F3}) (Version: 28.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
IBM SPSS Statistics 22 (HKLM\...\{104875A1-D083-4A34-BC4F-3F635B7F8EF7}) (Version: 22.0.0.0 - IBM Corp)
ISO Workshop 5.9 (HKLM-x32\...\ISO Workshop_is1) (Version:  - Glorylogic)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.328 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.328 - LogMeIn, Inc.) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Project Professional 2013 (HKLM\...\Office15.PRJPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visio Professional 2013 (HKLM\...\Office15.VISPROR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
MSI Afterburner 4.1.1 (HKLM-x32\...\Afterburner) (Version: 4.1.1 - MSI Co., LTD)
NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)
NVIDIA Update 10.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 10.4.0 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.5.5.2850 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.51.17865 - pdfforge GmbH)
PDF Architect 2 Create Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 Edit Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDF Architect 2 View Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
PokerTracker 4 (remove only) (HKLM-x32\...\PokerTracker4) (Version:  - )
PostgreSQL 8.4 (HKLM-x32\...\PostgreSQL 8.4) (Version: 8.4 - PostgreSQL Global Development Group)
RivaTuner Statistics Server 6.3.0 (HKLM-x32\...\RTSS) (Version: 6.3.0 - Unwinder)
Secure Download Manager (HKLM-x32\...\{C58626D6-7EBD-460D-8B6C-75B3C3464879}) (Version: 3.1.60 - Kivuto Solutions Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Sparkol VideoScribe (HKLM-x32\...\Sparkol VideoScribe 2.0.3) (Version: 2.0.3 - Sparkol)
Sparkol VideoScribe (x32 Version: 2.0.3 - Sparkol) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
SurfEasy VPN 3.0.400 (HKLM-x32\...\SurfEasy VPN) (Version: 3.0.400 - SurfEasy Inc)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.41459 - TeamViewer)
The Guild Gold Edition (HKLM-x32\...\Steam App 39520) (Version:  - 4HEAD Studios)
The Guild II - Pirates of the European Seas (HKLM-x32\...\Steam App 39660) (Version:  - 4 Head Studios)
The Guild II (HKLM-x32\...\Steam App 39650) (Version:  - 4 Head Studios)
The Guild II: Renaissance (HKLM-x32\...\Steam App 39680) (Version:  - Rune Forge)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WestwoodOnline (HKLM-x32\...\{BBCD6D56-8A26-4DDE-9482-DBC9C7B7341D}) (Version: 1.0.0.0 - WestwoodOnline)
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version:  - )
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WISO Steuer-Sparbuch 2014 (HKLM-x32\...\{985852ED-F80C-43D2-8F38-DC2EF7AA07FB}) (Version: 21.01.8499 - Buhl Data Service GmbH)
WISO Steuer-Sparbuch 2015 (HKLM-x32\...\{62B8D13D-1245-4C12-9938-4F5379120DF0}) (Version: 22.00.8811 - Buhl Data Service GmbH)
Xvid 1.2.2 final uninstall (HKLM-x32\...\Xvid_is1) (Version: 1.2 - Xvid team (Koepi))

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-926302194-777514634-3206159580-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marvin\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

08-05-2015 11:15:18 Windows Update
12-05-2015 19:55:02 Windows Update
12-05-2015 20:50:16 Windows Update
14-05-2015 18:03:33 Windows Update
14-05-2015 19:20:04 Gerätetreiber-Paketinstallation: DT Soft Ltd Systemgeräte
15-05-2015 11:25:39 Gerätetreiber-Paketinstallation: Elaborate Bytes AG Speichercontroller
19-05-2015 10:07:40 Windows Update
20-05-2015 20:44:46 Windows Update
30-05-2015 19:19:42 Windows Update
31-05-2015 12:22:41 Installed IBM SPSS Statistics 22.
31-05-2015 22:53:29 Windows Update
04-06-2015 21:13:13 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-03-04 18:10 - 00000909 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 on4u3.buhl.de

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {224DBEA9-51A2-45A7-8384-3F4263E0A466} - System32\Tasks\HP AR Program Upload - 44684f70d59e44f895b634c2e1e129369db10c18c69b4dcaa8ff37fd55338f88 => C:\Program Files\HP\HP Photosmart 7520 series\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {4F444322-8A6C-415D-850A-E00F0DAE6F2D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {511826CB-2ED2-4D2B-8806-1DB06BFBB747} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-31] (Adobe Systems Incorporated)
Task: {5A44AAC8-8568-4AB8-A9AC-A048428590F0} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {5CC84938-590A-42FA-8C05-411994FA1B68} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {8A6F5EF4-D317-4341-B596-17CA0D4EBBA7} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {A8909099-3C82-4D02-B779-5ADEEE16B62C} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {CFEFEB2B-F096-4C81-B5E2-3466EA756B0A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2014-10-02 12:04 - 2014-07-02 20:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-17 01:18 - 2015-01-17 01:18 - 13421936 _____ () C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe
2015-01-17 01:18 - 2015-01-17 01:18 - 03272048 _____ () C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe
2015-06-07 10:26 - 2015-06-07 10:26 - 00050477 _____ () C:\Users\Marvin\Downloads\Defogger.exe
2013-12-13 00:36 - 2013-12-13 00:36 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2015-01-17 01:18 - 2015-01-17 01:18 - 00089456 _____ () C:\Program Files (x86)\SurfEasy VPN\client\zlib.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 01007104 _____ () C:\Program Files (x86)\Origin\platforms\qwindows.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 00023552 _____ () C:\Program Files (x86)\Origin\imageformats\qgif.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 00024576 _____ () C:\Program Files (x86)\Origin\imageformats\qico.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 00216576 _____ () C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 00261120 _____ () C:\Program Files (x86)\Origin\imageformats\qmng.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 00019456 _____ () C:\Program Files (x86)\Origin\imageformats\qtga.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 00337408 _____ () C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2015-03-15 16:32 - 2015-06-06 13:45 - 00018944 _____ () C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2015-06-07 10:27 - 2015-06-07 10:27 - 00043008 _____ () c:\users\marvin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpiop7mq.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Marvin\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-03-29 13:00 - 2014-02-18 10:11 - 00172032 _____ () c:\postgreSQL\bin\LIBPQ.dll
2015-03-29 13:01 - 2012-08-14 15:19 - 00999424 _____ () c:\postgreSQL\bin\libxml2.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Marvin\Desktop\Ergebnis_Übung_2_Hier stand ein Name Version 2.pptx:com.dropbox.attributes
AlternateDataStreams: C:\Users\Marvin\Desktop\Innovationsprojekt Video_Kristoph.scribe:com.dropbox.attributes
AlternateDataStreams: C:\Users\Marvin\Desktop\Präsentation_Prozessanalyse.pptx:com.dropbox.attributes
AlternateDataStreams: C:\Users\Marvin\Desktop\Seminararbeit_foundup.docx:com.dropbox.attributes
AlternateDataStreams: C:\Users\Marvin\Desktop\tonspur 1.wav:com.dropbox.attributes
AlternateDataStreams: C:\Users\Marvin\Desktop\wi2_vorlage_seminararbeit.doc:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-926302194-777514634-3206159580-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{25B41DFD-D820-4274-9861-A54381441263}] => (Allow) C:\Users\Marvin\Steam\Steam.exe
FirewallRules: [{51F0B131-812F-4576-8CF9-62EEE6A59134}] => (Allow) C:\Users\Marvin\Steam\Steam.exe
FirewallRules: [{940F26A6-6971-44CE-A60E-D4009DFC9F38}] => (Allow) C:\Users\Marvin\Steam\bin\steamwebhelper.exe
FirewallRules: [{B3D6BF4A-7435-4858-8205-8C920361C82B}] => (Allow) C:\Users\Marvin\Steam\bin\steamwebhelper.exe
FirewallRules: [{62177B54-98E8-4F60-8911-DB5A236AE8A5}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{B8990157-7850-4029-92F8-33DA5EAB4338}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{E2273E64-5C99-4974-908C-2EF43B33A981}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{B0AA02D8-C349-439C-AB23-A575D90C5173}] => (Allow) C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{BB086168-CE0C-42E4-88F1-F02C0CBC40A6}] => (Allow) C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{660A29A4-D3EF-4D07-A2C6-19B1A7373F8F}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\Europa 1400 The Guild - Gold Edition\Europa1400Gold.exe
FirewallRules: [{D92B7EED-1D26-4195-A66F-117B2FBD7CC6}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\Europa 1400 The Guild - Gold Edition\Europa1400Gold.exe
FirewallRules: [{E9C53259-6F9F-412F-965F-8E6FE1A1CD55}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\Europa 1400 The Guild - Gold Edition\Europa1400Gold_TL.exe
FirewallRules: [{118D7107-F7D3-4AB3-9DB0-E327E98FDFFE}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\Europa 1400 The Guild - Gold Edition\Europa1400Gold_TL.exe
FirewallRules: [TCP Query User{999E1D5E-553A-49EC-95A0-EC188D8585C5}F:\die gilde gold-edition\die gilde gold-edition\gildegold_tl.exe] => (Allow) F:\die gilde gold-edition\die gilde gold-edition\gildegold_tl.exe
FirewallRules: [UDP Query User{88E9BB06-2E5B-4B09-814D-1653DCD6C8FC}F:\die gilde gold-edition\die gilde gold-edition\gildegold_tl.exe] => (Allow) F:\die gilde gold-edition\die gilde gold-edition\gildegold_tl.exe
FirewallRules: [{5301F3E4-7C67-43DC-AB11-0B4CF5FB82C5}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\The Guild II\GuildII.exe
FirewallRules: [{B3B804F1-1325-42D6-8346-B6E287BC2E02}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\The Guild II\GuildII.exe
FirewallRules: [TCP Query User{1E4370B3-327C-4AAE-8402-9F7D587259B9}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{8B6153AE-00D0-4586-A206-1767FB713F7B}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{CF235A5E-6BEF-4BEF-A858-E9C309784E71}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\The Guild II - Pirates of the European Seas\GuildII.exe
FirewallRules: [{CBE87EAB-F633-470E-AC4A-51CD8173EAB2}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\The Guild II - Pirates of the European Seas\GuildII.exe
FirewallRules: [{1FD7479A-2BCC-44B8-912A-C87E6DCCCB0A}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\The Guild 2 Renaissance\GuildII.exe
FirewallRules: [{40C22BD5-2523-46D4-9C8E-678228F2ED90}] => (Allow) C:\Users\Marvin\Steam\SteamApps\common\The Guild 2 Renaissance\GuildII.exe
FirewallRules: [{3BFBA6D5-C0CF-4EC9-BB36-C9FC1EB3DEC0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D00D840C-9686-4B80-8654-DE33252DC61B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{BF984231-866D-460B-A4A4-C06263284C6F}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\FaxApplications.exe
FirewallRules: [{46A74EC2-ED95-4F06-9CDB-F27882A4C761}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\DigitalWizards.exe
FirewallRules: [{8A8F33FF-5D6C-40A6-AD79-401324F219FD}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\SendAFax.exe
FirewallRules: [{16C5008D-34FE-475D-9866-53C88BC7DF5B}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\DeviceSetup.exe
FirewallRules: [{74EDC714-0479-473C-8A17-BE230EB57F9B}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe
FirewallRules: [{9266A252-89CD-43A5-B9F3-D212FE200464}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{E740DAE8-C77B-4311-8A29-A232D9DDE275}] => (Allow) C:\Program Files (x86)\Origin Games\Command and Conquer Red Alert II\RA2Launcher.exe
FirewallRules: [{DC7935D4-508B-43B2-860E-D349CC3ECA96}] => (Allow) C:\Program Files (x86)\Origin Games\Command and Conquer Red Alert II\RA2Launcher.exe
FirewallRules: [TCP Query User{A5A05B19-57AE-43A6-9D41-24D4C1DC3C02}C:\program files (x86)\origin games\command and conquer red alert ii\gamemd.exe] => (Allow) C:\program files (x86)\origin games\command and conquer red alert ii\gamemd.exe
FirewallRules: [UDP Query User{04DACBA1-A3E8-4330-8FB0-37268C91946A}C:\program files (x86)\origin games\command and conquer red alert ii\gamemd.exe] => (Allow) C:\program files (x86)\origin games\command and conquer red alert ii\gamemd.exe
FirewallRules: [TCP Query User{6FB427AD-3794-4BBD-8575-75414A46A7DE}C:\program files (x86)\origin games\command and conquer red alert ii\game.dat] => (Allow) C:\program files (x86)\origin games\command and conquer red alert ii\game.dat
FirewallRules: [UDP Query User{1AA75E57-9BEF-46E1-A31D-A9A5F9C40394}C:\program files (x86)\origin games\command and conquer red alert ii\game.dat] => (Allow) C:\program files (x86)\origin games\command and conquer red alert ii\game.dat
FirewallRules: [{524CDABC-41CA-40E1-BF7A-0FD86E1E2946}] => (Allow) LPort=5432
FirewallRules: [{652D1819-B685-4BE3-A559-392C0AE2E437}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{2B258B61-DF91-43FF-84D7-88C673D4A557}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{BEC095D7-58A8-43D8-8AA1-03BA102571B9}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{CBBF3E01-33F4-4E0A-BB45-6FC143A16741}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{7ADDB1B1-C1B9-48DD-B238-9D865CA4E8E7}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{E3FF0A91-94B7-4DAE-83D1-8203B01C767E}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [{8856E7E8-C29E-4095-A2A3-F75C09C7600E}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{79665340-07D3-4D43-91FB-A974A3A1856A}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{E749FCC3-0299-40F2-A272-7E98CA908A32}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{253F7173-174D-4273-8FCC-F4325ECEDDD3}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [TCP Query User{DA6AD03F-31E9-40C5-BC38-9F9B5B511B80}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [UDP Query User{4EFA2C43-D73C-46CB-B3D0-DD7E6A87146F}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [TCP Query User{D42C7899-51E5-4E1F-91EF-B0FDC014EC35}C:\users\marvin\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\marvin\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{B8B02178-9858-476E-9000-01DC78019406}C:\users\marvin\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\marvin\appdata\roaming\dropbox\bin\dropbox.exe

==================== Faulty Device Manager Devices =============

Name: High Definition Audio-Gerät
Description: High Definition Audio-Gerät
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: HdAudAddService
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/07/2015 10:29:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 10:27:42 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2015-06-07 10:27:42 CESTFATAL:  the database system is starting up

Error: (06/07/2015 10:26:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_DiagTrack, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18839, Zeitstempel: 0x553e8bfa
Ausnahmecode: 0xc000000d
Fehleroffset: 0x000000000006ec12
ID des fehlerhaften Prozesses: 0x71c
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_DiagTrack0
Pfad der fehlerhaften Anwendung: svchost.exe_DiagTrack1
Pfad des fehlerhaften Moduls: svchost.exe_DiagTrack2
Berichtskennung: svchost.exe_DiagTrack3

Error: (06/07/2015 10:07:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 10:05:30 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2015-06-07 10:05:29 CESTFATAL:  the database system is starting up

Error: (06/07/2015 10:04:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_DiagTrack, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18839, Zeitstempel: 0x553e8bfa
Ausnahmecode: 0xc000000d
Fehleroffset: 0x000000000006ec12
ID des fehlerhaften Prozesses: 0x788
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_DiagTrack0
Pfad der fehlerhaften Anwendung: svchost.exe_DiagTrack1
Pfad des fehlerhaften Moduls: svchost.exe_DiagTrack2
Berichtskennung: svchost.exe_DiagTrack3

Error: (06/07/2015 09:48:52 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.

Error: (06/07/2015 09:42:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 09:41:12 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2015-06-07 09:41:12 CESTFATAL:  the database system is starting up

Error: (06/07/2015 09:29:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (06/07/2015 10:26:45 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Diagnostics Tracking Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/07/2015 10:04:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Diagnostics Tracking Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "LogMeIn Hamachi Tunneling Engine" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SurfEasy Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "postgresql-8.4 - PostgreSQL Server 8.4" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PDF Architect 2 Creator" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/07/2015 10:04:11 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Cisco AnyConnect Secure Mobility Agent" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office:
=========================
Error: (06/07/2015 10:29:25 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 10:27:42 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2015-06-07 10:27:42 CESTFATAL:  the database system is starting up

Error: (06/07/2015 10:26:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_DiagTrack6.1.7600.163854a5bc3c1ntdll.dll6.1.7601.18839553e8bfac000000d000000000006ec1271c01d0a0f8b740f00eC:\Windows\System32\svchost.exeC:\Windows\SYSTEM32\ntdll.dllee4ab581-0cee-11e5-b1e4-001a4d4c7236

Error: (06/07/2015 10:07:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 10:05:30 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2015-06-07 10:05:29 CESTFATAL:  the database system is starting up

Error: (06/07/2015 10:04:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_DiagTrack6.1.7600.163854a5bc3c1ntdll.dll6.1.7601.18839553e8bfac000000d000000000006ec1278801d0a0f551f785e6C:\Windows\System32\svchost.exeC:\Windows\SYSTEM32\ntdll.dlld0b0dfc9-0ceb-11e5-bffb-001a4d4c7236

Error: (06/07/2015 09:48:52 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (06/07/2015 09:42:55 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/07/2015 09:41:12 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: 2015-06-07 09:41:12 CESTFATAL:  the database system is starting up

Error: (06/07/2015 09:29:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2015-04-13 19:56:32.241
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:56:32.203
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:58.717
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:58.685
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:57.103
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:57.066
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:56.589
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:56.554
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:55.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-04-13 19:55:55.203
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume6\Windows\System32\nQAPO.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz
Percentage of memory in use: 40%
Total physical RAM: 4094.49 MB
Available physical RAM: 2421.72 MB
Total Pagefile: 8188.7 MB
Available Pagefile: 5388.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.47 GB) (Free:157.22 GB) NTFS
Drive d: (Volume) (Fixed) (Total:698.63 GB) (Free:600.04 GB) NTFS
Drive e: () (Fixed) (Total:97.65 GB) (Free:16.48 GB) NTFS
Drive f: () (Fixed) (Total:319.27 GB) (Free:4.4 GB) NTFS
Drive g: () (Fixed) (Total:48.73 GB) (Free:2.8 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: C177C177)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=48.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=416.9 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 4D60EC6C)
Partition 1: (Not Active) - (Size=698.6 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 2F57C575)
Partition 1: (Not Active) - (Size=238.5 GB) - (Type=07 NTFS)

==================== End of log ============================
--- --- ---

Large1337 07.06.2015 11:29
GMER

Code:
GMER Logfile:

       
Code:

       
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-07 10:35:10
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T0L0-3 TS256GSSD370 rev.20140402 238,47GB
Running: Gmer-19357.exe; Driver: C:\Users\Marvin\AppData\Local\Temp\pxdiypob.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                    0000000074ff1401 2 bytes JMP 76d7b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                      0000000074ff1419 2 bytes JMP 76d7b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                    0000000074ff1431 2 bytes JMP 76df8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                    0000000074ff144a 2 bytes CALL 76d5489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                       0000000074ff14dd 2 bytes JMP 76df8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                0000000074ff14f5 2 bytes JMP 76df89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                       0000000074ff150d 2 bytes JMP 76df8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                0000000074ff1525 2 bytes JMP 76df8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                      0000000074ff153d 2 bytes JMP 76d6fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                           0000000074ff1555 2 bytes JMP 76d768ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                    0000000074ff156d 2 bytes JMP 76df8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                      0000000074ff1585 2 bytes JMP 76df8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                         0000000074ff159d 2 bytes JMP 76df86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                      0000000074ff15b5 2 bytes JMP 76d6fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                    0000000074ff15cd 2 bytes JMP 76d7b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                0000000074ff16b2 2 bytes JMP 76df8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe[1132] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                0000000074ff16bd 2 bytes JMP 76df8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\kernel32.dll!CreateFileW                                                                                                                                                                 0000000076d53f0c 5 bytes JMP 00000001681407c0
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!SetWindowPos                                                                                                                                                                  0000000075828e4e 5 bytes JMP 000000016813fca0
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!ShowWindow                                                                                                                                                                    0000000075830dfb 5 bytes JMP 000000016813fa80
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!SetFocus                                                                                                                                                                      0000000075832175 5 bytes JMP 000000016813fb90
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!SetActiveWindow                                                                                                                                                               0000000075833208 5 bytes JMP 000000016813fdb0
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!BringWindowToTop                                                                                                                                                              0000000075837b3b 5 bytes JMP 000000016813f7b0
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!SetForegroundWindow                                                                                                                                                           000000007584f170 5 bytes JMP 000000016813f6a0
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!SwitchToThisWindow                                                                                                                                                            00000000758690fc 5 bytes JMP 000000016813f8c0
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\USER32.dll!ShowWindowAsync                                                                                                                                                               0000000075887d97 5 bytes JMP 000000016813f970
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\ole32.dll!DoDragDrop                                                                                                                                                                     0000000074d3a827 5 bytes JMP 000000016813f5b0
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                      0000000074ff1401 2 bytes JMP 76d7b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                        0000000074ff1419 2 bytes JMP 76d7b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                      0000000074ff1431 2 bytes JMP 76df8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                      0000000074ff144a 2 bytes CALL 76d5489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                         0000000074ff14dd 2 bytes JMP 76df8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                  0000000074ff14f5 2 bytes JMP 76df89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                         0000000074ff150d 2 bytes JMP 76df8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                  0000000074ff1525 2 bytes JMP 76df8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                        0000000074ff153d 2 bytes JMP 76d6fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                             0000000074ff1555 2 bytes JMP 76d768ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                      0000000074ff156d 2 bytes JMP 76df8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                        0000000074ff1585 2 bytes JMP 76df8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                           0000000074ff159d 2 bytes JMP 76df86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                        0000000074ff15b5 2 bytes JMP 76d6fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                      0000000074ff15cd 2 bytes JMP 76d7b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                  0000000074ff16b2 2 bytes JMP 76df8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Origin\Origin.exe[1616] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                  0000000074ff16bd 2 bytes JMP 76df8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17                                                                                                                                       0000000074ff1401 2 bytes JMP 76d7b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17                                                                                                                                         0000000074ff1419 2 bytes JMP 76d7b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17                                                                                                                                       0000000074ff1431 2 bytes JMP 76df8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42                                                                                                                                       0000000074ff144a 2 bytes CALL 76d5489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17                                                                                                                                          0000000074ff14dd 2 bytes JMP 76df8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                   0000000074ff14f5 2 bytes JMP 76df89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17                                                                                                                                          0000000074ff150d 2 bytes JMP 76df8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                   0000000074ff1525 2 bytes JMP 76df8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17                                                                                                                                         0000000074ff153d 2 bytes JMP 76d6fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17                                                                                                                                              0000000074ff1555 2 bytes JMP 76d768ef C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                       0000000074ff156d 2 bytes JMP 76df8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17                                                                                                                                         0000000074ff1585 2 bytes JMP 76df8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17                                                                                                                                            0000000074ff159d 2 bytes JMP 76df86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17                                                                                                                                         0000000074ff15b5 2 bytes JMP 76d6fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17                                                                                                                                       0000000074ff15cd 2 bytes JMP 76d7b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                   0000000074ff16b2 2 bytes JMP 76df8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe[1892] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                   0000000074ff16bd 2 bytes JMP 76df8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetModuleFileNameExW + 17                                                                                                                                       0000000074ff1401 2 bytes JMP 76d7b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!EnumProcessModules + 17                                                                                                                                         0000000074ff1419 2 bytes JMP 76d7b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetModuleInformation + 17                                                                                                                                       0000000074ff1431 2 bytes JMP 76df8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetModuleInformation + 42                                                                                                                                       0000000074ff144a 2 bytes CALL 76d5489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!EnumDeviceDrivers + 17                                                                                                                                          0000000074ff14dd 2 bytes JMP 76df8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                   0000000074ff14f5 2 bytes JMP 76df89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!QueryWorkingSetEx + 17                                                                                                                                          0000000074ff150d 2 bytes JMP 76df8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                   0000000074ff1525 2 bytes JMP 76df8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetModuleBaseNameW + 17                                                                                                                                         0000000074ff153d 2 bytes JMP 76d6fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!EnumProcesses + 17                                                                                                                                              0000000074ff1555 2 bytes JMP 76d768ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetProcessMemoryInfo + 17                                                                                                                                       0000000074ff156d 2 bytes JMP 76df8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetPerformanceInfo + 17                                                                                                                                         0000000074ff1585 2 bytes JMP 76df8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!QueryWorkingSet + 17                                                                                                                                            0000000074ff159d 2 bytes JMP 76df86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetModuleBaseNameA + 17                                                                                                                                         0000000074ff15b5 2 bytes JMP 76d6fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetModuleFileNameExA + 17                                                                                                                                       0000000074ff15cd 2 bytes JMP 76d7b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetProcessImageFileNameW + 20                                                                                                                                   0000000074ff16b2 2 bytes JMP 76df8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[2096] C:\Windows\syswow64\PsApi.dll!GetProcessImageFileNameW + 31                                                                                                                                   0000000074ff16bd 2 bytes JMP 76df8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                        0000000074ff1401 2 bytes JMP 76d7b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                          0000000074ff1419 2 bytes JMP 76d7b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                        0000000074ff1431 2 bytes JMP 76df8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                        0000000074ff144a 2 bytes CALL 76d5489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                         * 9
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                           0000000074ff14dd 2 bytes JMP 76df8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                    0000000074ff14f5 2 bytes JMP 76df89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                           0000000074ff150d 2 bytes JMP 76df8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                    0000000074ff1525 2 bytes JMP 76df8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                          0000000074ff153d 2 bytes JMP 76d6fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                               0000000074ff1555 2 bytes JMP 76d768ef C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                        0000000074ff156d 2 bytes JMP 76df8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                          0000000074ff1585 2 bytes JMP 76df8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                             0000000074ff159d 2 bytes JMP 76df86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                          0000000074ff15b5 2 bytes JMP 76d6fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                        0000000074ff15cd 2 bytes JMP 76d7b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                    0000000074ff16b2 2 bytes JMP 76df8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Users\Marvin\Downloads\Defogger.exe[4960] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                    0000000074ff16bd 2 bytes JMP 76df8671 C:\Windows\syswow64\kernel32.dll
---- Processes - GMER 2.1 ----

Library  c:\users\marvin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpiop7mq.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892](2015-06-07 08:27:44)                                       0000000003d50000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24)           00000000707c0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (ICU I18N DLL/The ICU Project)(2015-03-04 21:45:30)                                                           000000004a900000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (ICU Common DLL/The ICU Project)(2015-03-04 21:45:30)                                                         0000000005ca0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (ICU Data DLL/The ICU Project)(2015-03-04 21:45:30)                                                           000000004ad00000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)        0000000070310000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            000000006ff50000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892](2015-03-04 21:45:30)                                                                                        000000006fdf0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)        000000006f900000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)         000000006e410000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)          000000006f6e0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            000000006f480000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)            00000000722c0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892](2015-03-04 21:45:30)                                                                                           00000000722b0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28)  0000000072280000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)         00000000702d0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26)   000000006ff00000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892](2015-03-04 21:45:30)                                                                       000000006e2f0000
Library  C:\Users\Marvin\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Marvin\AppData\Roaming\Dropbox\bin\Dropbox.exe [1892](2015-03-04 21:45:30)                                                                       000000006e2b0000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                                                                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                                                                                                                         1
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                                                                                                                      0x6F 0x91 0xCF 0xCB ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                                                                                                         D:\DAEMON Tools Lite\
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                                                                         0x00 0x00 0x00 0x00 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                                                         0
Reg      HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                                                      0x60 0x87 0x9B 0xD7 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                                                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                                                                                                                             1
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                                                                                                                          0x6F 0x91 0xCF 0xCB ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                                                                       
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                                                                                                             D:\DAEMON Tools Lite\
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                                                                             0x00 0x00 0x00 0x00 ...
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                                                                             0
Reg      HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                                                                          0x60 0x87 0x9B 0xD7 ...
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Marvin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics\IBM SPSS Statistics 22 \x2013 Pendlerlizenz.lnk                                    1
Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IBM SPSS Statistics\IBM SPSS Statistics 22 \x2013 Pendlerlizenz.lnk                                                     1

---- EOF - GMER 2.1 ----

--- --- ---

schrauber 08.06.2015 06:10
hi,

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Large1337 24.06.2015 19:23
Hallo mein System hat eine zeitlang nicht funktioniert da scheinbar meine Grafikkarte den Geist aufgegeben hat. Habe jetzt eine neue gebrauchte (8800gtx 768mb) und be quiet! 430w L8 Netzteil.
Anbei die Codes:
Code:
20:16:15.0325 0x1320  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
20:16:18.0344 0x1320  ============================================================
20:16:18.0344 0x1320  Current date / time: 2015/06/24 20:16:18.0344
20:16:18.0344 0x1320  SystemInfo:
20:16:18.0344 0x1320 
20:16:18.0344 0x1320  OS Version: 6.1.7601 ServicePack: 1.0
20:16:18.0344 0x1320  Product type: Workstation
20:16:18.0344 0x1320  ComputerName: MARVIN-PC
20:16:18.0344 0x1320  UserName: Marvin
20:16:18.0344 0x1320  Windows directory: C:\Windows
20:16:18.0345 0x1320  System windows directory: C:\Windows
20:16:18.0345 0x1320  Running under WOW64
20:16:18.0345 0x1320  Processor architecture: Intel x64
20:16:18.0345 0x1320  Number of processors: 2
20:16:18.0345 0x1320  Page size: 0x1000
20:16:18.0345 0x1320  Boot type: Normal boot
20:16:18.0345 0x1320  ============================================================
20:16:18.0454 0x1320  KLMD registered as C:\Windows\system32\drivers\73828827.sys
20:16:18.0486 0x1320  System UUID: {6DB7E31D-5E56-D48C-6C67-C12B4FF18E56}
20:16:18.0759 0x1320  Drive \Device\Harddisk0\DR3 - Size: 0xAEA8BD5E00 ( 698.64 Gb ), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:16:18.0760 0x1320  Drive \Device\Harddisk1\DR1 - Size: 0x7470AFDE00 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xFC59, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
20:16:18.0760 0x1320  Drive \Device\Harddisk2\DR2 - Size: 0x3B9E656000 ( 238.47 Gb ), SectorSize: 0x200, Cylinders: 0x799A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:16:18.0764 0x1320  ============================================================
20:16:18.0764 0x1320  \Device\Harddisk0\DR3:
20:16:18.0764 0x1320  MBR partitions:
20:16:18.0764 0x1320  \Device\Harddisk0\DR3\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x57545000
20:16:18.0764 0x1320  \Device\Harddisk1\DR1:
20:16:18.0764 0x1320  MBR partitions:
20:16:18.0764 0x1320  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
20:16:18.0764 0x1320  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x6175000
20:16:18.0779 0x1320  \Device\Harddisk1\DR1\Partition3: MBR, Type 0x7, StartLBA 0x61A79A5, BlocksNum 0xC34F28D
20:16:18.0790 0x1320  \Device\Harddisk1\DR1\Partition4: MBR, Type 0x7, StartLBA 0x124F6C71, BlocksNum 0x27E8A10F
20:16:18.0790 0x1320  \Device\Harddisk2\DR2:
20:16:18.0794 0x1320  MBR partitions:
20:16:18.0794 0x1320  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1DCF2000
20:16:18.0794 0x1320  ============================================================
20:16:18.0795 0x1320  C: <-> \Device\Harddisk2\DR2\Partition1
20:16:18.0806 0x1320  D: <-> \Device\Harddisk0\DR3\Partition1
20:16:18.0814 0x1320  E: <-> \Device\Harddisk1\DR1\Partition3
20:16:18.0837 0x1320  F: <-> \Device\Harddisk1\DR1\Partition4
20:16:18.0865 0x1320  G: <-> \Device\Harddisk1\DR1\Partition2
20:16:18.0865 0x1320  ============================================================
20:16:18.0865 0x1320  Initialize success
20:16:18.0865 0x1320  ============================================================
20:17:11.0712 0x0790  ============================================================
20:17:11.0712 0x0790  Scan started
20:17:11.0712 0x0790  Mode: Manual; SigCheck; TDLFS;
20:17:11.0712 0x0790  ============================================================
20:17:11.0712 0x0790  KSN ping started
20:17:25.0186 0x0790  KSN ping finished: true
20:17:25.0562 0x0790  ================ Scan system memory ========================
20:17:25.0562 0x0790  System memory - ok
20:17:25.0562 0x0790  ================ Scan services =============================
20:17:25.0595 0x0790  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
20:17:25.0637 0x0790  1394ohci - ok
20:17:25.0652 0x0790  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
20:17:25.0668 0x0790  ACPI - ok
20:17:25.0675 0x0790  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
20:17:25.0687 0x0790  AcpiPmi - ok
20:17:25.0695 0x0790  [ D0B11E40EA74A98A5E133DF1F5276240, BAD5885CD8CC271D59DFA95159EFC3AC36D2BA11B6DA593AAED0C45F1C2F280F ] acsock          C:\Windows\system32\DRIVERS\acsock64.sys
20:17:25.0714 0x0790  acsock - ok
20:17:25.0721 0x0790  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
20:17:25.0732 0x0790  AdobeARMservice - ok
20:17:25.0753 0x0790  [ 6259A5B669AE018A5E53247259A101C3, 1CD2102FAF1DCEB6B8278D098A7C1A85ED6D6E5DCF7F70E0E9A5166B67C8D057 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:17:25.0768 0x0790  AdobeFlashPlayerUpdateSvc - ok
20:17:25.0783 0x0790  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
20:17:25.0805 0x0790  adp94xx - ok
20:17:25.0818 0x0790  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci        C:\Windows\system32\drivers\adpahci.sys
20:17:25.0836 0x0790  adpahci - ok
20:17:25.0847 0x0790  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
20:17:25.0863 0x0790  adpu320 - ok
20:17:25.0870 0x0790  [ 83BFCCAC53795E8A5055A93672D0C46C, B2B03473D950A5BA9DE59D81E7B14C1FAFF17B2A4D8A5808588F5CC21D63B291 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
20:17:25.0883 0x0790  AeLookupSvc - ok
20:17:25.0898 0x0790  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD            C:\Windows\system32\drivers\afd.sys
20:17:25.0921 0x0790  AFD - ok
20:17:25.0927 0x0790  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
20:17:25.0937 0x0790  agp440 - ok
20:17:25.0944 0x0790  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG            C:\Windows\System32\alg.exe
20:17:25.0957 0x0790  ALG - ok
20:17:25.0961 0x0790  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
20:17:25.0971 0x0790  aliide - ok
20:17:25.0976 0x0790  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
20:17:25.0985 0x0790  amdide - ok
20:17:25.0992 0x0790  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
20:17:26.0005 0x0790  AmdK8 - ok
20:17:26.0011 0x0790  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
20:17:26.0022 0x0790  AmdPPM - ok
20:17:26.0029 0x0790  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
20:17:26.0042 0x0790  amdsata - ok
20:17:26.0052 0x0790  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
20:17:26.0066 0x0790  amdsbs - ok
20:17:26.0071 0x0790  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata        C:\Windows\system32\drivers\amdxata.sys
20:17:26.0081 0x0790  amdxata - ok
20:17:26.0087 0x0790  [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID          C:\Windows\system32\drivers\appid.sys
20:17:26.0099 0x0790  AppID - ok
20:17:26.0104 0x0790  [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
20:17:26.0115 0x0790  AppIDSvc - ok
20:17:26.0120 0x0790  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo        C:\Windows\System32\appinfo.dll
20:17:26.0133 0x0790  Appinfo - ok
20:17:26.0141 0x0790  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt        C:\Windows\System32\appmgmts.dll
20:17:26.0156 0x0790  AppMgmt - ok
20:17:26.0163 0x0790  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc            C:\Windows\system32\drivers\arc.sys
20:17:26.0174 0x0790  arc - ok
20:17:26.0180 0x0790  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\drivers\arcsas.sys
20:17:26.0192 0x0790  arcsas - ok
20:17:26.0204 0x0790  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
20:17:26.0217 0x0790  aspnet_state - ok
20:17:26.0222 0x0790  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
20:17:26.0254 0x0790  AsyncMac - ok
20:17:26.0259 0x0790  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi          C:\Windows\system32\drivers\atapi.sys
20:17:26.0269 0x0790  atapi - ok
20:17:26.0289 0x0790  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:17:26.0317 0x0790  AudioEndpointBuilder - ok
20:17:26.0335 0x0790  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll
20:17:26.0359 0x0790  AudioSrv - ok
20:17:26.0367 0x0790  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
20:17:26.0383 0x0790  AxInstSV - ok
20:17:26.0398 0x0790  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
20:17:26.0420 0x0790  b06bdrv - ok
20:17:26.0431 0x0790  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
20:17:26.0448 0x0790  b57nd60a - ok
20:17:26.0456 0x0790  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
20:17:26.0468 0x0790  BDESVC - ok
20:17:26.0473 0x0790  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
20:17:26.0504 0x0790  Beep - ok
20:17:26.0523 0x0790  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE            C:\Windows\System32\bfe.dll
20:17:26.0550 0x0790  BFE - ok
20:17:26.0574 0x0790  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
20:17:26.0624 0x0790  BITS - ok
20:17:26.0631 0x0790  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
20:17:26.0643 0x0790  blbdrive - ok
20:17:26.0649 0x0790  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
20:17:26.0660 0x0790  bowser - ok
20:17:26.0665 0x0790  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
20:17:26.0677 0x0790  BrFiltLo - ok
20:17:26.0681 0x0790  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
20:17:26.0694 0x0790  BrFiltUp - ok
20:17:26.0702 0x0790  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser        C:\Windows\System32\browser.dll
20:17:26.0716 0x0790  Browser - ok
20:17:26.0728 0x0790  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
20:17:26.0745 0x0790  Brserid - ok
20:17:26.0750 0x0790  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
20:17:26.0764 0x0790  BrSerWdm - ok
20:17:26.0769 0x0790  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
20:17:26.0782 0x0790  BrUsbMdm - ok
20:17:26.0786 0x0790  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
20:17:26.0798 0x0790  BrUsbSer - ok
20:17:26.0803 0x0790  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
20:17:26.0817 0x0790  BTHMODEM - ok
20:17:26.0826 0x0790  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv        C:\Windows\system32\bthserv.dll
20:17:26.0857 0x0790  bthserv - ok
20:17:26.0863 0x0790  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
20:17:26.0900 0x0790  cdfs - ok
20:17:26.0909 0x0790  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
20:17:26.0922 0x0790  cdrom - ok
20:17:26.0928 0x0790  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc    C:\Windows\System32\certprop.dll
20:17:26.0958 0x0790  CertPropSvc - ok
20:17:26.0966 0x0790  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
20:17:26.0980 0x0790  circlass - ok
20:17:26.0992 0x0790  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\Windows\system32\CLFS.sys
20:17:27.0011 0x0790  CLFS - ok
20:17:27.0018 0x0790  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:17:27.0029 0x0790  clr_optimization_v2.0.50727_32 - ok
20:17:27.0036 0x0790  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:17:27.0048 0x0790  clr_optimization_v2.0.50727_64 - ok
20:17:27.0057 0x0790  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:17:27.0070 0x0790  clr_optimization_v4.0.30319_32 - ok
20:17:27.0078 0x0790  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:17:27.0091 0x0790  clr_optimization_v4.0.30319_64 - ok
20:17:27.0096 0x0790  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
20:17:27.0107 0x0790  CmBatt - ok
20:17:27.0112 0x0790  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
20:17:27.0121 0x0790  cmdide - ok
20:17:27.0136 0x0790  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG            C:\Windows\system32\Drivers\cng.sys
20:17:27.0162 0x0790  CNG - ok
20:17:27.0167 0x0790  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
20:17:27.0177 0x0790  Compbatt - ok
20:17:27.0182 0x0790  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
20:17:27.0195 0x0790  CompositeBus - ok
20:17:27.0199 0x0790  COMSysApp - ok
20:17:27.0204 0x0790  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
20:17:27.0214 0x0790  crcdisk - ok
20:17:27.0225 0x0790  [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc        C:\Windows\system32\cryptsvc.dll
20:17:27.0240 0x0790  CryptSvc - ok
20:17:27.0255 0x0790  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC            C:\Windows\system32\drivers\csc.sys
20:17:27.0278 0x0790  CSC - ok
20:17:27.0297 0x0790  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
20:17:27.0324 0x0790  CscService - ok
20:17:27.0341 0x0790  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
20:17:27.0380 0x0790  DcomLaunch - ok
20:17:27.0392 0x0790  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc      C:\Windows\System32\defragsvc.dll
20:17:27.0428 0x0790  defragsvc - ok
20:17:27.0434 0x0790  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
20:17:27.0464 0x0790  DfsC - ok
20:17:27.0475 0x0790  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
20:17:27.0494 0x0790  Dhcp - ok
20:17:27.0525 0x0790  [ EA8A3E8C674B03CB4AFA1D344DBD7BC1, 564D9370AE4D12973647997684B9637B2A5A7480F66B87018F789CE4E43C8191 ] DiagTrack      C:\Windows\system32\diagtrack.dll
20:17:27.0562 0x0790  DiagTrack - ok
20:17:27.0570 0x0790  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
20:17:27.0599 0x0790  discache - ok
20:17:27.0605 0x0790  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\drivers\disk.sys
20:17:27.0616 0x0790  Disk - ok
20:17:27.0622 0x0790  [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc          C:\Windows\system32\drivers\dmvsc.sys
20:17:27.0633 0x0790  dmvsc - ok
20:17:27.0642 0x0790  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
20:17:27.0656 0x0790  Dnscache - ok
20:17:27.0666 0x0790  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc        C:\Windows\System32\dot3svc.dll
20:17:27.0701 0x0790  dot3svc - ok
20:17:27.0709 0x0790  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS            C:\Windows\system32\dps.dll
20:17:27.0742 0x0790  DPS - ok
20:17:27.0746 0x0790  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
20:17:27.0756 0x0790  drmkaud - ok
20:17:27.0783 0x0790  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
20:17:27.0816 0x0790  DXGKrnl - ok
20:17:27.0824 0x0790  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost        C:\Windows\System32\eapsvc.dll
20:17:27.0856 0x0790  EapHost - ok
20:17:27.0930 0x0790  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv          C:\Windows\system32\drivers\evbda.sys
20:17:28.0023 0x0790  ebdrv - ok
20:17:28.0034 0x0790  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] EFS            C:\Windows\System32\lsass.exe
20:17:28.0045 0x0790  EFS - ok
20:17:28.0050 0x0790  [ BE2902E13CA69383F449B6BF927844FB, F092785E305D8E1FE795AF98A7A7B7B4548A0D6687060568C9E078FFA8D65C1C ] ElbyCDIO        C:\Windows\system32\Drivers\ElbyCDIO.sys
20:17:28.0060 0x0790  ElbyCDIO - ok
20:17:28.0075 0x0790  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
20:17:28.0098 0x0790  elxstor - ok
20:17:28.0107 0x0790  [ E89006C75E49B7F765F75C5FD397E620, B2E4B38FAF7F7E88EFEE1015036DF3B01DC92F4E6F1484F2D13769B08C950C7E ] Envy24HFS      C:\Windows\system32\drivers\Envy24HF.sys
20:17:28.0120 0x0790  Envy24HFS - ok
20:17:28.0126 0x0790  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
20:17:28.0136 0x0790  ErrDev - ok
20:17:28.0153 0x0790  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem    C:\Windows\system32\es.dll
20:17:28.0192 0x0790  EventSystem - ok
20:17:28.0201 0x0790  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat          C:\Windows\system32\drivers\exfat.sys
20:17:28.0235 0x0790  exfat - ok
20:17:28.0244 0x0790  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
20:17:28.0279 0x0790  fastfat - ok
20:17:28.0298 0x0790  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax            C:\Windows\system32\fxssvc.exe
20:17:28.0325 0x0790  Fax - ok
20:17:28.0331 0x0790  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc            C:\Windows\system32\drivers\fdc.sys
20:17:28.0341 0x0790  fdc - ok
20:17:28.0346 0x0790  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost        C:\Windows\system32\fdPHost.dll
20:17:28.0376 0x0790  fdPHost - ok
20:17:28.0381 0x0790  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
20:17:28.0411 0x0790  FDResPub - ok
20:17:28.0417 0x0790  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
20:17:28.0428 0x0790  FileInfo - ok
20:17:28.0433 0x0790  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
20:17:28.0462 0x0790  Filetrace - ok
20:17:28.0467 0x0790  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
20:17:28.0479 0x0790  flpydisk - ok
20:17:28.0490 0x0790  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
20:17:28.0506 0x0790  FltMgr - ok
20:17:28.0536 0x0790  [ E612E86FA15EA1EF9A52433A2743C447, 8A66164541D2EE2334B6DE3995C31138EA85E3A06BC7FD901E60D345E4E1E8A8 ] FontCache      C:\Windows\system32\FntCache.dll
20:17:28.0576 0x0790  FontCache - ok
20:17:28.0583 0x0790  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:17:28.0593 0x0790  FontCache3.0.0.0 - ok
20:17:28.0598 0x0790  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
20:17:28.0609 0x0790  FsDepends - ok
20:17:28.0614 0x0790  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
20:17:28.0624 0x0790  Fs_Rec - ok
20:17:28.0634 0x0790  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
20:17:28.0651 0x0790  fvevol - ok
20:17:28.0657 0x0790  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
20:17:28.0668 0x0790  gagp30kx - ok
20:17:28.0688 0x0790  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc          C:\Windows\System32\gpsvc.dll
20:17:28.0736 0x0790  gpsvc - ok
20:17:28.0744 0x0790  [ 1E6438D4EA6E1174A3B3B1EDC4DE660B, F9995CFEC7BBFE10B06EEE04CA6B49658275C43096E57747BFF9C2C31A0F9011 ] hamachi        C:\Windows\system32\DRIVERS\hamachi.sys
20:17:28.0752 0x0790  hamachi - ok
20:17:28.0808 0x0790  [ 03CABA844BC03C99DB84146BF51A9259, 81E6340B9C9DAC97FE5C6F26FEACAB204E857FD5B0490E52D209066B83610DBB ] Hamachi2Svc    C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
20:17:28.0866 0x0790  Hamachi2Svc - ok
20:17:28.0876 0x0790  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
20:17:28.0887 0x0790  hcw85cir - ok
20:17:28.0899 0x0790  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:17:28.0921 0x0790  HdAudAddService - ok
20:17:28.0929 0x0790  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
20:17:28.0945 0x0790  HDAudBus - ok
20:17:28.0949 0x0790  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
20:17:28.0961 0x0790  HidBatt - ok
20:17:28.0967 0x0790  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
20:17:28.0982 0x0790  HidBth - ok
20:17:28.0987 0x0790  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr          C:\Windows\system32\drivers\hidir.sys
20:17:29.0001 0x0790  HidIr - ok
20:17:29.0006 0x0790  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv        C:\Windows\system32\hidserv.dll
20:17:29.0036 0x0790  hidserv - ok
20:17:29.0041 0x0790  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
20:17:29.0051 0x0790  HidUsb - ok
20:17:29.0057 0x0790  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
20:17:29.0089 0x0790  hkmsvc - ok
20:17:29.0098 0x0790  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:17:29.0115 0x0790  HomeGroupListener - ok
20:17:29.0123 0x0790  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:17:29.0139 0x0790  HomeGroupProvider - ok
20:17:29.0146 0x0790  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
20:17:29.0157 0x0790  HpSAMD - ok
20:17:29.0177 0x0790  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
20:17:29.0205 0x0790  HTTP - ok
20:17:29.0211 0x0790  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
20:17:29.0221 0x0790  hwpolicy - ok
20:17:29.0228 0x0790  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
20:17:29.0241 0x0790  i8042prt - ok
20:17:29.0254 0x0790  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
20:17:29.0273 0x0790  iaStorV - ok
20:17:29.0298 0x0790  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:17:29.0330 0x0790  idsvc - ok
20:17:29.0337 0x0790  IEEtwCollectorService - ok
20:17:29.0341 0x0790  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
20:17:29.0352 0x0790  iirsp - ok
20:17:29.0374 0x0790  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
20:17:29.0405 0x0790  IKEEXT - ok
20:17:29.0413 0x0790  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
20:17:29.0422 0x0790  intelide - ok
20:17:29.0429 0x0790  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
20:17:29.0441 0x0790  intelppm - ok
20:17:29.0450 0x0790  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
20:17:29.0482 0x0790  IPBusEnum - ok
20:17:29.0488 0x0790  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:17:29.0519 0x0790  IpFilterDriver - ok
20:17:29.0535 0x0790  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
20:17:29.0559 0x0790  iphlpsvc - ok
20:17:29.0566 0x0790  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
20:17:29.0580 0x0790  IPMIDRV - ok
20:17:29.0587 0x0790  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
20:17:29.0620 0x0790  IPNAT - ok
20:17:29.0625 0x0790  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
20:17:29.0639 0x0790  IRENUM - ok
20:17:29.0645 0x0790  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
20:17:29.0654 0x0790  isapnp - ok
20:17:29.0665 0x0790  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
20:17:29.0681 0x0790  iScsiPrt - ok
20:17:29.0687 0x0790  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
20:17:29.0698 0x0790  kbdclass - ok
20:17:29.0702 0x0790  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
20:17:29.0714 0x0790  kbdhid - ok
20:17:29.0718 0x0790  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] KeyIso          C:\Windows\system32\lsass.exe
20:17:29.0729 0x0790  KeyIso - ok
20:17:29.0735 0x0790  [ F7DFAE6040AC910B7C64EE208A34157D, AEF1100F12391692D9DB78519D843A90C97E199A80DDC4D43E3AF1919A9E8E56 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
20:17:29.0747 0x0790  KSecDD - ok
20:17:29.0754 0x0790  [ 8FE94F2EF9BF444E93E35D87E210D02F, 78E8F6FD7C1EA3556194947707BE6893538A9E25A550C22045866C5B30251D14 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
20:17:29.0768 0x0790  KSecPkg - ok
20:17:29.0773 0x0790  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
20:17:29.0802 0x0790  ksthunk - ok
20:17:29.0814 0x0790  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm          C:\Windows\system32\msdtckrm.dll
20:17:29.0853 0x0790  KtmRm - ok
20:17:29.0863 0x0790  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
20:17:29.0898 0x0790  LanmanServer - ok
20:17:29.0904 0x0790  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:17:29.0937 0x0790  LanmanWorkstation - ok
20:17:29.0946 0x0790  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
20:17:29.0977 0x0790  lltdio - ok
20:17:29.0988 0x0790  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
20:17:30.0025 0x0790  lltdsvc - ok
20:17:30.0030 0x0790  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts        C:\Windows\System32\lmhsvc.dll
20:17:30.0061 0x0790  lmhosts - ok
20:17:30.0073 0x0790  [ D6BF6FD055BD719F3D62E51B90857159, A7777D18E404164B4DA531AD94D2A712D9CC6A9288795B7388037752A558E96F ] LMIGuardianSvc  C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
20:17:30.0088 0x0790  LMIGuardianSvc - ok
20:17:30.0097 0x0790  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
20:17:30.0109 0x0790  LSI_FC - ok
20:17:30.0115 0x0790  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
20:17:30.0127 0x0790  LSI_SAS - ok
20:17:30.0133 0x0790  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
20:17:30.0144 0x0790  LSI_SAS2 - ok
20:17:30.0150 0x0790  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
20:17:30.0162 0x0790  LSI_SCSI - ok
20:17:30.0170 0x0790  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv          C:\Windows\system32\drivers\luafv.sys
20:17:30.0202 0x0790  luafv - ok
20:17:30.0207 0x0790  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas        C:\Windows\system32\drivers\megasas.sys
20:17:30.0218 0x0790  megasas - ok
20:17:30.0228 0x0790  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
20:17:30.0244 0x0790  MegaSR - ok
20:17:30.0250 0x0790  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS          C:\Windows\system32\mmcss.dll
20:17:30.0281 0x0790  MMCSS - ok
20:17:30.0286 0x0790  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem          C:\Windows\system32\drivers\modem.sys
20:17:30.0318 0x0790  Modem - ok
20:17:30.0323 0x0790  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
20:17:30.0341 0x0790  monitor - ok
20:17:30.0347 0x0790  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
20:17:30.0357 0x0790  mouclass - ok
20:17:30.0363 0x0790  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
20:17:30.0373 0x0790  mouhid - ok
20:17:30.0381 0x0790  [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
20:17:30.0392 0x0790  mountmgr - ok
20:17:30.0399 0x0790  [ DD370A8148862150BA81A3F5C56A1E40, F56B84297BDC32266CB69D10FB2D66B8B332D60CAB7E64E4E3AC2BB749BBD31B ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:17:30.0411 0x0790  MozillaMaintenance - ok
20:17:30.0421 0x0790  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
20:17:30.0434 0x0790  mpio - ok
20:17:30.0440 0x0790  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
20:17:30.0471 0x0790  mpsdrv - ok
20:17:30.0493 0x0790  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
20:17:30.0541 0x0790  MpsSvc - ok
20:17:30.0550 0x0790  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
20:17:30.0564 0x0790  MRxDAV - ok
20:17:30.0571 0x0790  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
20:17:30.0586 0x0790  mrxsmb - ok
20:17:30.0597 0x0790  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:17:30.0614 0x0790  mrxsmb10 - ok
20:17:30.0621 0x0790  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:17:30.0635 0x0790  mrxsmb20 - ok
20:17:30.0639 0x0790  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
20:17:30.0650 0x0790  msahci - ok
20:17:30.0657 0x0790  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
20:17:30.0670 0x0790  msdsm - ok
20:17:30.0677 0x0790  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC          C:\Windows\System32\msdtc.exe
20:17:30.0692 0x0790  MSDTC - ok
20:17:30.0700 0x0790  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
20:17:30.0733 0x0790  Msfs - ok
20:17:30.0738 0x0790  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
20:17:30.0768 0x0790  mshidkmdf - ok
20:17:30.0772 0x0790  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
20:17:30.0782 0x0790  msisadrv - ok
20:17:30.0789 0x0790  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
20:17:30.0824 0x0790  MSiSCSI - ok
20:17:30.0828 0x0790  msiserver - ok
20:17:30.0833 0x0790  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
20:17:30.0863 0x0790  MSKSSRV - ok
20:17:30.0867 0x0790  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
20:17:30.0896 0x0790  MSPCLOCK - ok
20:17:30.0901 0x0790  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
20:17:30.0932 0x0790  MSPQM - ok
20:17:30.0944 0x0790  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
20:17:30.0963 0x0790  MsRPC - ok
20:17:30.0970 0x0790  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
20:17:30.0981 0x0790  mssmbios - ok
20:17:30.0985 0x0790  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
20:17:31.0014 0x0790  MSTEE - ok
20:17:31.0019 0x0790  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
20:17:31.0030 0x0790  MTConfig - ok
20:17:31.0037 0x0790  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup            C:\Windows\system32\Drivers\mup.sys
20:17:31.0048 0x0790  Mup - ok
20:17:31.0063 0x0790  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
20:17:31.0104 0x0790  napagent - ok
20:17:31.0116 0x0790  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
20:17:31.0138 0x0790  NativeWifiP - ok
20:17:31.0163 0x0790  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
20:17:31.0196 0x0790  NDIS - ok
20:17:31.0202 0x0790  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
20:17:31.0232 0x0790  NdisCap - ok
20:17:31.0238 0x0790  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
20:17:31.0267 0x0790  NdisTapi - ok
20:17:31.0274 0x0790  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
20:17:31.0304 0x0790  Ndisuio - ok
20:17:31.0312 0x0790  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
20:17:31.0344 0x0790  NdisWan - ok
20:17:31.0352 0x0790  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
20:17:31.0381 0x0790  NDProxy - ok
20:17:31.0387 0x0790  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
20:17:31.0417 0x0790  NetBIOS - ok
20:17:31.0426 0x0790  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
20:17:31.0461 0x0790  NetBT - ok
20:17:31.0466 0x0790  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] Netlogon        C:\Windows\system32\lsass.exe
20:17:31.0476 0x0790  Netlogon - ok
20:17:31.0488 0x0790  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
20:17:31.0527 0x0790  Netman - ok
20:17:31.0534 0x0790  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:17:31.0549 0x0790  NetMsmqActivator - ok
20:17:31.0554 0x0790  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:17:31.0568 0x0790  NetPipeActivator - ok
20:17:31.0583 0x0790  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
20:17:31.0625 0x0790  netprofm - ok
20:17:31.0632 0x0790  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:17:31.0646 0x0790  NetTcpActivator - ok
20:17:31.0652 0x0790  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:17:31.0666 0x0790  NetTcpPortSharing - ok
20:17:31.0671 0x0790  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
20:17:31.0682 0x0790  nfrd960 - ok
20:17:31.0692 0x0790  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
20:17:31.0710 0x0790  NlaSvc - ok
20:17:31.0715 0x0790  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
20:17:31.0746 0x0790  Npfs - ok
20:17:31.0750 0x0790  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi            C:\Windows\system32\nsisvc.dll
20:17:31.0782 0x0790  nsi - ok
20:17:31.0787 0x0790  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
20:17:31.0816 0x0790  nsiproxy - ok
20:17:31.0857 0x0790  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
20:17:31.0907 0x0790  Ntfs - ok
20:17:31.0915 0x0790  nTuneService - ok
20:17:31.0920 0x0790  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
20:17:31.0951 0x0790  Null - ok
20:17:32.0228 0x0790  [ 2232AE1BB51A96A7381A2CA17DF12E24, 4813E27BC14EB3CBD55AF89B098EA5C8DA4C7FF0B6CCB7AACFC43BC0E578C988 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:17:32.0564 0x0790  nvlddmkm - ok
20:17:32.0594 0x0790  [ 241A095631570A9CEF4F126C87605C60, AFDA5AF5F210336061BFF0FAB0ED93EE495312BED639EC5DB56FBAC0EA8247D3 ] NVR0Dev        C:\Windows\nvoclk64.sys
20:17:32.0602 0x0790  NVR0Dev - ok
20:17:32.0610 0x0790  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
20:17:32.0622 0x0790  nvraid - ok
20:17:32.0631 0x0790  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
20:17:32.0644 0x0790  nvstor - ok
20:17:32.0669 0x0790  [ 2C8DD5A34A81715865D66D7AF39362A6, 62F9D873127921EE2EAA80B73E8994C4BF6DA7EEDACAEA030B8D58E086FD3850 ] nvsvc          C:\Windows\system32\nvvsvc.exe
20:17:32.0698 0x0790  nvsvc - ok
20:17:32.0706 0x0790  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
20:17:32.0719 0x0790  nv_agp - ok
20:17:32.0727 0x0790  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
20:17:32.0739 0x0790  ohci1394 - ok
20:17:32.0784 0x0790  [ D06C2368C93396C6B983CE60523BA99F, ABC90E2DC2DE577AFA37BF34630502AA209C9556DFCC1757844D95D9370FFA8C ] Origin Client Service C:\Program Files (x86)\Origin\OriginClientService.exe
20:17:32.0835 0x0790  Origin Client Service - ok
20:17:32.0847 0x0790  [ 11E0B35479C895888BA3D7F619DCFFF3, 6ED82C19898101EC00BD64A9F90595C3D20AD2D2902AA8765B740FB3B9312DDF ] ose64          C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:17:32.0861 0x0790  ose64 - ok
20:17:32.0976 0x0790  [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
20:17:33.0113 0x0790  osppsvc - ok
20:17:33.0136 0x0790  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
20:17:33.0155 0x0790  p2pimsvc - ok
20:17:33.0170 0x0790  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
20:17:33.0192 0x0790  p2psvc - ok
20:17:33.0199 0x0790  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
20:17:33.0212 0x0790  Parport - ok
20:17:33.0218 0x0790  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
20:17:33.0230 0x0790  partmgr - ok
20:17:33.0238 0x0790  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll
20:17:33.0254 0x0790  PcaSvc - ok
20:17:33.0262 0x0790  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci            C:\Windows\system32\drivers\pci.sys
20:17:33.0276 0x0790  pci - ok
20:17:33.0282 0x0790  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
20:17:33.0291 0x0790  pciide - ok
20:17:33.0300 0x0790  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
20:17:33.0315 0x0790  pcmcia - ok
20:17:33.0321 0x0790  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw            C:\Windows\system32\drivers\pcw.sys
20:17:33.0331 0x0790  pcw - ok
20:17:33.0373 0x0790  [ 8F98C4BC605261B4B6E568FE791EB67A, 7B0D99D972A60423F7378BEE886061695FDA79B59AFF939744A130721E0174A1 ] PDF Architect 2 C:\Program Files (x86)\PDF Architect 2\ws.exe
20:17:33.0424 0x0790  PDF Architect 2 - ok
20:17:33.0446 0x0790  [ B2309F132A31AF03C0A249AEDE8CF289, BBAE32AA55E495ACB9A8089C090ADD78BE1DC16233CAA61BBED1456CA718D430 ] PDF Architect 2 Creator C:\Program Files (x86)\PDF Architect 2\creator-ws.exe
20:17:33.0468 0x0790  PDF Architect 2 Creator - ok
20:17:33.0490 0x0790  [ 9077A3059AB47834633AEAAED465F3D9, 9CA662E9CBA30795E4E5DAB3E309D2062FFDC2053C261054E24EF7EE5300F69F ] pdfforge CrashHandler C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe
20:17:33.0518 0x0790  pdfforge CrashHandler - ok
20:17:33.0537 0x0790  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
20:17:33.0563 0x0790  PEAUTH - ok
20:17:33.0597 0x0790  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
20:17:33.0637 0x0790  PeerDistSvc - ok
20:17:33.0655 0x0790  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
20:17:33.0667 0x0790  PerfHost - ok
20:17:33.0708 0x0790  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla            C:\Windows\system32\pla.dll
20:17:33.0767 0x0790  pla - ok
20:17:33.0783 0x0790  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
20:17:33.0804 0x0790  PlugPlay - ok
20:17:33.0809 0x0790  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
20:17:33.0821 0x0790  PNRPAutoReg - ok
20:17:33.0832 0x0790  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
20:17:33.0849 0x0790  PNRPsvc - ok
20:17:33.0864 0x0790  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
20:17:33.0905 0x0790  PolicyAgent - ok
20:17:33.0913 0x0790  [ 4671F353D0DF74C3B0D2D00DE676F56C, 0F75009DD36B2E18212CE855FB7CA7D273E5749D8F2F451655ED81AA5E86BA9F ] postgresql-8.4  c:\postgreSQL\bin\pg_ctl.exe
20:17:33.0918 0x0790  postgresql-8.4 - detected UnsignedFile.Multi.Generic ( 1 )
20:17:36.0287 0x0790  Detect skipped due to KSN trusted
20:17:36.0287 0x0790  postgresql-8.4 - ok
20:17:36.0298 0x0790  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power          C:\Windows\system32\umpo.dll
20:17:36.0333 0x0790  Power - ok
20:17:36.0339 0x0790  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
20:17:36.0370 0x0790  PptpMiniport - ok
20:17:36.0376 0x0790  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor      C:\Windows\system32\drivers\processr.sys
20:17:36.0388 0x0790  Processor - ok
20:17:36.0397 0x0790  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc        C:\Windows\system32\profsvc.dll
20:17:36.0413 0x0790  ProfSvc - ok
20:17:36.0421 0x0790  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:17:36.0431 0x0790  ProtectedStorage - ok
20:17:36.0438 0x0790  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
20:17:36.0469 0x0790  Psched - ok
20:17:36.0506 0x0790  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
20:17:36.0553 0x0790  ql2300 - ok
20:17:36.0563 0x0790  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
20:17:36.0575 0x0790  ql40xx - ok
20:17:36.0586 0x0790  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE          C:\Windows\system32\qwave.dll
20:17:36.0607 0x0790  QWAVE - ok
20:17:36.0613 0x0790  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
20:17:36.0628 0x0790  QWAVEdrv - ok
20:17:36.0633 0x0790  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
20:17:36.0662 0x0790  RasAcd - ok
20:17:36.0668 0x0790  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
20:17:36.0699 0x0790  RasAgileVpn - ok
20:17:36.0705 0x0790  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto        C:\Windows\System32\rasauto.dll
20:17:36.0740 0x0790  RasAuto - ok
20:17:36.0748 0x0790  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
20:17:36.0778 0x0790  Rasl2tp - ok
20:17:36.0790 0x0790  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
20:17:36.0828 0x0790  RasMan - ok
20:17:36.0835 0x0790  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
20:17:36.0866 0x0790  RasPppoe - ok
20:17:36.0872 0x0790  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
20:17:36.0903 0x0790  RasSstp - ok
20:17:36.0914 0x0790  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
20:17:36.0950 0x0790  rdbss - ok
20:17:36.0955 0x0790  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
20:17:36.0968 0x0790  rdpbus - ok
20:17:36.0972 0x0790  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
20:17:37.0002 0x0790  RDPCDD - ok
20:17:37.0011 0x0790  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
20:17:37.0026 0x0790  RDPDR - ok
20:17:37.0031 0x0790  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
20:17:37.0060 0x0790  RDPENCDD - ok
20:17:37.0066 0x0790  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
20:17:37.0095 0x0790  RDPREFMP - ok
20:17:37.0103 0x0790  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
20:17:37.0113 0x0790  RdpVideoMiniport - ok
20:17:37.0125 0x0790  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
20:17:37.0140 0x0790  RDPWD - ok
20:17:37.0150 0x0790  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
20:17:37.0164 0x0790  rdyboost - ok
20:17:37.0171 0x0790  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
20:17:37.0203 0x0790  RemoteAccess - ok
20:17:37.0211 0x0790  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
20:17:37.0246 0x0790  RemoteRegistry - ok
20:17:37.0252 0x0790  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
20:17:37.0284 0x0790  RpcEptMapper - ok
20:17:37.0289 0x0790  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
20:17:37.0301 0x0790  RpcLocator - ok
20:17:37.0315 0x0790  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs          C:\Windows\system32\rpcss.dll
20:17:37.0354 0x0790  RpcSs - ok
20:17:37.0362 0x0790  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
20:17:37.0393 0x0790  rspndr - ok
20:17:37.0409 0x0790  [ EE082E06A82FF630351D1E0EBBD3D8D0, 537F1A4108BDA72E8DD271466E7B7FCF39D4D55E4129AB35A409AB7AF2E7D219 ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
20:17:37.0429 0x0790  RTL8167 - ok
20:17:37.0435 0x0790  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
20:17:37.0445 0x0790  s3cap - ok
20:17:37.0451 0x0790  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] SamSs          C:\Windows\system32\lsass.exe
20:17:37.0461 0x0790  SamSs - ok
20:17:37.0468 0x0790  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
20:17:37.0480 0x0790  sbp2port - ok
20:17:37.0489 0x0790  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
20:17:37.0524 0x0790  SCardSvr - ok
20:17:37.0529 0x0790  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
20:17:37.0558 0x0790  scfilter - ok
20:17:37.0585 0x0790  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
20:17:37.0643 0x0790  Schedule - ok
20:17:37.0650 0x0790  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc    C:\Windows\System32\certprop.dll
20:17:37.0679 0x0790  SCPolicySvc - ok
20:17:37.0688 0x0790  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
20:17:37.0704 0x0790  SDRSVC - ok
20:17:37.0709 0x0790  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
20:17:37.0739 0x0790  secdrv - ok
20:17:37.0744 0x0790  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
20:17:37.0774 0x0790  seclogon - ok
20:17:37.0782 0x0790  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
20:17:37.0814 0x0790  SENS - ok
20:17:37.0819 0x0790  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
20:17:37.0831 0x0790  SensrSvc - ok
20:17:37.0835 0x0790  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
20:17:37.0846 0x0790  Serenum - ok
20:17:37.0856 0x0790  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
20:17:37.0869 0x0790  Serial - ok
20:17:37.0874 0x0790  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
20:17:37.0885 0x0790  sermouse - ok
20:17:37.0896 0x0790  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
20:17:37.0928 0x0790  SessionEnv - ok
20:17:37.0933 0x0790  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
20:17:37.0948 0x0790  sffdisk - ok
20:17:37.0952 0x0790  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
20:17:37.0965 0x0790  sffp_mmc - ok
20:17:37.0970 0x0790  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
20:17:37.0982 0x0790  sffp_sd - ok
20:17:37.0987 0x0790  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
20:17:37.0997 0x0790  sfloppy - ok
20:17:38.0009 0x0790  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
20:17:38.0051 0x0790  SharedAccess - ok
20:17:38.0064 0x0790  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:17:38.0103 0x0790  ShellHWDetection - ok
20:17:38.0108 0x0790  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
20:17:38.0118 0x0790  SiSRaid2 - ok
20:17:38.0124 0x0790  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
20:17:38.0136 0x0790  SiSRaid4 - ok
20:17:38.0146 0x0790  [ 704B4F81729F676BBF034529FC334D82, 1E50DAF97836807A500284385D99272780A8B69CA88761250451060B207824F8 ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
20:17:38.0166 0x0790  SkypeUpdate - ok
20:17:38.0173 0x0790  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
20:17:38.0204 0x0790  Smb - ok
20:17:38.0212 0x0790  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
20:17:38.0224 0x0790  SNMPTRAP - ok
20:17:38.0229 0x0790  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr          C:\Windows\system32\drivers\spldr.sys
20:17:38.0239 0x0790  spldr - ok
20:17:38.0257 0x0790  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler        C:\Windows\System32\spoolsv.exe
20:17:38.0282 0x0790  Spooler - ok
20:17:38.0370 0x0790  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
20:17:38.0488 0x0790  sppsvc - ok
20:17:38.0505 0x0790  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
20:17:38.0537 0x0790  sppuinotify - ok
20:17:38.0549 0x0790  [ FEB80A9EC320569CC82D4DB9F4AC78BC, E6340CDA9B5F59DBE68128356E357FEDA3655A296BFE4B7F44944F2DE5DA9765 ] sptd            C:\Windows\System32\Drivers\sptd.sys
20:17:38.0567 0x0790  sptd - ok
20:17:38.0583 0x0790  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv            C:\Windows\system32\DRIVERS\srv.sys
20:17:38.0604 0x0790  srv - ok
20:17:38.0617 0x0790  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
20:17:38.0637 0x0790  srv2 - ok
20:17:38.0645 0x0790  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
20:17:38.0659 0x0790  srvnet - ok
20:17:38.0668 0x0790  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
20:17:38.0703 0x0790  SSDPSRV - ok
20:17:38.0709 0x0790  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc        C:\Windows\system32\sstpsvc.dll
20:17:38.0743 0x0790  SstpSvc - ok
20:17:38.0765 0x0790  [ 0398BF35F898BA77033E678609AAB64F, E48D2E1E1C8FD314340BA1AA69E8942F630139B1E7019C8828BA5525444320D4 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
20:17:38.0797 0x0790  Steam Client Service - ok
20:17:38.0813 0x0790  [ D2230317777033CD0456990BFC4994E5, 0F2F559593EAD7AB4596E67E9AE56E5ABF5C945201366CFC972357C22A4F776A ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
20:17:38.0830 0x0790  Stereo Service - ok
20:17:38.0836 0x0790  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
20:17:38.0848 0x0790  stexstor - ok
20:17:38.0853 0x0790  [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
20:17:38.0864 0x0790  StillCam - ok
20:17:38.0883 0x0790  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
20:17:38.0914 0x0790  stisvc - ok
20:17:38.0920 0x0790  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
20:17:38.0930 0x0790  storflt - ok
20:17:38.0935 0x0790  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc        C:\Windows\system32\storsvc.dll
20:17:38.0946 0x0790  StorSvc - ok
20:17:38.0951 0x0790  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc        C:\Windows\system32\drivers\storvsc.sys
20:17:38.0961 0x0790  storvsc - ok
20:17:39.0038 0x0790  [ 460CF6E93344CC4B6D90BE3D6150260A, FC33378468B8403DE4AB7E6D683A8E99417C69C6526FD3E7F845BD0BA7C8DBA4 ] SurfEasyVPN    C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyService.exe
20:17:39.0116 0x0790  SurfEasyVPN - ok
20:17:39.0127 0x0790  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
20:17:39.0137 0x0790  swenum - ok
20:17:39.0152 0x0790  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv          C:\Windows\System32\swprv.dll
20:17:39.0196 0x0790  swprv - ok
20:17:39.0237 0x0790  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain        C:\Windows\system32\sysmain.dll
20:17:39.0297 0x0790  SysMain - ok
20:17:39.0309 0x0790  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:17:39.0327 0x0790  TabletInputService - ok
20:17:39.0338 0x0790  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv        C:\Windows\System32\tapisrv.dll
20:17:39.0375 0x0790  TapiSrv - ok
20:17:39.0380 0x0790  [ 172186CFB1866380A963E45D46D77B9A, 2089E2AB3ADC3BD232482A0B037D9A655BF3612A1E42740BE78354BB6D186B6A ] tapse01        C:\Windows\system32\DRIVERS\tapse01.sys
20:17:39.0389 0x0790  tapse01 - ok
20:17:39.0397 0x0790  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS            C:\Windows\System32\tbssvc.dll
20:17:39.0430 0x0790  TBS - ok
20:17:39.0476 0x0790  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
20:17:39.0535 0x0790  Tcpip - ok
20:17:39.0584 0x0790  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
20:17:39.0632 0x0790  TCPIP6 - ok
20:17:39.0643 0x0790  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
20:17:39.0655 0x0790  tcpipreg - ok
20:17:39.0661 0x0790  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
20:17:39.0672 0x0790  TDPIPE - ok
20:17:39.0677 0x0790  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
20:17:39.0687 0x0790  TDTCP - ok
20:17:39.0694 0x0790  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
20:17:39.0707 0x0790  tdx - ok
20:17:39.0830 0x0790  [ 6CA83C69643E7BF144A428B7BDC7D630, DB015BA4428509E1D5BE74FEFB446A29D316564617EB15A379424B3FCE3B74A9 ] TeamViewer      C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
20:17:39.0950 0x0790  TeamViewer - ok
20:17:39.0971 0x0790  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
20:17:39.0982 0x0790  TermDD - ok
20:17:40.0001 0x0790  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService    C:\Windows\System32\termsrv.dll
20:17:40.0029 0x0790  TermService - ok
20:17:40.0038 0x0790  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
20:17:40.0055 0x0790  Themes - ok
20:17:40.0061 0x0790  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER    C:\Windows\system32\mmcss.dll
20:17:40.0093 0x0790  THREADORDER - ok
20:17:40.0099 0x0790  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
20:17:40.0132 0x0790  TrkWks - ok
20:17:40.0140 0x0790  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:17:40.0173 0x0790  TrustedInstaller - ok
20:17:40.0179 0x0790  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
20:17:40.0191 0x0790  tssecsrv - ok
20:17:40.0196 0x0790  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
20:17:40.0208 0x0790  TsUsbFlt - ok
20:17:40.0212 0x0790  [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
20:17:40.0223 0x0790  TsUsbGD - ok
20:17:40.0230 0x0790  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
20:17:40.0261 0x0790  tunnel - ok
20:17:40.0267 0x0790  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
20:17:40.0278 0x0790  uagp35 - ok
20:17:40.0290 0x0790  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
20:17:40.0328 0x0790  udfs - ok
20:17:40.0336 0x0790  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect      C:\Windows\system32\UI0Detect.exe
20:17:40.0350 0x0790  UI0Detect - ok
20:17:40.0357 0x0790  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
20:17:40.0368 0x0790  uliagpkx - ok
20:17:40.0373 0x0790  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
20:17:40.0385 0x0790  umbus - ok
20:17:40.0389 0x0790  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\drivers\umpass.sys
20:17:40.0400 0x0790  UmPass - ok
20:17:40.0409 0x0790  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
20:17:40.0425 0x0790  UmRdpService - ok
20:17:40.0437 0x0790  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
20:17:40.0476 0x0790  upnphost - ok
20:17:40.0483 0x0790  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
20:17:40.0495 0x0790  usbccgp - ok
20:17:40.0502 0x0790  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
20:17:40.0514 0x0790  usbcir - ok
20:17:40.0520 0x0790  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
20:17:40.0531 0x0790  usbehci - ok
20:17:40.0543 0x0790  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
20:17:40.0562 0x0790  usbhub - ok
20:17:40.0568 0x0790  [ 58E546BBAF87664FC57E0F6081E4F609, 1DD99D57369A0069654432AB5325AFD8F7D422D531E053EA05FF664BA6BDAEF9 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
20:17:40.0578 0x0790  usbohci - ok
20:17:40.0584 0x0790  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
20:17:40.0597 0x0790  usbprint - ok
20:17:40.0603 0x0790  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
20:17:40.0613 0x0790  usbscan - ok
20:17:40.0620 0x0790  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:17:40.0632 0x0790  USBSTOR - ok
20:17:40.0637 0x0790  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci        C:\Windows\system32\DRIVERS\usbuhci.sys
20:17:40.0647 0x0790  usbuhci - ok
20:17:40.0653 0x0790  [ 7B28E2FBE75115660FAB31079C0A9F29, 81BB5A3E64B652A672A0782A88ABF6DDD729D38712D0706CE0FB9DE6D1EE1515 ] usb_rndisx      C:\Windows\system32\DRIVERS\usb8023x.sys
20:17:40.0663 0x0790  usb_rndisx - ok
20:17:40.0670 0x0790  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms          C:\Windows\System32\uxsms.dll
20:17:40.0702 0x0790  UxSms - ok
20:17:40.0706 0x0790  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] VaultSvc        C:\Windows\system32\lsass.exe
20:17:40.0718 0x0790  VaultSvc - ok
20:17:40.0722 0x0790  [ 3C8E2C591345F38149C69FE8E5DF8C90, 9F4BB9BDA09CB2E99A6A888B288F322AE5C460B5D124CD714C6F00FF5029144B ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
20:17:40.0731 0x0790  VClone - ok
20:17:40.0737 0x0790  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
20:17:40.0747 0x0790  vdrvroot - ok
20:17:40.0763 0x0790  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds            C:\Windows\System32\vds.exe
20:17:40.0806 0x0790  vds - ok
20:17:40.0811 0x0790  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
20:17:40.0824 0x0790  vga - ok
20:17:40.0829 0x0790  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave        C:\Windows\System32\drivers\vga.sys
20:17:40.0859 0x0790  VgaSave - ok
20:17:40.0867 0x0790  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
20:17:40.0882 0x0790  vhdmp - ok
20:17:40.0887 0x0790  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
20:17:40.0897 0x0790  viaide - ok
20:17:40.0905 0x0790  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus          C:\Windows\system32\drivers\vmbus.sys
20:17:40.0920 0x0790  vmbus - ok
20:17:40.0924 0x0790  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
20:17:40.0934 0x0790  VMBusHID - ok
20:17:40.0940 0x0790  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
20:17:40.0951 0x0790  volmgr - ok
20:17:40.0963 0x0790  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
20:17:40.0982 0x0790  volmgrx - ok
20:17:40.0994 0x0790  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap        C:\Windows\system32\drivers\volsnap.sys
20:17:41.0011 0x0790  volsnap - ok
20:17:41.0028 0x0790  [ 0B0772247B85FC844A06498386E32F59, 47FBF825649C78E52A13EBD06336209C15414293A414757CF424E4B4490319BA ] vpnagent        C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
20:17:41.0047 0x0790  vpnagent - ok
20:17:41.0053 0x0790  [ 5932B2999AEF21C4599A792599F28D89, 78B2842BA71F9DAB5BB64BA4AB97BD19DEEFB075F83D735244906D046E78B2DC ] vpnva          C:\Windows\system32\DRIVERS\vpnva64-6.sys
20:17:41.0062 0x0790  vpnva - ok
20:17:41.0072 0x0790  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
20:17:41.0086 0x0790  vsmraid - ok
20:17:41.0125 0x0790  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS            C:\Windows\system32\vssvc.exe
20:17:41.0190 0x0790  VSS - ok
20:17:41.0198 0x0790  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
20:17:41.0211 0x0790  vwifibus - ok
20:17:41.0223 0x0790  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time        C:\Windows\system32\w32time.dll
20:17:41.0263 0x0790  W32Time - ok
20:17:41.0270 0x0790  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
20:17:41.0282 0x0790  WacomPen - ok
20:17:41.0288 0x0790  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
20:17:41.0319 0x0790  WANARP - ok
20:17:41.0324 0x0790  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
20:17:41.0353 0x0790  Wanarpv6 - ok
20:17:41.0390 0x0790  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
20:17:41.0440 0x0790  wbengine - ok
20:17:41.0451 0x0790  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
20:17:41.0472 0x0790  WbioSrvc - ok
20:17:41.0484 0x0790  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc        C:\Windows\System32\wcncsvc.dll
20:17:41.0509 0x0790  wcncsvc - ok
20:17:41.0514 0x0790  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:17:41.0526 0x0790  WcsPlugInService - ok
20:17:41.0531 0x0790  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
20:17:41.0542 0x0790  Wd - ok
20:17:41.0563 0x0790  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
20:17:41.0594 0x0790  Wdf01000 - ok
20:17:41.0601 0x0790  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll
20:17:41.0615 0x0790  WdiServiceHost - ok
20:17:41.0620 0x0790  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost  C:\Windows\system32\wdi.dll
20:17:41.0632 0x0790  WdiSystemHost - ok
20:17:41.0643 0x0790  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient      C:\Windows\System32\webclnt.dll
20:17:41.0661 0x0790  WebClient - ok
20:17:41.0671 0x0790  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
20:17:41.0707 0x0790  Wecsvc - ok
20:17:41.0714 0x0790  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
20:17:41.0746 0x0790  wercplsupport - ok
20:17:41.0753 0x0790  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
20:17:41.0785 0x0790  WerSvc - ok
20:17:41.0790 0x0790  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
20:17:41.0819 0x0790  WfpLwf - ok
20:17:41.0824 0x0790  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
20:17:41.0834 0x0790  WIMMount - ok
20:17:41.0837 0x0790  WinDefend - ok
20:17:41.0843 0x0790  WinHttpAutoProxySvc - ok
20:17:41.0858 0x0790  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
20:17:41.0893 0x0790  Winmgmt - ok
20:17:41.0942 0x0790  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM          C:\Windows\system32\WsmSvc.dll
20:17:42.0004 0x0790  WinRM - ok
20:17:42.0035 0x0790  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc        C:\Windows\System32\wlansvc.dll
20:17:42.0072 0x0790  Wlansvc - ok
20:17:42.0077 0x0790  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
20:17:42.0094 0x0790  WmiAcpi - ok
20:17:42.0104 0x0790  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
20:17:42.0120 0x0790  wmiApSrv - ok
20:17:42.0124 0x0790  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
20:17:42.0136 0x0790  WPCSvc - ok
20:17:42.0140 0x0790  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
20:17:42.0169 0x0790  ws2ifsl - ok
20:17:42.0175 0x0790  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
20:17:42.0193 0x0790  wscsvc - ok
20:17:42.0197 0x0790  WSearch - ok
20:17:42.0260 0x0790  [ 0814A74C853F50B354F08F83DDA9F7FB, 0A63BAA8DE451B8C2C71FEF961718E769B9BAC305C76D24048C664CB27D0DF28 ] wuauserv        C:\Windows\system32\wuaueng.dll
20:17:42.0334 0x0790  wuauserv - ok
20:17:42.0346 0x0790  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
20:17:42.0358 0x0790  WudfPf - ok
20:17:42.0364 0x0790  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
20:17:42.0378 0x0790  wudfsvc - ok
20:17:42.0387 0x0790  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc        C:\Windows\System32\wwansvc.dll
20:17:42.0404 0x0790  WwanSvc - ok
20:17:42.0417 0x0790  ================ Scan global ===============================
20:17:42.0422 0x0790  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
20:17:42.0431 0x0790  [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll
20:17:42.0445 0x0790  [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll
20:17:42.0454 0x0790  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
20:17:42.0465 0x0790  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
20:17:42.0474 0x0790  [ Global ] - ok
20:17:42.0474 0x0790  ================ Scan MBR ==================================
20:17:42.0486 0x0790  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR3
20:17:42.0559 0x0790  \Device\Harddisk0\DR3 - ok
20:17:42.0562 0x0790  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
20:17:42.0755 0x0790  \Device\Harddisk1\DR1 - ok
20:17:42.0761 0x0790  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
20:17:42.0774 0x0790  \Device\Harddisk2\DR2 - ok
20:17:42.0774 0x0790  ================ Scan VBR ==================================
20:17:42.0776 0x0790  [ D1627E0667557E4CDF5143896BDBB181 ] \Device\Harddisk0\DR3\Partition1
20:17:42.0794 0x0790  \Device\Harddisk0\DR3\Partition1 - ok
20:17:42.0799 0x0790  [ FF53644A66457435DE81C29F1E8221BF ] \Device\Harddisk1\DR1\Partition1
20:17:42.0801 0x0790  \Device\Harddisk1\DR1\Partition1 - ok
20:17:42.0803 0x0790  [ DEE254886E6D1B947374CA947C2E8943 ] \Device\Harddisk1\DR1\Partition2
20:17:42.0805 0x0790  \Device\Harddisk1\DR1\Partition2 - ok
20:17:42.0807 0x0790  [ 876EC93E621B73D99A66A166305903D4 ] \Device\Harddisk1\DR1\Partition3
20:17:42.0808 0x0790  \Device\Harddisk1\DR1\Partition3 - ok
20:17:42.0810 0x0790  [ 9D040426BDE562DF27CE785E2017DFBD ] \Device\Harddisk1\DR1\Partition4
20:17:42.0811 0x0790  \Device\Harddisk1\DR1\Partition4 - ok
20:17:42.0813 0x0790  [ 4D5BE89562B32077FAC0A9F87E57F861 ] \Device\Harddisk2\DR2\Partition1
20:17:42.0814 0x0790  \Device\Harddisk2\DR2\Partition1 - ok
20:17:42.0815 0x0790  ================ Scan generic autorun ======================
20:17:42.0858 0x0790  [ 66B1C09A03323BC0142B62769ACB195E, 54B59524DE975DF649AD0C781772753135F6F73BA1A5E2458658665565BAADEC ] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
20:17:42.0901 0x0790  NvBackend - ok
20:17:42.0913 0x0790  [ 39CF316EB5842AE27CC0D3CC4E2840DE, BC4D4ED926F988B7B70CC87B7EC92D148DA6BC39C5C514751F1B0CA69D0F9081 ] C:\Program Files\Microsoft Office\Office14\BCSSync.exe
20:17:42.0925 0x0790  BCSSync - ok
20:17:42.0929 0x0790  [ 34D296AFC913E302953C70463EF09A48, BC413307CBC56C039EE8A05B51A56E14EF59678FBB33815AEB320078056C8CE7 ] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
20:17:42.0938 0x0790  HP Software Update - ok
20:17:42.0967 0x0790  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:17:43.0002 0x0790  Sidebar - ok
20:17:43.0009 0x0790  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:17:43.0026 0x0790  mctadmin - ok
20:17:43.0055 0x0790  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:17:43.0094 0x0790  Sidebar - ok
20:17:43.0103 0x0790  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:17:43.0119 0x0790  mctadmin - ok
20:17:43.0420 0x0790  [ 26EEF71E76270D172112D28435BA18B9, B73D91A61495A562C2AF04F3559112C65DF532FE2F35886C6A3654283AF2AAD8 ] C:\Program Files (x86)\SurfEasy VPN\client\SurfEasyVPN.exe
20:17:43.0697 0x0790  SurfEasy - ok
20:17:43.0783 0x0790  [ 22F7B9670AD770C7ED7F4738204C8E5C, 7B793AC094CB1B073419B5DAE09DFBB8EBED03D29301F490AA76EA0667613438 ] C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe
20:17:43.0841 0x0790  HP Photosmart 7520 series (NET) - ok
20:17:43.0929 0x0790  [ 05EF48203CC819B57F8665217FB6DDF5, D34DA867FA4F6B8BF5BCF5C9DE5E5CC315632CFA8A4056567DEF431CEE524A8E ] C:\Program Files (x86)\Origin\Origin.exe
20:17:44.0023 0x0790  EADM - ok
20:17:44.0058 0x0790  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:17:44.0093 0x0790  Sidebar - ok
20:17:44.0102 0x0790  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:17:44.0119 0x0790  mctadmin - ok
20:17:44.0120 0x0790  Waiting for KSN requests completion. In queue: 337
20:17:45.0120 0x0790  Waiting for KSN requests completion. In queue: 26
20:17:46.0120 0x0790  Waiting for KSN requests completion. In queue: 26
20:17:47.0142 0x0790  Win FW state via NFP2: enabled
20:17:49.0535 0x0790  ============================================================
20:17:49.0535 0x0790  Scan finished
20:17:49.0535 0x0790  ============================================================
20:17:49.0548 0x0db8  Detected object count: 0
20:17:49.0548 0x0db8  Actual detected object count: 0
Code:
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.1.1004

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17801

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED, G:\ DRIVE_FIXED
CPU speed: 2.666000 GHz
Memory total: 4293386240, free: 1565499392

Downloaded database version: v2015.06.24.04
Downloaded database version: v2015.06.22.01
Downloaded database version: v2015.06.15.01
Initializing...
======================
------------ Kernel report ------------
    06/24/2015 20:06:32
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\sptd.sys
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\ElbyCDIO.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\Envy24HF.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\1394ohci.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\tapse01.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\DRIVERS\VClone.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\nvoclk64.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
----------- End -----------
Done!
IRP handler 0 of \Driver\atapi points to an unknown module
Unhooking enabled.

Scan started
Database versions:
  main:    v2015.06.24.04
  rootkit: v2015.06.22.01

<<<1>>>
Upper Device Name: \Device\Harddisk0\DR3
Upper Device Object: 0xfffffa800468c060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-2\
Lower Device Object: 0xfffffa8004537060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa800468e060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T1L0-8\
Lower Device Object: 0xfffffa8004536680
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800468d060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T1L0-4\
Lower Device Object: 0xfffffa8004541060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
<<<2>>>
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa800468e060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800468eb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800468e060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8004533520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8004536680, DeviceName: \Device\Ide\IdeDeviceP3T1L0-8\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a00fd76c60, 0xfffffa800468e060, 0xfffffa8005e9b490
Lower DeviceData: 0xfffff8a0107ab840, 0xfffffa8004536680, 0xfffffa8007412390
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800468c060, DeviceName: \Device\Harddisk0\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004857040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800468c060, DeviceName: \Device\Harddisk0\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8004252e40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8004537060, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR3\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a00b3610e0, 0xfffffa800468c060, 0xfffffa8005cfc790
Lower DeviceData: 0xfffff8a00ab85e80, 0xfffffa8004537060, 0xfffffa800444b930
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 4D60EC6C

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 2048  Numsec = 1465143296

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 750155292160 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa800468d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800468db90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800468d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800410a9b0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8004541060, DeviceName: \Device\Ide\IdeDeviceP2T1L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a010abad50, 0xfffffa800468d060, 0xfffffa8005e70090
Lower DeviceData: 0xfffff8a00ee8cd20, 0xfffffa8004541060, 0xfffffa8003dffdc0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C177C177

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 102191104

    Partition 2 type is Extended with LBA (0xf)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 102398310  Numsec = 874353690

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 500106780160 bytes
Sector size: 512 bytes

Done!
Drive 2
This is a System drive
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2F57C575

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 2048  Numsec = 500113408

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 256060514304 bytes
Sector size: 512 bytes

Done!
File "C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-595EBBE06A02D2C740085195E14A770238098F0F.bin.VE1" is compressed (flags = 1)
File "C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-595EBBE06A02D2C740085195E14A770238098F0F.bin.VF" is compressed (flags = 1)
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished

schrauber 25.06.2015 18:53
Sind dadurch auch die andern Probleme behoben oder sind die noch da?

Large1337 26.06.2015 20:28
Zitat:
Zitat von schrauber (Beitrag 1482118)
Sind dadurch auch die andern Probleme behoben oder sind die noch da?
Hallo, vielen Dank für deine Mühe. Ich habe meinen PC jetzt ausgiebig getestet und konnte das Problem nicht erneut feststellen.
Vielen Dank nochmal. Hätte nie erwartet das es an der Grafikkarte liegt...

schrauber 27.06.2015 08:45
alles klar :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:55 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27