Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Volksbank Trojaner: Modernisierung Sicherheitssystem (https://www.trojaner-board.de/171942-volksbank-trojaner-modernisierung-sicherheitssystem.html)

RehIT 09.10.2015 17:10
Volksbank Trojaner: Modernisierung Sicherheitssystem
 
Guten Tag.

Wenn ich die Seite der Volksbank aufrufe, erhalte ich eine Meldung:

"In Zusammenhang mit der Modernisierung des Sicherheitssystems kann von Ihnen beim Einloggen ins Benutzerkonto eine zusätzliche Identifizierung angefordert werden. Um Ihr Konto weiterhin benutzen zu können, würden wir Sie einmalig bitten, unsere Applikation für Smartphones auf Ihr Mobiltelefon zu installieren, das zu Ihrem Konto hinzugefügt ist. Ohne Installation der mobilen Applikation wird der Zugang zum Konto gesperrt. Wir danken für Ihr Verständnis."

Ich habe mich nun schon darüber informiert und auch mit einigen Anti-Virus Programmen versucht den Virus zu entfernen - ohne Erfolg.
(Gescant mit ADWCleaner 5.013, Anti-MalewareBytes 2.1.8.1057, SpyBot - Search and Destroy)

Eine Systemwiederherstellung ist leider auch nicht möglich, da EIGENARTIGERWEISE alle Systemwiederherstellungspunkte vor heute morgen vernichtet wurden. :daumenrunter:

Was ich nun schon herausgefunden habe, ist, dass die Meldung, wenn ich den Internet Explorer ohne Add-ons ausführe, nicht erscheind. Doch wenn ich die Add-ons selbst nach und nach deaktiviere ändert sich auch nach der Deaktivierung von allen nichts an dem Problem.

Ich bin leider so langsam am Ende mit meinen Ideen. Wenn jemand bereits Erfahrungen mit dem Trojaner hat, oder sonst noch eine Idee hätte was ich ausprobieren könnte, wäre ich froh über eine Rückmeldung (:

Kann doch nicht sein, dass dieser kleine Virus so schwer zu vernichten ist :aufsmaul:

deeprybka 09.10.2015 17:15
:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.



Los geht's:

Schritt 1
http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...e/frst/sn1.PNG

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://deeprybka.trojaner-board.de/tdss/codetags.gif

RehIT 10.10.2015 02:26
FRST Logs
 
Guten Abend.

Wie angewiesen, habe ich den Scan durchgeführt.

FRST.txt
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:08-10-2015
durchgeführt von USER (Administrator) auf COMPUTER (10-10-2015 02:51:27)
Gestartet von C:\Users\USER\Desktop
Geladene Profile: USER (Verfügbare Profile: USER & Administrator & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 10 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
 (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
 (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
 (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-07-30] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
BootExecute: autocheck autochk:cf * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

AutoConfigURL: [S-1-5-21-3347640149-618416472-1368429990-1176] => hxxps://crvvpn.net/secvpn.js
Tcpip\Parameters: [DhcpNameServer] ***.***.***.***
Tcpip\..\Interfaces\{71A0E7E8-E6B4-4338-8501-233684B540FE}: [DhcpNameServer] ***.***.***.***

Internet Explorer:
==================
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.at/?gfe_rd=ssl&ei=j8IXVvKSE4uEaIK6tMgL
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com/?pc=DCJB
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3347640149-618416472-1368429990-1176 -> {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-08-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-09-22] (Eyeo GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-10-09] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-09] (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)

FireFox:
========
FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\9wc6i27g.default
FF Homepage: hxxps://www.google.at/
FF NetworkProxy: "type", 2
FF NetworkProxy: "autoconfig_url", "https://crvvpn.net/secvpn.js"
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-22] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-22] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-10-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-10-09] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF Extension: Firefox Old Version Update Hotfix - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\9wc6i27g.default\Extensions\firefox-hotfix@mozilla.org.xpi [2014-09-02]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => nicht gefunden

Chrome:
=======
CHR Profile: C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-12]
CHR Extension: (Google Drive) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-12]
CHR Extension: (YouTube) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-12]
CHR Extension: (Google Search) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-12]
CHR Extension: (Google Docs Offline) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-10-09]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-10-09]
CHR Extension: (Chrome Web Store Payments) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-09]
CHR Extension: (Gmail) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
S2 InvProtectSvc; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe [3485512 2015-08-20] (Invincea, Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-22] (Intel Corporation)
S4 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S4 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 SboxSvc; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe [174920 2015-08-20] (Invincea, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-03-20] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTDVHD64.sys [2192088 2013-08-24] (Realtek Semiconductor Corp.)
S3 InvProtectDrv; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrv64.sys [64648 2015-08-20] (Invincea, Inc.)
S3 InvProtectDrvNet; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrvNet64.sys [24200 2015-08-20] (Invincea, Inc.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-08-22] (Intel Corporation)
R3 SboxDrv; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxDrv.sys [187528 2015-08-20] (Invincea, Inc.)
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2014-03-20] (Microsoft Corporation) [Datei ist nicht signiert]
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2014-03-20] (Microsoft Corporation) [Datei ist nicht signiert]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-10 02:50 - 2015-10-10 02:51 - 00029576 _____ C:\Users\USER\Desktop\Addition.txt
2015-10-10 02:50 - 2015-10-10 02:51 - 00015212 _____ C:\Users\USER\Desktop\FRST.txt
2015-10-10 02:50 - 2015-10-10 02:51 - 00000000 ____D C:\FRST
2015-10-10 02:46 - 2015-10-10 02:47 - 02194944 _____ (Farbar) C:\Users\USER\Desktop\FRST64.exe
2015-10-09 17:44 - 2014-04-22 17:01 - 00001485 _____ C:\Users\USER\Desktop\Internet Explorer.lnk
2015-10-09 15:00 - 2015-10-09 15:00 - 00000952 _____ C:\Windows\system32\TmInstall.log
2015-10-09 14:48 - 2015-10-09 14:57 - 00164812 _____ C:\Windows\PFRO.log
2015-10-09 14:48 - 2015-10-09 14:57 - 00000112 _____ C:\Windows\setupact.log
2015-10-09 14:48 - 2015-10-09 14:48 - 00000000 _____ C:\Windows\setuperr.log
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default\AppData\Roaming\Invincea
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default\AppData\Local\Invincea
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Invincea
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default User\AppData\Local\Invincea
2015-10-09 13:50 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2015-10-09 13:50 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2015-10-09 13:47 - 2015-10-09 13:47 - 00000000 ____D C:\Program Files\Common Files\AV
2015-10-09 13:42 - 2015-10-09 14:20 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-10-09 13:42 - 2015-10-09 13:47 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-10-09 13:42 - 2015-10-09 13:42 - 00001393 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-10-09 13:42 - 2015-10-09 13:42 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-10-09 13:42 - 2015-10-09 13:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-10-09 13:42 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-10-09 13:22 - 2015-10-09 13:22 - 00000000 ____D C:\Users\USER\AppData\Roaming\Sun
2015-10-09 13:22 - 2015-10-09 13:22 - 00000000 ____D C:\Users\USER\.oracle_jre_usage
2015-10-09 13:21 - 2015-10-09 13:21 - 01682432 _____ C:\Users\USER\Downloads\adwcleaner_5.013.exe
2015-10-09 13:21 - 2015-10-09 13:21 - 00000000 ____D C:\Users\USER\AppData\LocalLow\Oracle
2015-10-09 13:16 - 2015-10-09 13:20 - 49695840 _____ (Oracle Corporation) C:\Users\USER\Downloads\jre-8u60-windows-i586.exe
2015-10-09 09:09 - 2015-10-09 09:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-10-08 03:00 - 2015-10-08 03:00 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2015-10-08 03:00 - 2015-10-08 03:00 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2015-10-07 15:29 - 2015-08-05 19:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-10-07 15:29 - 2015-08-05 19:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-10-07 15:29 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-10-07 15:28 - 2015-08-05 19:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-10-07 15:28 - 2015-07-15 05:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-10-07 15:28 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-10-07 15:27 - 2015-10-07 15:27 - 00002864 _____ C:\Users\USER\Desktop\Outlook 2013.lnk
2015-10-07 15:26 - 2015-09-02 05:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-10-07 15:26 - 2015-09-02 05:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-10-07 15:26 - 2015-09-02 05:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-10-07 15:26 - 2015-09-02 05:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-10-07 15:26 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-10-07 15:26 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-10-07 15:26 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-10-07 15:26 - 2015-09-02 04:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-10-07 15:26 - 2015-09-02 03:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-10-07 15:26 - 2015-09-02 03:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-10-07 15:26 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-10-07 15:26 - 2015-08-22 15:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-10-07 15:26 - 2015-08-22 15:50 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-10-07 15:26 - 2015-08-20 20:53 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-10-07 15:26 - 2015-08-20 20:46 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-10-07 15:26 - 2015-08-20 20:21 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-10-07 15:26 - 2015-08-20 20:19 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-10-07 15:26 - 2015-08-04 20:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-10-07 15:26 - 2015-08-04 20:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-10-07 15:26 - 2015-08-04 19:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-10-07 15:26 - 2015-08-04 19:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-10-07 15:26 - 2015-08-04 19:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-10-07 15:26 - 2015-08-04 19:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-10-07 15:26 - 2015-08-04 19:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-10-07 15:26 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-10-07 15:26 - 2015-08-04 18:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-10-07 15:25 - 2015-08-26 20:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-10-07 15:25 - 2015-08-26 20:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-10-07 15:25 - 2015-08-26 20:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-10-07 15:25 - 2015-08-26 20:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-10-07 15:25 - 2015-08-26 20:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-10-07 15:25 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-10-07 15:25 - 2015-08-22 16:40 - 14383616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 13774848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 02865664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 02056704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 01763328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-10-07 15:25 - 2015-08-22 16:40 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00718848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00525312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-10-07 15:25 - 2015-08-22 15:51 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-10-07 15:25 - 2015-08-22 15:51 - 01409024 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-10-07 15:25 - 2015-08-22 15:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 19291648 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 02657280 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-10-07 15:25 - 2015-08-22 15:50 - 00857600 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-10-07 15:25 - 2015-08-20 19:56 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-10-07 15:25 - 2015-08-20 19:55 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-10-07 15:14 - 2015-10-08 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-10-07 15:13 - 2015-10-07 15:13 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2015-10-07 15:12 - 2015-10-07 15:12 - 00000000 __RHD C:\MSOCache
2015-10-07 15:12 - 2015-10-07 15:12 - 00000000 ____D C:\Program Files\Microsoft Office
2015-10-07 15:12 - 2015-10-07 15:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2015-10-07 15:04 - 2015-10-07 15:04 - 00002143 _____ C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-10-07 15:04 - 2015-10-07 15:04 - 00002122 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-10-07 15:04 - 2015-10-07 15:04 - 00002122 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-10-07 15:04 - 2015-10-07 15:04 - 00000000 ___RD C:\Users\USER\OneDrive
2015-10-07 15:04 - 2015-10-07 15:04 - 00000000 ____D C:\Program Files (x86)\Microsoft OneDrive
2015-10-02 14:46 - 2015-10-02 14:45 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\mbam-setup-2.1.8.1057.exe

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-10 02:21 - 2014-03-20 03:17 - 02043755 _____ C:\Windows\WindowsUpdate.log
2015-10-10 02:21 - 2014-03-19 19:23 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-10-10 01:59 - 2014-11-12 08:11 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-10 01:49 - 2014-04-22 16:34 - 00000136 _____ C:\Windows\system32\config\netlogon.ftl
2015-10-09 15:07 - 2009-07-14 06:45 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-09 15:07 - 2009-07-14 06:45 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-09 15:05 - 2011-03-01 06:56 - 00769884 _____ C:\Windows\system32\perfh007.dat
2015-10-09 15:05 - 2011-03-01 06:56 - 00167176 _____ C:\Windows\system32\perfc007.dat
2015-10-09 15:05 - 2009-07-14 07:13 - 01785240 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-09 15:00 - 2014-11-12 08:11 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-09 14:57 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-09 13:52 - 2014-03-19 19:36 - 00002014 _____ C:\Users\Public\Desktop\Protected Workspace.lnk
2015-10-09 13:52 - 2014-03-19 19:36 - 00000000 ____D C:\Program Files (x86)\Invincea
2015-10-09 13:52 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2015-10-09 13:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2015-10-09 13:41 - 2014-12-05 16:02 - 00000000 ____D C:\Windows\pss
2015-10-09 13:37 - 2014-07-01 08:49 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2015-10-09 13:37 - 2014-06-23 13:00 - 00000000 ____D C:\Users\USER\AppData\Local\CrashDumps
2015-10-09 13:37 - 2011-02-10 16:25 - 00000000 ____D C:\Windows\panther
2015-10-09 13:36 - 2014-12-05 15:42 - 00000000 ____D C:\temp
2015-10-09 13:25 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-10-09 13:24 - 2014-11-28 14:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-10-09 13:24 - 2014-04-22 09:55 - 00000000 ____D C:\ProgramData\Oracle
2015-10-09 13:22 - 2014-04-22 17:01 - 00000000 ____D C:\Users\USER
2015-10-09 13:22 - 2014-04-22 09:55 - 00274016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-10-09 13:22 - 2014-04-22 09:55 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-10-09 13:22 - 2014-04-22 09:55 - 00000000 ____D C:\Program Files (x86)\Java
2015-10-09 09:35 - 2014-12-02 14:46 - 00000000 ____D C:\Users\USER\AppData\LocalLow\Adblock Plus for IE
2015-10-09 09:34 - 2014-12-02 14:46 - 00000000 ____D C:\Program Files\Adblock Plus for IE
2015-10-08 16:05 - 2014-04-23 09:33 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-10-08 16:02 - 2009-07-14 04:34 - 00000510 _____ C:\Windows\win.ini
2015-10-08 15:58 - 2014-09-25 14:22 - 00000000 ____D C:\ProgramData\firebird
2015-10-08 08:02 - 2014-04-22 17:15 - 00141376 _____ C:\Users\USER\AppData\Local\GDIPFONTCACHEV1.DAT
2015-10-08 03:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-10-08 03:11 - 2010-11-21 09:17 - 00000000 ____D C:\Program Files\Windows Journal
2015-10-08 03:11 - 2009-07-14 06:45 - 00549832 _____ C:\Windows\system32\FNTCACHE.DAT
2015-10-08 03:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-10-07 15:24 - 2011-02-10 16:33 - 01804514 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-10-07 15:20 - 2014-04-23 13:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-07 15:13 - 2014-03-19 19:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2015-10-07 15:13 - 2010-11-21 09:17 - 00000000 ____D C:\Windows\ShellNew
2015-10-07 15:12 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-10-02 13:03 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-10-01 17:12 - 2014-04-23 10:09 - 00000000 ____D C:\ProgramData\FLEXnet
2015-10-01 17:12 - 2014-04-22 18:38 - 00000000 ____D C:\ProgramData\SQL Anywhere 11
2015-10-01 17:12 - 2014-04-22 18:31 - 00000000 ____D C:\Users\Administrator.COMPUTER
2015-10-01 17:12 - 2014-04-22 18:22 - 00000000 ____D C:\Users\USER\AppData\Roaming\SQL Anywhere 12
2015-10-01 17:12 - 2014-04-22 16:36 - 00000000 ____D C:\Users\administrator
2015-10-01 17:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-09-30 17:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\security
2015-09-30 17:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2015-09-30 12:08 - 2015-04-30 12:36 - 00008132 _____ C:\Users\USER\0.mbs.txt
2015-09-28 08:00 - 2014-11-12 08:13 - 00002177 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-22 08:22 - 2014-03-19 19:23 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-09-22 08:22 - 2014-03-19 19:23 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-22 08:22 - 2014-03-19 19:23 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-09-15 12:54 - 2014-11-12 08:11 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-15 12:54 - 2014-11-12 08:11 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

Einige Dateien in TEMP:
====================
C:\Users\Administrator.COMPUTER\AppData\Local\Temp\drm_dialogs.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-10-02 12:16

==================== Ende von FRST.txt ============================
Addition.txt
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:08-10-2015
durchgeführt von USER (2015-10-10 02:51:47)
Gestartet von C:\Users\USER\Desktop
Windows 7 Professional Service Pack 1 (X64) (2014-04-22 07:42:53)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-4246694115-3229728745-2940103716-500 - Administrator - Enabled) => C:\Users\Administrator.COMPUTER
Gast (S-1-5-21-4246694115-3229728745-2940103716-501 - Limited - Disabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
a.sign Client 1.3.2.13 (HKLM-x32\...\a.sign Client) (Version: 1.3.2.13 - A-Trust GmbH)
Adblock Plus für IE (32-Bit- und 64-Bit) (HKLM\...\{588B7DD2-3480-4A89-A8F6-C6781CBFAD56}) (Version: 1.5 - Eyeo GmbH)
Adobe Flash Player 19 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 19.0.0.185 - Adobe Systems Incorporated)
Adobe Reader XI  MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
asignPDFverify 1.0.9.0 (HKLM-x32\...\asignPDFverify) (Version: 1.0.9.0 - A-Trust)
BDE Information Utility (HKLM-x32\...\BDE Information Utility) (Version:  - InterBase Installation Info (and BDE Information Utility))
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.9.13 - REINER SCT)
Dell Client System Update (HKLM-x32\...\{04566294-A6B6-4462-9721-031073EB3694}) (Version: 1.3.0 - Dell Inc.)
Dell Digital Delivery (HKLM-x32\...\{03A9F528-A754-460F-B2C1-AC125A147114}) (Version: 2.8.5000.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Protected Workspace (HKLM-x32\...\{E2CAA395-66B3-4772-85E3-6134DBAB244E}) (Version: 5.0.21247 - Invincea, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.101 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3234 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Java 8 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218060F0}) (Version: 8.0.600.27 - Oracle Corporation)
Kundendienste Online 2.0.0.6 (HKLM-x32\...\Kundendienste Online) (Version: 2.0.0.6 - A-Trust GmbH)
medix4 Version 1.2.1 (HKLM-x32\...\Lexio_32_9CB5CB3B8BC94CA3B7713517A9901DD1_is1) (Version: 1.2.1 - Medix Informatik GmbH)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM-x32\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3347640149-618416472-1368429990-1176\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 2.0 SP3 (HKLM-x32\...\{6F396FFB-CC3A-4335-BC0B-2AEF38F4492C}) (Version: 2.0.5050.0 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Olivetti Product Library (HKLM\...\Olivetti Product Library) (Version: 3.0.0219 - KYOCERA Document Solutions Inc.)
Outils de vérification linguistique 2013 de Microsoft Office - Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
paraOfficeSuite2011 (HKU\S-1-5-21-3347640149-618416472-1368429990-1176\...\4aca4659c0d5fdc6) (Version: 2.13.5.137 - paraOfficeSuite2011)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5987 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version:  - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SpeechExec Pro Transcribe (HKLM-x32\...\{15EECDD1-C7DE-4714-AD97-7CB1718EF9AC}) (Version: 8.5.850.8 - Speech Processing Solutions GmbH)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SQL Anywhere 11 (HKLM\...\{ECE263B0-6C8B-404C-B4AC-8FAB1C87AB4A}) (Version: 11.0.1562 - iAnywhere Solutions, Inc.)
Update for Skype for Business 2015 (KB2889853) 32-Bit Edition (HKLM-x32\...\{90150000-012B-0407-0000-0000000FF1CE}_Office15.PROPLUS_{0C5B0539-7EDE-4297-947E-48890971B557}) (Version:  - Microsoft)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

09-10-2015 13:50:42 Windows Update

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {18A19178-9B9E-4ECC-9619-783DD068EE4D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {216B4E4A-E34A-4824-B6C3-971F6222AA0F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {34BAA542-0B56-496E-8DE6-18FD30753E80} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-22] (Adobe Systems Incorporated)
Task: {55C88803-BF97-4A4C-8471-C9E328FF54C9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {5E900163-A63B-455C-977C-B9C0CE8E8476} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {8D6F179E-B016-44FB-AACC-5B5BB11E93ED} - System32\Tasks\Microsoft Office 15 Sync Maintenance for {1a7b7c82-4ebf-44ea-8e04-7c2615cf18a3} COMPUTER.weidacher.local => C:\Program Files (x86)\Microsoft Office\Office15\MsoSync.exe [2015-08-12] (Microsoft Corporation)
Task: {AB97AB13-D74D-46B7-99CB-DE16EDCD831C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {CE751575-50F0-46EB-9EC4-25ACA0C62F99} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {F1BDF7F1-A9A8-4F16-AFDA-16564815BAC7} - System32\Tasks\{6790C9BE-DB4F-4B1E-933D-217A273F847A} => pcalua.exe -a "C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WAHTFP5S\bc_6_9_13.exe" -d C:\Users\USER\Desktop
Task: {F5F69185-A23B-4470-8CA2-C24539635E47} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2014-04-23 09:32 - 2011-02-10 12:01 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2014-09-02 17:09 - 2007-05-31 08:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2015-10-09 13:42 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-10-09 13:42 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-10-09 13:42 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-10-09 13:42 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-10-09 13:42 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-03-19 19:27 - 2013-08-22 01:33 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:104
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:150
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:272
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3204
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3247
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3348

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-3347640149-618416472-1368429990-1176\...\elba.at -> hxxp://www.elba.at


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3347640149-618416472-1368429990-1176\Control Panel\Desktop\\Wallpaper -> C:\Users\USER\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: ***.***.***.***
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\Services: FlexNet Licensing Service => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: PDF Architect 2 => 3
MSCONFIG\Services: pdfforge CrashHandler => 3
MSCONFIG\Services: SboxSvc => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^a.sign Client.lnk => C:\Windows\pss\a.sign Client.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^USER^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^An OneNote senden.lnk => C:\Windows\pss\An OneNote senden.lnk.Startup
MSCONFIG\startupreg: SHIWebOnDiskManager => "C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe"
MSCONFIG\startupreg: SpeechExecPTQuickLoad => "C:\Program Files (x86)\Philips Speech\SpeechExec Pro Transcribe\SEPTrans.exe" /quickload
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{73C516C1-6FBF-4ADC-BB99-5A3786896594}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{3674823F-EA57-4CAC-8658-35DDA41A3C42}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{D4D38A16-430B-43CF-927B-C04CC9693747}] => (Allow) C:\Users\administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{AFA0F1C2-7055-42D7-BA1B-BAF2E659B13F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{514CB1E1-0744-4CCB-8EFB-5675F80D94B0}] => (Allow) C:\Users\USER\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{D92B6960-A8EF-4164-94D6-FA30579EE2F4}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{F2B56C56-37A7-4E4F-AFC7-57558E47BFAE}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\lync.exe
FirewallRules: [{A9DCB39D-DFBD-47ED-A05E-8D1F144B37DE}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{8CCDB284-4B16-4788-B763-F9473C933A1E}] => (Allow) C:\Program Files (x86)\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{1773D399-C05A-423D-B96E-B2C3FE71D988}] => (Allow) LPort=23493
FirewallRules: [{7CA77212-7CF2-4977-B791-6C6E9A13A4A3}] => (Allow) LPort=23493
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: M37S             
Description: M37S             
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (10/09/2015 02:58:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/09/2015 02:49:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/09/2015 01:30:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/09/2015 09:35:18 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 10.0.9200.17489 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1268

Startzeit: 01d1026500e452b4

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (10/09/2015 09:31:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/09/2015 09:27:46 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d.manifest.

Error: (10/09/2015 07:39:52 AM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft Word: Rejected Safe Mode action : Word konnte beim letzten Mal nicht gestartet werden. Der abgesicherte Modus kann Ihnen bei der Problembehandlung behilflich sein. Einige Features sind aber in diesem Modus möglicherweise nicht verfügbar.

Möchten Sie im abgesicherten Modus starten?.
Rejected Safe Mode action : Microsoft Word.

Error: (10/09/2015 07:06:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/08/2015 01:07:09 PM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft Outlook: Rejected Safe Mode action : Outlook konnte beim letzten Mal nicht gestartet werden. Der abgesicherte Modus kann Ihnen bei der Problembehandlung behilflich sein. Einige Features sind aber in diesem Modus möglicherweise nicht verfügbar.

Möchten Sie im abgesicherten Modus starten?.
Rejected Safe Mode action : Microsoft Outlook.

Error: (10/08/2015 12:53:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OUTLOOK.EXE, Version: 15.0.4569.1503, Zeitstempel: 0x52b0b282
Name des fehlerhaften Moduls: d3d11.dll, Version: 6.2.9200.16570, Zeitstempel: 0x5153774d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000424b6
ID des fehlerhaften Prozesses: 0xba8
Startzeit der fehlerhaften Anwendung: 0xOUTLOOK.EXE0
Pfad der fehlerhaften Anwendung: OUTLOOK.EXE1
Pfad des fehlerhaften Moduls: OUTLOOK.EXE2
Berichtskennung: OUTLOOK.EXE3


Systemfehler:
=============
Error: (10/09/2015 03:00:31 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (10/09/2015 02:58:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Invincea Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (10/09/2015 02:58:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Invincea Service erreicht.

Error: (10/09/2015 02:51:22 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (10/09/2015 02:49:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Invincea Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 38%
Installierter physikalischer RAM: 4014.77 MB
Verfügbarer physikalischer RAM: 2462.88 MB
Summe virtueller Speicher: 8027.75 MB
Verfügbarer virtueller Speicher: 6296.96 MB

==================== Laufwerke ================================

Drive c: (OS) (Fixed) (Total:96.1 GB) (Free:29.82 GB) NTFS
Drive e: (RECOVERY) (Fixed) (Total:15.67 GB) (Free:7.15 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]
Drive f: (Daten) (Fixed) (Total:450.06 GB) (Free:448.06 GB) NTFS
Drive p: () (Network) (Total:419.15 GB) (Free:142.16 GB) NTFS
Drive u: () (Network) (Total:419.15 GB) (Free:142.16 GB) NTFS
Drive v: () (Network) (Total:419.15 GB) (Free:142.16 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 63A1ACE4)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=15.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 111.8 GB) (Disk ID: 5F4BBC39)
Partition 1: (Not Active) - (Size=16 MB) - (Type=DE)
Partition 2: (Active) - (Size=15.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=96.1 GB) - (Type=07 NTFS)

==================== Ende von Addition.txt ============================
Danke schon einmal für die schnelle Antwort! :dankeschoen:

deeprybka 10.10.2015 11:06
Zitat:
Zitat von RehIT (Beitrag 1523913)
Kann doch nicht sein, dass dieser kleine Virus so schwer zu vernichten ist :aufsmaul:
Nö, ist es auch nicht. Ich hoffe Du hast Deine Login-Daten nicht eingegeben oder ein App installiert? In diesem Falle muss Dein Online-Banking-Konto gesperrt werden.
Bitte bis zum Ende der Bereinigung mit dem PC nur online gehen um meine Anweisungen durchzuführen und natürlich kein Onlinebanking.
Keine Programme de-/installieren außer auf Anweisung.

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...e/frst/sn4.PNG

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
CloseProcesses:
Task: {F1BDF7F1-A9A8-4F16-AFDA-16564815BAC7} - System32\Tasks\{6790C9BE-DB4F-4B1E-933D-217A273F847A} => pcalua.exe -a
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:104
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:150
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:272
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3204
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3247
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3348
AutoConfigURL: [S-1-5-21-3347640149-618416472-1368429990-1176] => hxxps://crvvpn.net/secvpn.js
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3347640149-618416472-1368429990-1176 -> {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
FF NetworkProxy:
RemoveProxy:
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Entfernen-Button.
  • Das Tool erstellt eine "Fixlog.txt" -Datei.
  • Poste mir bitte deren Inhalt.

Schritt 2
Bitte deinstalliere Spybot - Search and Destroy.

Schritt 3
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.


Schritt 4

Downloade Dir HitmanProhttp://deeprybka.trojaner-board.de/b.../hitmanpro.pngauf Deinen Desktop:

HitmanPro-32 Bit Version
HitmanPro-64 Bit Version
Schritt 5

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...e/frst/sn1.PNG

Bitte starte FRST erneut, und drücke auf Untersuchen.
Bitte poste mir den Inhalt des Logs.

RehIT 11.10.2015 00:02
Ausführung der weiteren Schritte
 
Guten Abend.

Ich bedanke mich vorweg schon einmal für deine Hilfe und deine detailierten Anleitungen. :daumenhoc


Schritt 1:
FRST Fixlist

Fixlog
Code:
Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:10-10-2015
durchgeführt von USER (2015-10-11 00:05:43) Run:1
Gestartet von C:\Users\USER\Downloads\Virenscan
Geladene Profile: USER (Verfügbare Profile: USER & Administrator & Administrator)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
CloseProcesses:
Task: {F1BDF7F1-A9A8-4F16-AFDA-16564815BAC7} - System32\Tasks\{6790C9BE-DB4F-4B1E-933D-217A273F847A} => pcalua.exe -a
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:104
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:150
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:272
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3204
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3247
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:3348
AutoConfigURL: [S-1-5-21-3347640149-618416472-1368429990-1176] => hxxps://crvvpn.net/secvpn.js
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3347640149-618416472-1368429990-1176 -> {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
FF NetworkProxy:
RemoveProxy:
*****************

Prozess erfolgreich geschlossen.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F1BDF7F1-A9A8-4F16-AFDA-16564815BAC7}" => Schlüssel erfolgreich entfernt
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1BDF7F1-A9A8-4F16-AFDA-16564815BAC7}" => Schlüssel erfolgreich entfernt
C:\Windows\System32\Tasks\{6790C9BE-DB4F-4B1E-933D-217A273F847A} => erfolgreich verschoben
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6790C9BE-DB4F-4B1E-933D-217A273F847A}" => Schlüssel erfolgreich entfernt
C:\Windows\SysWOW64\MSIHANDLE => ":104" ADS erfolgreich entfernt.
C:\Windows\SysWOW64\MSIHANDLE => ":150" ADS erfolgreich entfernt.
C:\Windows\SysWOW64\MSIHANDLE => ":272" ADS erfolgreich entfernt.
C:\Windows\SysWOW64\MSIHANDLE => ":3204" ADS erfolgreich entfernt.
C:\Windows\SysWOW64\MSIHANDLE => ":3247" ADS erfolgreich entfernt.
C:\Windows\SysWOW64\MSIHANDLE => ":3348" ADS erfolgreich entfernt.
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\AutoConfigURL => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich entfernt
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich entfernt
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wert erfolgreich entfernt
"HKU\S-1-5-21-3347640149-618416472-1368429990-1176\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AB6345E8-AE38-45A0-BEC0-AB30139FEDFB}" => Schlüssel erfolgreich entfernt
HKCR\CLSID\{AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} => Schlüssel nicht gefunden.
Firefox Proxy-Einstellungen wurden zurückgesetzt

========= RemoveProxy: =========

HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\\ => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt


========= Ende von RemoveProxy: =========

Schritt 2:
Spybot Search and Destroy wurde deinstalliert.


Schritt 3:
TDSSKiller Scan

TDSSKiller Log
Code:
00:18:04.0350 0x061c  TDSS rootkit removing tool 3.1.0.5 Jul 24 2015 12:29:57
00:18:13.0035 0x061c  ============================================================
00:18:13.0035 0x061c  Current date / time: 2015/10/11 00:18:13.0035
00:18:13.0035 0x061c  SystemInfo:
00:18:13.0035 0x061c 
00:18:13.0035 0x061c  OS Version: 6.1.7601 ServicePack: 1.0
00:18:13.0035 0x061c  Product type: Workstation
00:18:13.0035 0x061c  ComputerName: COMPUTER
00:18:13.0035 0x061c  UserName: USER
00:18:13.0035 0x061c  Windows directory: C:\Windows
00:18:13.0035 0x061c  System windows directory: C:\Windows
00:18:13.0035 0x061c  Running under WOW64
00:18:13.0035 0x061c  Processor architecture: Intel x64
00:18:13.0035 0x061c  Number of processors: 4
00:18:13.0035 0x061c  Page size: 0x1000
00:18:13.0035 0x061c  Boot type: Normal boot
00:18:13.0035 0x061c  ============================================================
00:18:13.0495 0x061c  KLMD registered as C:\Windows\system32\drivers\59312811.sys
00:18:13.0720 0x061c  System UUID: {9D15D25F-BC2F-F570-F02A-C5EE24AEB433}
00:18:14.0265 0x061c  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
00:18:14.0275 0x061c  Drive \Device\Harddisk1\DR1 - Size: 0x1BF2976000 ( 111.79 Gb ), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
00:18:14.0290 0x061c  ============================================================
00:18:14.0290 0x061c  \Device\Harddisk0\DR0:
00:18:14.0290 0x061c  MBR partitions:
00:18:14.0290 0x061c  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1F55000
00:18:14.0290 0x061c  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1F69000, BlocksNum 0x3841C800
00:18:14.0290 0x061c  \Device\Harddisk1\DR1:
00:18:14.0290 0x061c  MBR partitions:
00:18:14.0290 0x061c  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x7D82, BlocksNum 0x1F58A7E
00:18:14.0290 0x061c  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x1F60800, BlocksNum 0xC032FC1
00:18:14.0290 0x061c  ============================================================
00:18:14.0290 0x061c  C: <-> \Device\Harddisk1\DR1\Partition2
00:18:14.0310 0x061c  E: <-> \Device\Harddisk0\DR0\Partition1
00:18:14.0325 0x061c  F: <-> \Device\Harddisk0\DR0\Partition2
00:18:14.0325 0x061c  ============================================================
00:18:14.0325 0x061c  Initialize success
00:18:14.0325 0x061c  ============================================================
00:18:52.0188 0x094c  ============================================================
00:18:52.0188 0x094c  Scan started
00:18:52.0188 0x094c  Mode: Manual; SigCheck; TDLFS;
00:18:52.0188 0x094c  ============================================================
00:18:52.0188 0x094c  KSN ping started
00:18:54.0528 0x094c  KSN ping finished: true
00:18:54.0733 0x094c  ================ Scan system memory ========================
00:18:54.0733 0x094c  System memory - ok
00:18:54.0733 0x094c  ================ Scan services =============================
00:18:54.0758 0x094c  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
00:18:54.0808 0x094c  1394ohci - ok
00:18:54.0823 0x094c  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
00:18:54.0838 0x094c  ACPI - ok
00:18:54.0843 0x094c  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
00:18:54.0878 0x094c  AcpiPmi - ok
00:18:54.0883 0x094c  [ 013697369EAFFA675D0671607F036020, 65611C775AC4681E46A6565E5A7A4FF3363C66EBDC98C4C58AFB365D40BE23B6 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
00:18:54.0893 0x094c  AdobeARMservice - ok
00:18:54.0908 0x094c  [ C6D147C12C424373B016C0AB0A6C61EB, 043D44F3C942CFC3558E782938C26849BF648A58A7AA62C4A526E37DE4136C27 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
00:18:54.0918 0x094c  AdobeFlashPlayerUpdateSvc - ok
00:18:54.0933 0x094c  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
00:18:54.0953 0x094c  adp94xx - ok
00:18:54.0958 0x094c  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci        C:\Windows\system32\drivers\adpahci.sys
00:18:54.0973 0x094c  adpahci - ok
00:18:54.0983 0x094c  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
00:18:54.0993 0x094c  adpu320 - ok
00:18:54.0998 0x094c  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
00:18:55.0048 0x094c  AeLookupSvc - ok
00:18:55.0068 0x094c  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD            C:\Windows\system32\drivers\afd.sys
00:18:55.0093 0x094c  AFD - ok
00:18:55.0098 0x094c  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
00:18:55.0103 0x094c  agp440 - ok
00:18:55.0108 0x094c  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG            C:\Windows\System32\alg.exe
00:18:55.0123 0x094c  ALG - ok
00:18:55.0128 0x094c  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
00:18:55.0138 0x094c  aliide - ok
00:18:55.0138 0x094c  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
00:18:55.0148 0x094c  amdide - ok
00:18:55.0153 0x094c  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
00:18:55.0163 0x094c  AmdK8 - ok
00:18:55.0168 0x094c  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
00:18:55.0183 0x094c  AmdPPM - ok
00:18:55.0188 0x094c  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
00:18:55.0198 0x094c  amdsata - ok
00:18:55.0203 0x094c  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
00:18:55.0213 0x094c  amdsbs - ok
00:18:55.0218 0x094c  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata        C:\Windows\system32\drivers\amdxata.sys
00:18:55.0228 0x094c  amdxata - ok
00:18:55.0248 0x094c  Amsp - ok
00:18:55.0253 0x094c  [ A0711D119BA4B48A1470C768D301013E, 536366F809125D2C2171597C8C2CB3271BE5C6B373152112E0D970749776E00A ] AppID          C:\Windows\system32\drivers\appid.sys
00:18:55.0268 0x094c  AppID - ok
00:18:55.0268 0x094c  [ 173C90AF5B243B4DD86F95CA154CB58A, 349F566DADC96B31FDC34C4F26545FB880844DBF84E5821AA0D0CAA91FB837E1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
00:18:55.0283 0x094c  AppIDSvc - ok
00:18:55.0288 0x094c  [ 978DC0A1FBE9CC91B21B40AF66CB396A, 90BAFF81D98F5AFD743D8BD65F716666A7A7BD2DA612492E03C79B29E9A0F8C2 ] Appinfo        C:\Windows\System32\appinfo.dll
00:18:55.0298 0x094c  Appinfo - ok
00:18:55.0308 0x094c  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt        C:\Windows\System32\appmgmts.dll
00:18:55.0328 0x094c  AppMgmt - ok
00:18:55.0333 0x094c  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc            C:\Windows\system32\drivers\arc.sys
00:18:55.0343 0x094c  arc - ok
00:18:55.0348 0x094c  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\drivers\arcsas.sys
00:18:55.0358 0x094c  arcsas - ok
00:18:55.0368 0x094c  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
00:18:55.0378 0x094c  aspnet_state - ok
00:18:55.0383 0x094c  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
00:18:55.0408 0x094c  AsyncMac - ok
00:18:55.0413 0x094c  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi          C:\Windows\system32\drivers\atapi.sys
00:18:55.0423 0x094c  atapi - ok
00:18:55.0438 0x094c  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
00:18:55.0463 0x094c  AudioEndpointBuilder - ok
00:18:55.0478 0x094c  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll
00:18:55.0503 0x094c  AudioSrv - ok
00:18:55.0508 0x094c  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
00:18:55.0538 0x094c  AxInstSV - ok
00:18:55.0543 0x094c  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
00:18:55.0563 0x094c  b06bdrv - ok
00:18:55.0573 0x094c  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
00:18:55.0588 0x094c  b57nd60a - ok
00:18:55.0598 0x094c  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
00:18:55.0613 0x094c  BDESVC - ok
00:18:55.0613 0x094c  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
00:18:55.0638 0x094c  Beep - ok
00:18:55.0658 0x094c  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE            C:\Windows\System32\bfe.dll
00:18:55.0688 0x094c  BFE - ok
00:18:55.0713 0x094c  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
00:18:55.0758 0x094c  BITS - ok
00:18:55.0768 0x094c  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
00:18:55.0783 0x094c  blbdrive - ok
00:18:55.0788 0x094c  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
00:18:55.0803 0x094c  bowser - ok
00:18:55.0803 0x094c  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
00:18:55.0818 0x094c  BrFiltLo - ok
00:18:55.0818 0x094c  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
00:18:55.0833 0x094c  BrFiltUp - ok
00:18:55.0838 0x094c  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser        C:\Windows\System32\browser.dll
00:18:55.0853 0x094c  Browser - ok
00:18:55.0863 0x094c  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
00:18:55.0883 0x094c  Brserid - ok
00:18:55.0888 0x094c  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
00:18:55.0903 0x094c  BrSerWdm - ok
00:18:55.0903 0x094c  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
00:18:55.0918 0x094c  BrUsbMdm - ok
00:18:55.0918 0x094c  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
00:18:55.0933 0x094c  BrUsbSer - ok
00:18:55.0938 0x094c  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
00:18:55.0948 0x094c  BTHMODEM - ok
00:18:55.0953 0x094c  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv        C:\Windows\system32\bthserv.dll
00:18:55.0983 0x094c  bthserv - ok
00:18:55.0988 0x094c  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
00:18:56.0013 0x094c  cdfs - ok
00:18:56.0018 0x094c  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
00:18:56.0033 0x094c  cdrom - ok
00:18:56.0038 0x094c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc    C:\Windows\System32\certprop.dll
00:18:56.0063 0x094c  CertPropSvc - ok
00:18:56.0068 0x094c  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
00:18:56.0083 0x094c  circlass - ok
00:18:56.0103 0x094c  [ 8FEE4423D682394EB436C975D0A3A994, E43EE914EBB4982E850B7E823C81BB4D11D486D9A27227FD9E0B8D60AAADE5B6 ] cjpcsc          C:\Windows\SysWOW64\cjpcsc.exe
00:18:56.0133 0x094c  cjpcsc - ok
00:18:56.0138 0x094c  [ 06E1F5228399FC49A8D026DA38DB6784, 5554071E5C55FC7EF3C7C95F0BC565509C3F0C03E0814C98376932A9D1C32AA6 ] cjusb          C:\Windows\system32\DRIVERS\cjusb.sys
00:18:56.0153 0x094c  cjusb - ok
00:18:56.0163 0x094c  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\Windows\system32\CLFS.sys
00:18:56.0178 0x094c  CLFS - ok
00:18:56.0183 0x094c  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
00:18:56.0193 0x094c  clr_optimization_v2.0.50727_32 - ok
00:18:56.0203 0x094c  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
00:18:56.0213 0x094c  clr_optimization_v2.0.50727_64 - ok
00:18:56.0223 0x094c  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
00:18:56.0233 0x094c  clr_optimization_v4.0.30319_32 - ok
00:18:56.0238 0x094c  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
00:18:56.0253 0x094c  clr_optimization_v4.0.30319_64 - ok
00:18:56.0253 0x094c  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
00:18:56.0268 0x094c  CmBatt - ok
00:18:56.0268 0x094c  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
00:18:56.0278 0x094c  cmdide - ok
00:18:56.0293 0x094c  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG            C:\Windows\system32\Drivers\cng.sys
00:18:56.0313 0x094c  CNG - ok
00:18:56.0318 0x094c  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
00:18:56.0328 0x094c  Compbatt - ok
00:18:56.0328 0x094c  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
00:18:56.0343 0x094c  CompositeBus - ok
00:18:56.0343 0x094c  COMSysApp - ok
00:18:56.0358 0x094c  [ AD4CCBA816E91937E10514B1099E8439, 0E0FECF5F0F07AD145730A1B92C35940B2C03846306A3D18156F75AA37E979C7 ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
00:18:56.0388 0x094c  cphs - ok
00:18:56.0393 0x094c  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
00:18:56.0398 0x094c  crcdisk - ok
00:18:56.0408 0x094c  [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc        C:\Windows\system32\cryptsvc.dll
00:18:56.0423 0x094c  CryptSvc - ok
00:18:56.0443 0x094c  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC            C:\Windows\system32\drivers\csc.sys
00:18:56.0468 0x094c  CSC - ok
00:18:56.0493 0x094c  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
00:18:56.0523 0x094c  CscService - ok
00:18:56.0548 0x094c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
00:18:56.0588 0x094c  DcomLaunch - ok
00:18:56.0598 0x094c  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc      C:\Windows\System32\defragsvc.dll
00:18:56.0633 0x094c  defragsvc - ok
00:18:56.0638 0x094c  [ F99467B497644C9F107876A510E8CB10, 66551E4A01106AFAC3BFB07D1E6E8CDB2AEEDB6A6BB0C7D9665AE287EC3A0A3C ] DellDigitalDelivery c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
00:18:56.0653 0x094c  DellDigitalDelivery - ok
00:18:56.0658 0x094c  [ CF1F6326AC44C42F4615D4BD53188AC5, 28DC32F1957918C3D5DE72415CC32A51C6885CAA38119FE475D2631269D3B9B3 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
00:18:56.0673 0x094c  DfsC - ok
00:18:56.0683 0x094c  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
00:18:56.0708 0x094c  Dhcp - ok
00:18:56.0713 0x094c  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
00:18:56.0738 0x094c  discache - ok
00:18:56.0743 0x094c  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\drivers\disk.sys
00:18:56.0753 0x094c  Disk - ok
00:18:56.0758 0x094c  [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc          C:\Windows\system32\drivers\dmvsc.sys
00:18:56.0768 0x094c  dmvsc - ok
00:18:56.0778 0x094c  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
00:18:56.0793 0x094c  Dnscache - ok
00:18:56.0803 0x094c  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc        C:\Windows\System32\dot3svc.dll
00:18:56.0833 0x094c  dot3svc - ok
00:18:56.0838 0x094c  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS            C:\Windows\system32\dps.dll
00:18:56.0868 0x094c  DPS - ok
00:18:56.0873 0x094c  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
00:18:56.0883 0x094c  drmkaud - ok
00:18:56.0908 0x094c  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
00:18:56.0928 0x094c  DXGKrnl - ok
00:18:56.0938 0x094c  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost        C:\Windows\System32\eapsvc.dll
00:18:56.0963 0x094c  EapHost - ok
00:18:57.0078 0x094c  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv          C:\Windows\system32\drivers\evbda.sys
00:18:57.0213 0x094c  ebdrv - ok
00:18:57.0223 0x094c  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] EFS            C:\Windows\System32\lsass.exe
00:18:57.0233 0x094c  EFS - ok
00:18:57.0268 0x094c  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
00:18:57.0313 0x094c  ehRecvr - ok
00:18:57.0318 0x094c  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched        C:\Windows\ehome\ehsched.exe
00:18:57.0333 0x094c  ehSched - ok
00:18:57.0378 0x094c  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
00:18:57.0403 0x094c  elxstor - ok
00:18:57.0408 0x094c  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
00:18:57.0418 0x094c  ErrDev - ok
00:18:57.0433 0x094c  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem    C:\Windows\system32\es.dll
00:18:57.0468 0x094c  EventSystem - ok
00:18:57.0478 0x094c  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat          C:\Windows\system32\drivers\exfat.sys
00:18:57.0508 0x094c  exfat - ok
00:18:57.0513 0x094c  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
00:18:57.0543 0x094c  fastfat - ok
00:18:57.0568 0x094c  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax            C:\Windows\system32\fxssvc.exe
00:18:57.0603 0x094c  Fax - ok
00:18:57.0608 0x094c  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc            C:\Windows\system32\drivers\fdc.sys
00:18:57.0623 0x094c  fdc - ok
00:18:57.0623 0x094c  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost        C:\Windows\system32\fdPHost.dll
00:18:57.0648 0x094c  fdPHost - ok
00:18:57.0653 0x094c  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
00:18:57.0678 0x094c  FDResPub - ok
00:18:57.0688 0x094c  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
00:18:57.0698 0x094c  FileInfo - ok
00:18:57.0703 0x094c  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
00:18:57.0728 0x094c  Filetrace - ok
00:18:57.0758 0x094c  [ 1A2AD78A77F989C0A2E4E526CAF99AB7, 03EC164D11DD4A20DE02BE2BE6406383CFC2F578A1A317C64E29E6EDFE6110A1 ] FlexNet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe
00:18:57.0833 0x094c  FlexNet Licensing Service - ok
00:18:57.0838 0x094c  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
00:18:57.0848 0x094c  flpydisk - ok
00:18:57.0863 0x094c  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
00:18:57.0878 0x094c  FltMgr - ok
00:18:57.0898 0x094c  [ D5A775990A7C202A037378FDBCDB6141, 27AD242914FAFB7A27B3045C0F0F6AFE6873FE331A51D8BB29A63B5D84C72EFB ] FontCache      C:\Windows\system32\FntCache.dll
00:18:57.0928 0x094c  FontCache - ok
00:18:57.0933 0x094c  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
00:18:57.0943 0x094c  FontCache3.0.0.0 - ok
00:18:57.0948 0x094c  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
00:18:57.0958 0x094c  FsDepends - ok
00:18:57.0958 0x094c  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
00:18:57.0968 0x094c  Fs_Rec - ok
00:18:57.0978 0x094c  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
00:18:57.0993 0x094c  fvevol - ok
00:18:57.0998 0x094c  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
00:18:58.0008 0x094c  gagp30kx - ok
00:18:58.0028 0x094c  [ FE91DC3D9A696CCDDB9F51C25ACBC53A, 4E1A7BB3AC57530A1DF8AB7E981087275E89E6AC629F881C98E40F13150ED532 ] gpsvc          C:\Windows\System32\gpsvc.dll
00:18:58.0063 0x094c  gpsvc - ok
00:18:58.0068 0x094c  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
00:18:58.0093 0x094c  gupdate - ok
00:18:58.0098 0x094c  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
00:18:58.0108 0x094c  gupdatem - ok
00:18:58.0113 0x094c  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
00:18:58.0123 0x094c  hcw85cir - ok
00:18:58.0128 0x094c  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
00:18:58.0143 0x094c  HDAudBus - ok
00:18:58.0148 0x094c  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
00:18:58.0158 0x094c  HidBatt - ok
00:18:58.0163 0x094c  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
00:18:58.0183 0x094c  HidBth - ok
00:18:58.0183 0x094c  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr          C:\Windows\system32\drivers\hidir.sys
00:18:58.0198 0x094c  HidIr - ok
00:18:58.0203 0x094c  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv        C:\Windows\system32\hidserv.dll
00:18:58.0228 0x094c  hidserv - ok
00:18:58.0233 0x094c  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
00:18:58.0243 0x094c  HidUsb - ok
00:18:58.0253 0x094c  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
00:18:58.0278 0x094c  hkmsvc - ok
00:18:58.0288 0x094c  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
00:18:58.0308 0x094c  HomeGroupListener - ok
00:18:58.0318 0x094c  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
00:18:58.0333 0x094c  HomeGroupProvider - ok
00:18:58.0338 0x094c  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
00:18:58.0348 0x094c  HpSAMD - ok
00:18:58.0368 0x094c  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
00:18:58.0393 0x094c  HTTP - ok
00:18:58.0398 0x094c  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
00:18:58.0403 0x094c  hwpolicy - ok
00:18:58.0408 0x094c  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
00:18:58.0423 0x094c  i8042prt - ok
00:18:58.0438 0x094c  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
00:18:58.0458 0x094c  iaStorV - ok
00:18:58.0513 0x094c  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
00:18:58.0578 0x094c  idsvc - ok
00:18:58.0733 0x094c  [ A3F8BC3E8CA239AC9855C3FA6BD0A353, F0EC8F32EB600C82B0D6F35B4CA6ABAE91D74516F2F086A0BC7F786D704EA62C ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
00:18:58.0888 0x094c  igfx - ok
00:18:58.0898 0x094c  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
00:18:58.0908 0x094c  iirsp - ok
00:18:58.0938 0x094c  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
00:18:58.0978 0x094c  IKEEXT - ok
00:18:59.0073 0x094c  [ 88E5F9D5E8EAD9EA6E271E26B42516A9, 6665CF836ED9490B5C9B501B892C1B82604BCC02ECA98FE156B0D851C1725E9F ] IntcAzAudAddService C:\Windows\system32\drivers\RTDVHD64.sys
00:18:59.0133 0x094c  IntcAzAudAddService - ok
00:18:59.0153 0x094c  [ EEE7376243CD8A4B49B885EF122D25E5, A3B89E7B513C95558C4DA41D3C136D464381263BA43E00EC136FC776DAA0BA94 ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
00:18:59.0183 0x094c  IntcDAud - ok
00:18:59.0223 0x094c  [ 0DB1E3F6189C628675F855C0EB510419, 989F539E82105019D2D81255369B96DC65826CD2A421DA09809155B26F69C555 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
00:18:59.0263 0x094c  Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 )
00:19:01.0693 0x094c  Detect skipped due to KSN trusted
00:19:01.0693 0x094c  Intel(R) Capability Licensing Service Interface - ok
00:19:01.0728 0x094c  [ 492AAF2FF66F437F0E796574B116EFC3, 6BF21C61ED05705DD58203952A750D1AB4D4B62F3A2B640BBBD9B85D1ECC3E5C ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
00:19:01.0768 0x094c  Intel(R) Capability Licensing Service TCP IP Interface - ok
00:19:01.0773 0x094c  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
00:19:01.0783 0x094c  intelide - ok
00:19:01.0788 0x094c  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
00:19:01.0798 0x094c  intelppm - ok
00:19:01.0798 0x094c  [ FD625A432D994748291CBC5ECE307248, 307B87E3E905152A0BE7AE680D451056D3C61646A3969335997439044BE8FCDF ] InvProtectDrv  C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrv64.sys
00:19:01.0818 0x094c  InvProtectDrv - ok
00:19:01.0823 0x094c  [ 521A195AF2B6556038BCCDF75FB675EB, 279AC311EA450F1C9A8CA589F582F3FB4FD9090DAD26318CB6928BC90301BE56 ] InvProtectDrvNet C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrvNet64.sys
00:19:01.0838 0x094c  InvProtectDrvNet - ok
00:19:01.0888 0x094c  [ 7DD5DA79AEC4915F02FE5428CF92CA93, C376E331177D545A4A2A6BE66E5363F4A3699D660F11D2A86A420775695FB823 ] InvProtectSvc  C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe
00:19:01.0993 0x094c  InvProtectSvc - ok
00:19:02.0008 0x094c  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
00:19:02.0033 0x094c  IPBusEnum - ok
00:19:02.0038 0x094c  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
00:19:02.0063 0x094c  IpFilterDriver - ok
00:19:02.0083 0x094c  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
00:19:02.0108 0x094c  iphlpsvc - ok
00:19:02.0113 0x094c  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
00:19:02.0128 0x094c  IPMIDRV - ok
00:19:02.0133 0x094c  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
00:19:02.0163 0x094c  IPNAT - ok
00:19:02.0163 0x094c  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
00:19:02.0178 0x094c  IRENUM - ok
00:19:02.0183 0x094c  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
00:19:02.0193 0x094c  isapnp - ok
00:19:02.0203 0x094c  [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
00:19:02.0218 0x094c  iScsiPrt - ok
00:19:02.0223 0x094c  [ 78D369F8A81A341109FBA1DB64B4C512, E584F693255CCBF7006E7D35984149CF599BB0849A8F02EFDD6223DF0D606049 ] iusb3hcs        C:\Windows\system32\DRIVERS\iusb3hcs.sys
00:19:02.0238 0x094c  iusb3hcs - ok
00:19:02.0253 0x094c  [ 5B632ABA038CE2E2D5D2D1115C6B26D1, 605A8FFA704E4369CF9D17DF8630DC9E196B8920D47F1CC5151759E60B234C1F ] iusb3hub        C:\Windows\system32\DRIVERS\iusb3hub.sys
00:19:02.0283 0x094c  iusb3hub - ok
00:19:02.0308 0x094c  [ EA841584EF59528D11F20355770E427E, 515737761BB2A0A233F4AD141E28D93E3B9789320A15B7D5FB3DB5AC3CD8E249 ] iusb3xhc        C:\Windows\system32\DRIVERS\iusb3xhc.sys
00:19:02.0343 0x094c  iusb3xhc - ok
00:19:02.0353 0x094c  [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
00:19:02.0363 0x094c  jhi_service - ok
00:19:02.0368 0x094c  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
00:19:02.0373 0x094c  kbdclass - ok
00:19:02.0378 0x094c  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
00:19:02.0393 0x094c  kbdhid - ok
00:19:02.0393 0x094c  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] KeyIso          C:\Windows\system32\lsass.exe
00:19:02.0408 0x094c  KeyIso - ok
00:19:02.0413 0x094c  [ 67A1743377EBB5D9A370A8C2086CFDCC, 2F0FD6C1969B1EEEEFFC1A8F972E1E90F1AD9558FF00EC159BC19ED927FD4BF5 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
00:19:02.0423 0x094c  KSecDD - ok
00:19:02.0428 0x094c  [ 522A1595D5701800DD41B2D472F5AAED, B62924AE94A5AC454AD6057BC133D717BB1C6445BE36D6BECAB76E1600F60C33 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
00:19:02.0438 0x094c  KSecPkg - ok
00:19:02.0438 0x094c  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
00:19:02.0463 0x094c  ksthunk - ok
00:19:02.0478 0x094c  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm          C:\Windows\system32\msdtckrm.dll
00:19:02.0513 0x094c  KtmRm - ok
00:19:02.0523 0x094c  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
00:19:02.0553 0x094c  LanmanServer - ok
00:19:02.0563 0x094c  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
00:19:02.0598 0x094c  LanmanWorkstation - ok
00:19:02.0603 0x094c  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
00:19:02.0628 0x094c  lltdio - ok
00:19:02.0643 0x094c  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
00:19:02.0673 0x094c  lltdsvc - ok
00:19:02.0678 0x094c  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts        C:\Windows\System32\lmhsvc.dll
00:19:02.0703 0x094c  lmhosts - ok
00:19:02.0718 0x094c  [ C8AE2216F31AB6A6CED3B4BEB377BF1D, 6DA89AB9060E24A2643019869DF8EF69D172AD3D066D9038614F7214216E51C4 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
00:19:02.0728 0x094c  LMS - ok
00:19:02.0738 0x094c  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
00:19:02.0748 0x094c  LSI_FC - ok
00:19:02.0753 0x094c  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
00:19:02.0763 0x094c  LSI_SAS - ok
00:19:02.0768 0x094c  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
00:19:02.0783 0x094c  LSI_SAS2 - ok
00:19:02.0788 0x094c  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
00:19:02.0798 0x094c  LSI_SCSI - ok
00:19:02.0803 0x094c  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv          C:\Windows\system32\drivers\luafv.sys
00:19:02.0833 0x094c  luafv - ok
00:19:02.0838 0x094c  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
00:19:02.0848 0x094c  Mcx2Svc - ok
00:19:02.0853 0x094c  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas        C:\Windows\system32\drivers\megasas.sys
00:19:02.0863 0x094c  megasas - ok
00:19:02.0873 0x094c  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
00:19:02.0888 0x094c  MegaSR - ok
00:19:02.0893 0x094c  [ 18B9AD128EC84E8D16A83F70CF36594F, 199DF15D68E2A079794E5DD325162C1A68A65EF26EEF5A6C6154281DDE57279A ] MEIx64          C:\Windows\system32\DRIVERS\TeeDriverx64.sys
00:19:02.0913 0x094c  MEIx64 - ok
00:19:02.0918 0x094c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS          C:\Windows\system32\mmcss.dll
00:19:02.0948 0x094c  MMCSS - ok
00:19:02.0953 0x094c  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem          C:\Windows\system32\drivers\modem.sys
00:19:02.0978 0x094c  Modem - ok
00:19:02.0983 0x094c  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
00:19:03.0003 0x094c  monitor - ok
00:19:03.0008 0x094c  [ 95314C3A08589471983C2C8173F23CDA, 05D30728D7204ABA2437259ECF929A94E6573F7621BAF35D76EBA26F5489A6CF ] MonitorFunction C:\Windows\system32\DRIVERS\TVMonitor.sys
00:19:03.0023 0x094c  MonitorFunction - ok
00:19:03.0028 0x094c  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
00:19:03.0038 0x094c  mouclass - ok
00:19:03.0043 0x094c  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
00:19:03.0053 0x094c  mouhid - ok
00:19:03.0058 0x094c  [ 67050452C0118BAF2883928E6FCCFE47, 335FC0AEB7B47DCC7CE0CF3F424EB60ACB1327D2FF6515F04D9AC03A10FF1E31 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
00:19:03.0068 0x094c  mountmgr - ok
00:19:03.0073 0x094c  [ 26EA1DAD601EE3ACAC301D66F07BA219, C9594BB15D53D4AC2156CCCD2DB65B2C20620F1F60DA85F48D1586FC10028096 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
00:19:03.0103 0x094c  MozillaMaintenance - ok
00:19:03.0108 0x094c  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
00:19:03.0123 0x094c  mpio - ok
00:19:03.0128 0x094c  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
00:19:03.0153 0x094c  mpsdrv - ok
00:19:03.0183 0x094c  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
00:19:03.0233 0x094c  MpsSvc - ok
00:19:03.0238 0x094c  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
00:19:03.0253 0x094c  MRxDAV - ok
00:19:03.0258 0x094c  [ B2081803D510DCE174992BA880EDCA70, 37DB53C9756EC03EB7165DEB58251615D70B7C86DF32A54DE25ADAF30A04D792 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
00:19:03.0268 0x094c  mrxsmb - ok
00:19:03.0278 0x094c  [ 552FA62B0EFECD22D8D52499324BCA4F, C3A02C9C30C36928AC7B1025496544967187A05BEF5D100B54F2C0155E47145C ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
00:19:03.0293 0x094c  mrxsmb10 - ok
00:19:03.0298 0x094c  [ 97687971F9CB30E2633DE0F1296B9F61, 865DA87523E4C32D65D55D5475A5CDDFA10699780DA500E6D606384FB3BEB1BE ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
00:19:03.0308 0x094c  mrxsmb20 - ok
00:19:03.0313 0x094c  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
00:19:03.0323 0x094c  msahci - ok
00:19:03.0328 0x094c  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
00:19:03.0338 0x094c  msdsm - ok
00:19:03.0348 0x094c  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC          C:\Windows\System32\msdtc.exe
00:19:03.0368 0x094c  MSDTC - ok
00:19:03.0373 0x094c  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
00:19:03.0398 0x094c  Msfs - ok
00:19:03.0398 0x094c  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
00:19:03.0423 0x094c  mshidkmdf - ok
00:19:03.0428 0x094c  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
00:19:03.0438 0x094c  msisadrv - ok
00:19:03.0443 0x094c  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
00:19:03.0468 0x094c  MSiSCSI - ok
00:19:03.0468 0x094c  msiserver - ok
00:19:03.0473 0x094c  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
00:19:03.0498 0x094c  MSKSSRV - ok
00:19:03.0498 0x094c  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
00:19:03.0523 0x094c  MSPCLOCK - ok
00:19:03.0528 0x094c  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
00:19:03.0548 0x094c  MSPQM - ok
00:19:03.0568 0x094c  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
00:19:03.0588 0x094c  MsRPC - ok
00:19:03.0593 0x094c  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
00:19:03.0598 0x094c  mssmbios - ok
00:19:03.0603 0x094c  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
00:19:03.0623 0x094c  MSTEE - ok
00:19:03.0628 0x094c  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
00:19:03.0638 0x094c  MTConfig - ok
00:19:03.0643 0x094c  [ AA0C2BA3782E92BD85E2264BE418E67C, 8B0953926E83274DF16670F1EF6F4E302F7EE17418F486975C353A406850298C ] Mup            C:\Windows\system32\Drivers\mup.sys
00:19:03.0653 0x094c  Mup - ok
00:19:03.0673 0x094c  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
00:19:03.0713 0x094c  napagent - ok
00:19:03.0723 0x094c  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
00:19:03.0743 0x094c  NativeWifiP - ok
00:19:03.0773 0x094c  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
00:19:03.0813 0x094c  NDIS - ok
00:19:03.0813 0x094c  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
00:19:03.0843 0x094c  NdisCap - ok
00:19:03.0843 0x094c  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
00:19:03.0868 0x094c  NdisTapi - ok
00:19:03.0873 0x094c  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
00:19:03.0898 0x094c  Ndisuio - ok
00:19:03.0903 0x094c  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
00:19:03.0928 0x094c  NdisWan - ok
00:19:03.0933 0x094c  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
00:19:03.0963 0x094c  NDProxy - ok
00:19:03.0968 0x094c  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
00:19:03.0993 0x094c  NetBIOS - ok
00:19:04.0003 0x094c  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
00:19:04.0033 0x094c  NetBT - ok
00:19:04.0033 0x094c  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] Netlogon        C:\Windows\system32\lsass.exe
00:19:04.0048 0x094c  Netlogon - ok
00:19:04.0058 0x094c  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
00:19:04.0098 0x094c  Netman - ok
00:19:04.0108 0x094c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:19:04.0123 0x094c  NetMsmqActivator - ok
00:19:04.0133 0x094c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:19:04.0143 0x094c  NetPipeActivator - ok
00:19:04.0158 0x094c  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
00:19:04.0198 0x094c  netprofm - ok
00:19:04.0208 0x094c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:19:04.0218 0x094c  NetTcpActivator - ok
00:19:04.0228 0x094c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
00:19:04.0238 0x094c  NetTcpPortSharing - ok
00:19:04.0248 0x094c  [ 73CE12B8BDD747B0063CB0A7EF44CEA7, F570BB52BE460DBA6203698CC96FFD9674E1903D0E0F5C49375BE3F8D8E89582 ] netvsc          C:\Windows\system32\DRIVERS\netvsc60.sys
00:19:04.0263 0x094c  netvsc - ok
00:19:04.0268 0x094c  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
00:19:04.0278 0x094c  nfrd960 - ok
00:19:04.0283 0x094c  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
00:19:04.0298 0x094c  NlaSvc - ok
00:19:04.0303 0x094c  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
00:19:04.0328 0x094c  Npfs - ok
00:19:04.0333 0x094c  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi            C:\Windows\system32\nsisvc.dll
00:19:04.0358 0x094c  nsi - ok
00:19:04.0363 0x094c  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
00:19:04.0383 0x094c  nsiproxy - ok
00:19:04.0463 0x094c  [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
00:19:04.0538 0x094c  Ntfs - ok
00:19:04.0543 0x094c  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
00:19:04.0568 0x094c  Null - ok
00:19:04.0578 0x094c  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
00:19:04.0593 0x094c  nvraid - ok
00:19:04.0598 0x094c  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
00:19:04.0613 0x094c  nvstor - ok
00:19:04.0618 0x094c  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
00:19:04.0633 0x094c  nv_agp - ok
00:19:04.0638 0x094c  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
00:19:04.0648 0x094c  ohci1394 - ok
00:19:04.0653 0x094c  [ 30B5F9FB0C35AE6B4A0851D24CE2EE8B, 0340E77E8EC2ADC21B8DDD9C9CC95B3F4BCAFD54618A333C72D7D9587D593B83 ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
00:19:04.0683 0x094c  ose - ok
00:19:04.0753 0x094c  [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
00:19:04.0848 0x094c  osppsvc - ok
00:19:04.0863 0x094c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
00:19:04.0888 0x094c  p2pimsvc - ok
00:19:04.0903 0x094c  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
00:19:04.0928 0x094c  p2psvc - ok
00:19:04.0938 0x094c  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport        C:\Windows\system32\drivers\parport.sys
00:19:04.0953 0x094c  Parport - ok
00:19:04.0958 0x094c  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
00:19:04.0968 0x094c  partmgr - ok
00:19:04.0973 0x094c  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll
00:19:04.0988 0x094c  PcaSvc - ok
00:19:04.0998 0x094c  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci            C:\Windows\system32\drivers\pci.sys
00:19:05.0013 0x094c  pci - ok
00:19:05.0018 0x094c  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
00:19:05.0028 0x094c  pciide - ok
00:19:05.0033 0x094c  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
00:19:05.0048 0x094c  pcmcia - ok
00:19:05.0053 0x094c  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw            C:\Windows\system32\drivers\pcw.sys
00:19:05.0058 0x094c  pcw - ok
00:19:05.0128 0x094c  [ D0AD1271494EB9E065E902D1013BC369, 0E4DB28B5C348DF44BADC64FB8BCDA563D0515A75F0F14FD076BC39AF19BD65F ] PDF Architect 2 C:\Program Files (x86)\PDF Architect 2\ws.exe
00:19:05.0223 0x094c  PDF Architect 2 - ok
00:19:05.0258 0x094c  [ 89436BB836F6737F19EB2B78250E414E, 9140F42CACDDC0979B90553D43A1FA1296DD829E6235D272F9DF3670613445CF ] pdfforge CrashHandler C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe
00:19:05.0313 0x094c  pdfforge CrashHandler - ok
00:19:05.0333 0x094c  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
00:19:05.0358 0x094c  PEAUTH - ok
00:19:05.0423 0x094c  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
00:19:05.0513 0x094c  PeerDistSvc - ok
00:19:05.0528 0x094c  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
00:19:05.0548 0x094c  PerfHost - ok
00:19:05.0598 0x094c  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla            C:\Windows\system32\pla.dll
00:19:05.0708 0x094c  pla - ok
00:19:05.0723 0x094c  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
00:19:05.0748 0x094c  PlugPlay - ok
00:19:05.0753 0x094c  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
00:19:05.0763 0x094c  PNRPAutoReg - ok
00:19:05.0773 0x094c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
00:19:05.0788 0x094c  PNRPsvc - ok
00:19:05.0803 0x094c  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
00:19:05.0838 0x094c  PolicyAgent - ok
00:19:05.0853 0x094c  [ A2CCA4FB273E6050F17A0A416CFF2FCD, C42BA18DF0C8E3F7358669A784E51E4DC7A4112096345EA699EDC95F561E0255 ] Power          C:\Windows\system32\umpo.dll
00:19:05.0873 0x094c  Power - ok
00:19:05.0878 0x094c  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
00:19:05.0903 0x094c  PptpMiniport - ok
00:19:05.0908 0x094c  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor      C:\Windows\system32\drivers\processr.sys
00:19:05.0923 0x094c  Processor - ok
00:19:05.0928 0x094c  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc        C:\Windows\system32\profsvc.dll
00:19:05.0943 0x094c  ProfSvc - ok
00:19:05.0948 0x094c  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] ProtectedStorage C:\Windows\system32\lsass.exe
00:19:05.0958 0x094c  ProtectedStorage - ok
00:19:05.0963 0x094c  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
00:19:05.0993 0x094c  Psched - ok
00:19:06.0028 0x094c  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
00:19:06.0078 0x094c  ql2300 - ok
00:19:06.0083 0x094c  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
00:19:06.0098 0x094c  ql40xx - ok
00:19:06.0103 0x094c  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE          C:\Windows\system32\qwave.dll
00:19:06.0123 0x094c  QWAVE - ok
00:19:06.0128 0x094c  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
00:19:06.0143 0x094c  QWAVEdrv - ok
00:19:06.0148 0x094c  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
00:19:06.0173 0x094c  RasAcd - ok
00:19:06.0178 0x094c  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
00:19:06.0203 0x094c  RasAgileVpn - ok
00:19:06.0208 0x094c  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto        C:\Windows\System32\rasauto.dll
00:19:06.0238 0x094c  RasAuto - ok
00:19:06.0243 0x094c  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
00:19:06.0268 0x094c  Rasl2tp - ok
00:19:06.0283 0x094c  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
00:19:06.0318 0x094c  RasMan - ok
00:19:06.0323 0x094c  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
00:19:06.0353 0x094c  RasPppoe - ok
00:19:06.0353 0x094c  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
00:19:06.0383 0x094c  RasSstp - ok
00:19:06.0393 0x094c  [ 71B6F78D6444CCE6F77BC42917A4E8F7, 34927A2C1CA349D251A327ED1F30018B065A8E6B886D9B5080A8AE2F6A8C0914 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
00:19:06.0413 0x094c  rdbss - ok
00:19:06.0418 0x094c  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
00:19:06.0433 0x094c  rdpbus - ok
00:19:06.0433 0x094c  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
00:19:06.0458 0x094c  RDPCDD - ok
00:19:06.0463 0x094c  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
00:19:06.0483 0x094c  RDPDR - ok
00:19:06.0483 0x094c  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
00:19:06.0508 0x094c  RDPENCDD - ok
00:19:06.0513 0x094c  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
00:19:06.0533 0x094c  RDPREFMP - ok
00:19:06.0543 0x094c  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
00:19:06.0558 0x094c  RDPWD - ok
00:19:06.0568 0x094c  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
00:19:06.0578 0x094c  rdyboost - ok
00:19:06.0588 0x094c  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
00:19:06.0613 0x094c  RemoteAccess - ok
00:19:06.0623 0x094c  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
00:19:06.0653 0x094c  RemoteRegistry - ok
00:19:06.0658 0x094c  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
00:19:06.0683 0x094c  RpcEptMapper - ok
00:19:06.0688 0x094c  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
00:19:06.0698 0x094c  RpcLocator - ok
00:19:06.0718 0x094c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs          C:\Windows\system32\rpcss.dll
00:19:06.0748 0x094c  RpcSs - ok
00:19:06.0753 0x094c  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
00:19:06.0783 0x094c  rspndr - ok
00:19:06.0818 0x094c  [ 22B27E5BFBAB2B5ED3BB5ABBE7D1E341, D56D3BA061FB7DB1414CB14537E9FE17907095C050FC674FFC38C8D8CA5B426B ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
00:19:06.0853 0x094c  RTL8167 - ok
00:19:06.0858 0x094c  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
00:19:06.0868 0x094c  s3cap - ok
00:19:06.0873 0x094c  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] SamSs          C:\Windows\system32\lsass.exe
00:19:06.0883 0x094c  SamSs - ok
00:19:06.0888 0x094c  [ 4064CD7F3C8B1D89B67B10042D22EEB1, 3167B006888A004A135B0643A4C966063B6A0C950C4EB48D3BD7FECEEC2FA3FF ] SboxDrv        C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxDrv.sys
00:19:06.0908 0x094c  SboxDrv - ok
00:19:06.0913 0x094c  [ E0462DE7DD39E8B16D74C7870DAD9E36, 824BBAF18255BD3D17F310C805D95D869106507F91B43010955AD065C96DAA44 ] SboxSvc        C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
00:19:06.0933 0x094c  SboxSvc - ok
00:19:06.0943 0x094c  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
00:19:06.0953 0x094c  sbp2port - ok
00:19:06.0958 0x094c  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
00:19:06.0993 0x094c  SCardSvr - ok
00:19:06.0998 0x094c  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
00:19:07.0023 0x094c  scfilter - ok
00:19:07.0038 0x094c  [ 40686B59C127F0C93B4234E4A1E3472A, B2DD61CB796C6AA8AFD285D43472B94646CA6D331D282818E0FDC9DE28DDE9CF ] Schedule        C:\Windows\system32\schedsvc.dll
00:19:07.0068 0x094c  Schedule - ok
00:19:07.0073 0x094c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc    C:\Windows\System32\certprop.dll
00:19:07.0098 0x094c  SCPolicySvc - ok
00:19:07.0103 0x094c  [ 111E0EBC0AD79CB0FA014B907B231CF0, B7D43D156C2524938503CF8E99C4D1F7A5C55E16C0368F57F4CD23C6D833B38F ] sdbus          C:\Windows\system32\drivers\sdbus.sys
00:19:07.0118 0x094c  sdbus - ok
00:19:07.0128 0x094c  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
00:19:07.0143 0x094c  SDRSVC - ok
00:19:07.0148 0x094c  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
00:19:07.0163 0x094c  secdrv - ok
00:19:07.0163 0x094c  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
00:19:07.0193 0x094c  seclogon - ok
00:19:07.0198 0x094c  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
00:19:07.0223 0x094c  SENS - ok
00:19:07.0228 0x094c  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
00:19:07.0238 0x094c  SensrSvc - ok
00:19:07.0243 0x094c  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum        C:\Windows\system32\drivers\serenum.sys
00:19:07.0253 0x094c  Serenum - ok
00:19:07.0263 0x094c  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\drivers\serial.sys
00:19:07.0278 0x094c  Serial - ok
00:19:07.0283 0x094c  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
00:19:07.0293 0x094c  sermouse - ok
00:19:07.0303 0x094c  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
00:19:07.0333 0x094c  SessionEnv - ok
00:19:07.0333 0x094c  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
00:19:07.0348 0x094c  sffdisk - ok
00:19:07.0348 0x094c  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
00:19:07.0363 0x094c  sffp_mmc - ok
00:19:07.0368 0x094c  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
00:19:07.0378 0x094c  sffp_sd - ok
00:19:07.0383 0x094c  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
00:19:07.0398 0x094c  sfloppy - ok
00:19:07.0408 0x094c  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
00:19:07.0448 0x094c  SharedAccess - ok
00:19:07.0458 0x094c  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
00:19:07.0488 0x094c  ShellHWDetection - ok
00:19:07.0493 0x094c  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
00:19:07.0503 0x094c  SiSRaid2 - ok
00:19:07.0508 0x094c  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
00:19:07.0518 0x094c  SiSRaid4 - ok
00:19:07.0523 0x094c  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
00:19:07.0553 0x094c  Smb - ok
00:19:07.0558 0x094c  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
00:19:07.0568 0x094c  SNMPTRAP - ok
00:19:07.0573 0x094c  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr          C:\Windows\system32\drivers\spldr.sys
00:19:07.0578 0x094c  spldr - ok
00:19:07.0623 0x094c  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler        C:\Windows\System32\spoolsv.exe
00:19:07.0653 0x094c  Spooler - ok
00:19:07.0783 0x094c  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
00:19:07.0858 0x094c  sppsvc - ok
00:19:07.0868 0x094c  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
00:19:07.0893 0x094c  sppuinotify - ok
00:19:07.0913 0x094c  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv            C:\Windows\system32\DRIVERS\srv.sys
00:19:07.0938 0x094c  srv - ok
00:19:07.0953 0x094c  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
00:19:07.0973 0x094c  srv2 - ok
00:19:07.0978 0x094c  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
00:19:07.0993 0x094c  srvnet - ok
00:19:08.0003 0x094c  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
00:19:08.0033 0x094c  SSDPSRV - ok
00:19:08.0038 0x094c  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc        C:\Windows\system32\sstpsvc.dll
00:19:08.0063 0x094c  SstpSvc - ok
00:19:08.0068 0x094c  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
00:19:08.0078 0x094c  stexstor - ok
00:19:08.0098 0x094c  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
00:19:08.0133 0x094c  stisvc - ok
00:19:08.0138 0x094c  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc        C:\Windows\system32\storsvc.dll
00:19:08.0148 0x094c  StorSvc - ok
00:19:08.0153 0x094c  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc        C:\Windows\system32\drivers\storvsc.sys
00:19:08.0163 0x094c  storvsc - ok
00:19:08.0163 0x094c  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
00:19:08.0173 0x094c  swenum - ok
00:19:08.0188 0x094c  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv          C:\Windows\System32\swprv.dll
00:19:08.0233 0x094c  swprv - ok
00:19:08.0233 0x094c  [ 4CDD7DF58730D23BA9CB5829A6E2ECEA, 89A2A1604C2BF985894000F51D9D376B32F1327197866850B5BF8640272DE828 ] SynthVid        C:\Windows\system32\DRIVERS\VMBusVideoM.sys
00:19:08.0248 0x094c  SynthVid - ok
00:19:08.0278 0x094c  [ 2E730941CC5BF6200A4F56D1E9C24AAD, 758836D55DC84F3EBE9917DC6FAB8E6170A5B238FEDBCFDB6D7C5C6EA98E08B2 ] SysMain        C:\Windows\system32\sysmain.dll
00:19:08.0318 0x094c  SysMain - ok
00:19:08.0323 0x094c  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
00:19:08.0338 0x094c  TabletInputService - ok
00:19:08.0348 0x094c  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv        C:\Windows\System32\tapisrv.dll
00:19:08.0383 0x094c  TapiSrv - ok
00:19:08.0388 0x094c  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS            C:\Windows\System32\tbssvc.dll
00:19:08.0413 0x094c  TBS - ok
00:19:08.0513 0x094c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
00:19:08.0618 0x094c  Tcpip - ok
00:19:08.0723 0x094c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
00:19:08.0758 0x094c  TCPIP6 - ok
00:19:08.0768 0x094c  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
00:19:08.0778 0x094c  tcpipreg - ok
00:19:08.0783 0x094c  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
00:19:08.0793 0x094c  TDPIPE - ok
00:19:08.0793 0x094c  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
00:19:08.0808 0x094c  TDTCP - ok
00:19:08.0813 0x094c  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
00:19:08.0843 0x094c  tdx - ok
00:19:09.0073 0x094c  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
00:19:09.0083 0x094c  TermDD - ok
00:19:09.0108 0x094c  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService    C:\Windows\System32\termsrv.dll
00:19:09.0143 0x094c  TermService - ok
00:19:09.0148 0x094c  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
00:19:09.0163 0x094c  Themes - ok
00:19:09.0168 0x094c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER    C:\Windows\system32\mmcss.dll
00:19:09.0193 0x094c  THREADORDER - ok
00:19:09.0198 0x094c  [ BA4030F56AACECD0E6D413565B4AED75, A9B0A672F9EAF5D23A200CE1D5249A30DBF8C9529BA82139D2B52B0C83521F30 ] tmactmon        C:\Windows\system32\DRIVERS\tmactmon.sys
00:19:09.0208 0x094c  tmactmon - ok
00:19:09.0213 0x094c  [ ED866799CA62626341632DA9EDECFD04, 079FCEA16F887943F873955805BAB078CE014D13839BAD4B732D8D7F9F7AF828 ] tmcomm          C:\Windows\system32\DRIVERS\tmcomm.sys
00:19:09.0223 0x094c  tmcomm - ok
00:19:09.0228 0x094c  [ 84FB4B5C8DCD78163C440431FEF3E096, 9D564EC35426E05A4159988C2688CB52221617B36491BB3152AC334336A45AA2 ] tmevtmgr        C:\Windows\system32\DRIVERS\tmevtmgr.sys
00:19:09.0233 0x094c  tmevtmgr - ok
00:19:09.0278 0x094c  TmListen - ok
00:19:09.0283 0x094c  [ 77B9BEBB0769F45EF770297196EF3506, 29B6DC561B5E1DE9072300A6B94A0B78336161F043DB53DC87C4B0AAA555EF7B ] tmtdi          C:\Windows\system32\DRIVERS\tmtdi.sys
00:19:09.0293 0x094c  tmtdi - ok
00:19:09.0298 0x094c  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
00:19:09.0327 0x094c  TrkWks - ok
00:19:09.0332 0x094c  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
00:19:09.0357 0x094c  TrustedInstaller - ok
00:19:09.0362 0x094c  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
00:19:09.0372 0x094c  tssecsrv - ok
00:19:09.0377 0x094c  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
00:19:09.0392 0x094c  TsUsbFlt - ok
00:19:09.0397 0x094c  [ 9CC2CCAE8A84820EAECB886D477CBCB8, 50D8AA2D7477A6618A0C31BB4D1C4887B457865FB1105E2E7B984EEFA337B804 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
00:19:09.0407 0x094c  TsUsbGD - ok
00:19:09.0412 0x094c  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
00:19:09.0442 0x094c  tunnel - ok
00:19:09.0447 0x094c  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
00:19:09.0457 0x094c  uagp35 - ok
00:19:09.0467 0x094c  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
00:19:09.0502 0x094c  udfs - ok
00:19:09.0507 0x094c  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect      C:\Windows\system32\UI0Detect.exe
00:19:09.0522 0x094c  UI0Detect - ok
00:19:09.0527 0x094c  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
00:19:09.0537 0x094c  uliagpkx - ok
00:19:09.0542 0x094c  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
00:19:09.0557 0x094c  umbus - ok
00:19:09.0557 0x094c  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
00:19:09.0567 0x094c  UmPass - ok
00:19:09.0577 0x094c  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
00:19:09.0597 0x094c  UmRdpService - ok
00:19:09.0612 0x094c  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
00:19:09.0652 0x094c  upnphost - ok
00:19:09.0662 0x094c  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
00:19:09.0677 0x094c  usbaudio - ok
00:19:09.0682 0x094c  [ 91D3C92A44FC682DD791147604E79152, AA0B6799BF9C26C2C1793C91295288A4989AA43EC5E070B650DA7F0A142817CE ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
00:19:09.0697 0x094c  usbccgp - ok
00:19:09.0702 0x094c  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
00:19:09.0717 0x094c  usbcir - ok
00:19:09.0722 0x094c  [ F7FFDF2A1D19A76A87759126B244C816, C91F09D77E22D976952A46F7B93F611B719EDAF694D538242FA8FAF1BA9BB2F0 ] usbehci        C:\Windows\system32\drivers\usbehci.sys
00:19:09.0732 0x094c  usbehci - ok
00:19:09.0747 0x094c  [ 245FE7FC634D6A993E682E0A9EBA4ABB, F7A536D215EE3A63358EC8B5946D7BB3B56357BF91347B07013E00DAC98775B6 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
00:19:09.0772 0x094c  usbhub - ok
00:19:09.0777 0x094c  [ F4A4255E930B6D007A3501C35A3DACC4, E0D0EF801100BE57A199A483330A80FB6C6FF29AEBF3380BEE16BB364A8D7FC7 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
00:19:09.0792 0x094c  usbohci - detected UnsignedFile.Multi.Generic ( 1 )
00:19:12.0142 0x094c  Detect skipped due to KSN trusted
00:19:12.0142 0x094c  usbohci - ok
00:19:12.0147 0x094c  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\drivers\usbprint.sys
00:19:12.0172 0x094c  usbprint - ok
00:19:12.0177 0x094c  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
00:19:12.0197 0x094c  USBSTOR - ok
00:19:12.0197 0x094c  [ 9462E6B70615C1703D4A95FA61FC54A1, A66E75A42E58E126F575F1AFC3BE47E119CF53431CED511776D878A78F597015 ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
00:19:12.0217 0x094c  usbuhci - detected UnsignedFile.Multi.Generic ( 1 )
00:19:14.0577 0x094c  Detect skipped due to KSN trusted
00:19:14.0577 0x094c  usbuhci - ok
00:19:14.0587 0x094c  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms          C:\Windows\System32\uxsms.dll
00:19:14.0642 0x094c  UxSms - ok
00:19:14.0642 0x094c  [ 0D48E93C6BE3143C0198CB252B992D16, AF34A41BAAE967045C8078E80B070E66ED60FDA0945FA752F715E49FD43373A4 ] VaultSvc        C:\Windows\system32\lsass.exe
00:19:14.0652 0x094c  VaultSvc - ok
00:19:14.0657 0x094c  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
00:19:14.0667 0x094c  vdrvroot - ok
00:19:14.0682 0x094c  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds            C:\Windows\System32\vds.exe
00:19:14.0722 0x094c  vds - ok
00:19:14.0727 0x094c  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
00:19:14.0737 0x094c  vga - ok
00:19:14.0742 0x094c  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave        C:\Windows\System32\drivers\vga.sys
00:19:14.0767 0x094c  VgaSave - ok
00:19:14.0772 0x094c  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
00:19:14.0787 0x094c  vhdmp - ok
00:19:14.0792 0x094c  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
00:19:14.0797 0x094c  viaide - ok
00:19:14.0802 0x094c  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
00:19:14.0812 0x094c  VMBusHID - ok
00:19:14.0817 0x094c  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
00:19:14.0827 0x094c  volmgr - ok
00:19:14.0842 0x094c  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
00:19:14.0857 0x094c  volmgrx - ok
00:19:14.0872 0x094c  [ DF8126BD41180351A093A3AD2FC8903B, AEFF4AA89CDDAAAD43CDE17C6B6EB2A397A0AC1651CBD51B889161EC2BC6527A ] volsnap        C:\Windows\system32\drivers\volsnap.sys
00:19:14.0887 0x094c  volsnap - ok
00:19:14.0892 0x094c  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
00:19:14.0907 0x094c  vsmraid - ok
00:19:14.0952 0x094c  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS            C:\Windows\system32\vssvc.exe
00:19:15.0022 0x094c  VSS - ok
00:19:15.0027 0x094c  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
00:19:15.0037 0x094c  vwifibus - ok
00:19:15.0052 0x094c  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time        C:\Windows\system32\w32time.dll
00:19:15.0087 0x094c  W32Time - ok
00:19:15.0092 0x094c  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
00:19:15.0107 0x094c  WacomPen - ok
00:19:15.0112 0x094c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
00:19:15.0137 0x094c  WANARP - ok
00:19:15.0142 0x094c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
00:19:15.0167 0x094c  Wanarpv6 - ok
00:19:15.0207 0x094c  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
00:19:15.0262 0x094c  wbengine - ok
00:19:15.0272 0x094c  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
00:19:15.0287 0x094c  WbioSrvc - ok
00:19:15.0302 0x094c  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc        C:\Windows\System32\wcncsvc.dll
00:19:15.0327 0x094c  wcncsvc - ok
00:19:15.0332 0x094c  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
00:19:15.0347 0x094c  WcsPlugInService - ok
00:19:15.0347 0x094c  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
00:19:15.0357 0x094c  Wd - ok
00:19:15.0387 0x094c  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
00:19:15.0427 0x094c  Wdf01000 - ok
00:19:15.0432 0x094c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
00:19:15.0462 0x094c  WdiServiceHost - ok
00:19:15.0467 0x094c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost  C:\Windows\system32\wdi.dll
00:19:15.0482 0x094c  WdiSystemHost - ok
00:19:15.0487 0x094c  [ 4E89FC53493704BF835F0300DC201C34, FB3080725E144D93512DED81047D21C0582BC3412250EFF37E039108D7351F53 ] WebClient      C:\Windows\System32\webclnt.dll
00:19:15.0502 0x094c  WebClient - ok
00:19:15.0512 0x094c  [ CBA25A299ECDBAE3A2300B68598AABA3, 5AC6F75FBDA58CD9D17922AF2780A37B89067EB4A97EE792A644B238BE94490D ] Wecsvc          C:\Windows\system32\wecsvc.dll
00:19:15.0537 0x094c  Wecsvc - ok
00:19:15.0542 0x094c  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
00:19:15.0572 0x094c  wercplsupport - ok
00:19:15.0577 0x094c  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
00:19:15.0602 0x094c  WerSvc - ok
00:19:15.0607 0x094c  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
00:19:15.0627 0x094c  WfpLwf - ok
00:19:15.0632 0x094c  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
00:19:15.0642 0x094c  WIMMount - ok
00:19:15.0642 0x094c  WinDefend - ok
00:19:15.0647 0x094c  WinHttpAutoProxySvc - ok
00:19:15.0657 0x094c  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
00:19:15.0692 0x094c  Winmgmt - ok
00:19:15.0747 0x094c  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM          C:\Windows\system32\WsmSvc.dll
00:19:15.0862 0x094c  WinRM - ok
00:19:15.0892 0x094c  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc        C:\Windows\System32\wlansvc.dll
00:19:15.0932 0x094c  Wlansvc - ok
00:19:15.0937 0x094c  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
00:19:15.0947 0x094c  WmiAcpi - ok
00:19:15.0957 0x094c  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
00:19:15.0977 0x094c  wmiApSrv - ok
00:19:15.0982 0x094c  WMPNetworkSvc - ok
00:19:15.0982 0x094c  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
00:19:15.0997 0x094c  WPCSvc - ok
00:19:16.0002 0x094c  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
00:19:16.0032 0x094c  WPDBusEnum - ok
00:19:16.0032 0x094c  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
00:19:16.0057 0x094c  ws2ifsl - ok
00:19:16.0062 0x094c  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
00:19:16.0077 0x094c  wscsvc - ok
00:19:16.0082 0x094c  [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
00:19:16.0097 0x094c  WSDPrintDevice - ok
00:19:16.0102 0x094c  [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan        C:\Windows\system32\DRIVERS\WSDScan.sys
00:19:16.0112 0x094c  WSDScan - ok
00:19:16.0117 0x094c  WSearch - ok
00:19:16.0157 0x094c  [ 39D604E190DFE2E483B637D6796ABAFF, 52DCCEA0DB59F00C615D94CC2B70FC1C335E553E8FC79AAC8C8C7D9EE1F6111D ] wuauserv        C:\Windows\system32\wuaueng.dll
00:19:16.0222 0x094c  wuauserv - ok
00:19:16.0227 0x094c  [ D3381DC54C34D79B22CEE0D65BA91B7C, 70DC4ADCA4C0C28BB133287511E329D1B6B9B97F96CDE5B1D2F1F59FE1A965D9 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
00:19:16.0252 0x094c  WudfPf - ok
00:19:16.0262 0x094c  [ CF8D590BE3373029D57AF80914190682, FB9641777E90A58C063FBE95F081DC6D2F4770827DE19108A9DC3E3D6B17B4BF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
00:19:16.0287 0x094c  WUDFRd - ok
00:19:16.0292 0x094c  [ 7A95C95B6C4CF292D689106BCAE49543, 9029F489E1E817CE12839B8C6656E46190497D445DC3F43C20CF96E5E6BD0691 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
00:19:16.0317 0x094c  wudfsvc - ok
00:19:16.0327 0x094c  [ FE90B750AB808FB9DD8FBB428B5FF83B, 3F8F592EC813BE292D305A87C5BA852F8BC3D7CE610612D9871F209A17326AA8 ] WwanSvc        C:\Windows\System32\wwansvc.dll
00:19:16.0347 0x094c  WwanSvc - ok
00:19:16.0352 0x094c  ================ Scan global ===============================
00:19:16.0352 0x094c  [ 168EA9CD9BD6056BB6F60B57D5304BBE, 5A2F98754F042A7D80E7483842967EB362F01D57CE9720B24C7EDAA047F24C6F ] C:\Windows\system32\basesrv.dll
00:19:16.0357 0x094c  [ E80CA72FA43BF258E72C408CEF9839BE, 06482E80F43AD91F4B9E5919A0C50219382213D59EACF9FBAE7AFD7A321F30D2 ] C:\Windows\system32\winsrv.dll
00:19:16.0367 0x094c  [ E80CA72FA43BF258E72C408CEF9839BE, 06482E80F43AD91F4B9E5919A0C50219382213D59EACF9FBAE7AFD7A321F30D2 ] C:\Windows\system32\winsrv.dll
00:19:16.0372 0x094c  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
00:19:16.0382 0x094c  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
00:19:16.0387 0x094c  [ Global ] - ok
00:19:16.0387 0x094c  ================ Scan MBR ==================================
00:19:16.0392 0x094c  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
00:19:16.0572 0x094c  \Device\Harddisk0\DR0 - ok
00:19:16.0577 0x094c  [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk1\DR1
00:19:16.0647 0x094c  \Device\Harddisk1\DR1 - ok
00:19:16.0647 0x094c  ================ Scan VBR ==================================
00:19:16.0652 0x094c  [ 6B5C3F8F640B6E1CD8695E4855C3D180 ] \Device\Harddisk0\DR0\Partition1
00:19:16.0672 0x094c  \Device\Harddisk0\DR0\Partition1 - ok
00:19:16.0677 0x094c  [ FE32C2DF465D1B3B4EE077CA5A11016E ] \Device\Harddisk0\DR0\Partition2
00:19:16.0677 0x094c  \Device\Harddisk0\DR0\Partition2 - ok
00:19:16.0677 0x094c  [ 949327C8ECCEF8E11249863E2C6A476E ] \Device\Harddisk1\DR1\Partition1
00:19:16.0682 0x094c  \Device\Harddisk1\DR1\Partition1 - ok
00:19:16.0687 0x094c  [ 0054E4441D5286C44CEDCC28868BCE32 ] \Device\Harddisk1\DR1\Partition2
00:19:16.0687 0x094c  \Device\Harddisk1\DR1\Partition2 - ok
00:19:16.0687 0x094c  ================ Scan generic autorun ======================
00:19:16.0947 0x094c  [ 5BAD798CBAB39F3A56A9CD495320F67E, 668FB3F30DD99CBF9EBDDF4C079636DFD2C7693B3506AC8A6DD1B3CA4B5BAF11 ] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
00:19:17.0052 0x094c  RtHDVCpl - ok
00:19:17.0122 0x094c  [ C9C552CE10985B889DC476F6C015F85D, 901A7BFC84A7C42DF0B9CBFB49F39A95DDC62BAC9E08777DA53AB2B1550AAA55 ] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
00:19:17.0147 0x094c  RtHDVBg - ok
00:19:17.0152 0x094c  [ 7776134C2B3F472BC245D8A9496CF0C0, B4891FF14CEAD52CB154BE0AEE143DD061889812A151571C0401993F176F984B ] C:\Windows\system32\igfxtray.exe
00:19:17.0162 0x094c  IgfxTray - ok
00:19:17.0182 0x094c  [ BC67AE48519F372C2A519C680BE0A8F9, F66FC5CD9269765C8346FEE3E39F07E34E22F909DF7A4599D9007814917A3CC9 ] C:\Windows\system32\hkcmd.exe
00:19:17.0192 0x094c  HotKeysCmds - ok
00:19:17.0212 0x094c  [ D4D714B422AE20CD20E9E68BC0133D6F, D554C3498F159D5CD4F29312FE73493061B3ADAF5DF81B780D749B3C54CFF7F3 ] C:\Windows\system32\igfxpers.exe
00:19:17.0227 0x094c  Persistence - ok
00:19:17.0257 0x094c  [ 50E81F5F143F4ABBCCC4BDF92D70C383, E5723A1CCC0E0B22F36A035ADCFE78D98A97A77CBD9D34CF95E75B78C139F175 ] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
00:19:17.0267 0x094c  USB3MON - ok
00:19:17.0307 0x094c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
00:19:17.0362 0x094c  Sidebar - ok
00:19:17.0367 0x094c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
00:19:17.0382 0x094c  mctadmin - ok
00:19:17.0417 0x094c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
00:19:17.0447 0x094c  Sidebar - ok
00:19:17.0452 0x094c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
00:19:17.0467 0x094c  mctadmin - ok
00:19:17.0482 0x094c  [ F51BB12D8977D26C1A4CDA348770D9F1, DDA35CD8F8A6591B83821B5180D457740E0B820CCE000BC7FB1B78FB4AEAD3BA ] C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe
00:19:17.0532 0x094c  SpybotPostWindows10UpgradeReInstall - detected UnsignedFile.Multi.Generic ( 1 )
00:19:19.0892 0x094c  Detect skipped due to KSN trusted
00:19:19.0892 0x094c  SpybotPostWindows10UpgradeReInstall - ok
00:19:19.0892 0x094c  Waiting for KSN requests completion. In queue: 35
00:19:20.0892 0x094c  Waiting for KSN requests completion. In queue: 35
00:19:21.0892 0x094c  Waiting for KSN requests completion. In queue: 35
00:19:22.0947 0x094c  Win FW state via NFP2: enabled ( trusted )
00:19:25.0312 0x094c  ============================================================
00:19:25.0312 0x094c  Scan finished
00:19:25.0312 0x094c  ============================================================
00:19:25.0332 0x0910  Detected object count: 0
00:19:25.0332 0x0910  Actual detected object count: 0

RehIT 11.10.2015 00:04
Ausführung der weiteren Schritte 2
 
Schritt 4:
Hitman Pro Scan

Hitman Pro Log
Code:
HitmanPro 3.7.10.250
www.hitmanpro.com

  Computer name . . . . : COMPUTER
  Windows . . . . . . . : 6.1.1.7601.X64/4
  User name . . . . . . : USER
  UAC . . . . . . . . . : Disabled
  License . . . . . . . : Free

  Scan date . . . . . . : 2015-10-11 00:29:30
  Scan mode . . . . . . : Normal
  Scan duration . . . . : 6m 33s
  Disk access mode  . . : Direct disk access (SRB)
  Cloud . . . . . . . . : Internet
  Reboot  . . . . . . . : No

  Threats . . . . . . . : 0
  Traces  . . . . . . . : 5

  Objects scanned . . . : 1.367.954
  Files scanned . . . . : 23.997
  Remnants scanned  . . : 233.068 files / 1.110.889 keys

Suspicious files ____________________________________________________________

  C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\615H313A\FRST64[1].exe
      Size . . . . . . . : 2.195.456 bytes
      Age  . . . . . . . : 0.0 days (2015-10-11 00:05:24)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : DAD29F68C34049504D7D4445355F83B1C6E017A43C68E88C94D8B2A9C0A57BFE
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
        Program has no publisher information but prompts the user for permission elevation.
        Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
        Authors name is missing in version info. This is not common to most programs.
        Version control is missing. This file is probably created by an individual. This is not typical for most programs.
        Time indicates that the file appeared recently on this computer.
      Forensic Cluster
        -2.3s C:\Users\USER\AppData\Roaming\Microsoft\Windows\Cookies\N395RRFG.txt
        -2.3s C:\Users\USER\AppData\Roaming\Microsoft\Windows\Cookies\U0AR1JM3.txt
        -2.3s C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1WGHS84R\82[1].htm
          0.0s C:\Users\USER\Downloads\Virenscan\FRST64.exe
          0.0s C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\615H313A\FRST64[1].exe
          0.3s C:\ProgramData\Microsoft\RAC\Temp\sqlB34C.tmp
          0.3s C:\ProgramData\Microsoft\RAC\Temp\sqlB35D.tmp
        15.1s C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q5MH94PT\up64[1]
        19.1s C:\FRST\Logs\ct
        19.5s C:\Users\USER\Downloads\Virenscan\Fixlog.txt
        20.0s C:\FRST\Quarantine\C\
        20.0s C:\FRST\Quarantine\C\Windows\System32\Tasks\
        20.0s C:\FRST\Quarantine\C\Windows\
        20.0s C:\FRST\Quarantine\C\Windows\System32\
        20.2s C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\9wc6i27g.default\prefs.js
        20.4s C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.314.gthr
        20.4s C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.314.Crwl

  C:\Users\USER\Downloads\Virenscan\FRST-OlderVersion\FRST64.exe
      Size . . . . . . . : 2.194.944 bytes
      Age  . . . . . . . : 0.9 days (2015-10-10 02:46:44)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : C71A17F855D73AB42D760200C8D7FF888650A20B6BCFF38A76748E285F1FDE40
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
        Program has no publisher information but prompts the user for permission elevation.
        Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
        Authors name is missing in version info. This is not common to most programs.
        Version control is missing. This file is probably created by an individual. This is not typical for most programs.
        Time indicates that the file appeared recently on this computer.

  C:\Users\USER\Downloads\Virenscan\FRST64.exe
      Size . . . . . . . : 2.195.456 bytes
      Age  . . . . . . . : 0.0 days (2015-10-11 00:05:24)
      Entropy  . . . . . : 7.6
      SHA-256  . . . . . : DAD29F68C34049504D7D4445355F83B1C6E017A43C68E88C94D8B2A9C0A57BFE
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
        Program has no publisher information but prompts the user for permission elevation.
        Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
        Authors name is missing in version info. This is not common to most programs.
        Version control is missing. This file is probably created by an individual. This is not typical for most programs.
        Time indicates that the file appeared recently on this computer.
      Forensic Cluster
        -2.3s C:\Users\USER\AppData\Roaming\Microsoft\Windows\Cookies\N395RRFG.txt
        -2.3s C:\Users\USER\AppData\Roaming\Microsoft\Windows\Cookies\U0AR1JM3.txt
        -2.3s C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1WGHS84R\82[1].htm
          0.0s C:\Users\USER\Downloads\Virenscan\FRST64.exe
          0.0s C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\615H313A\FRST64[1].exe
          0.3s C:\ProgramData\Microsoft\RAC\Temp\sqlB34C.tmp
          0.3s C:\ProgramData\Microsoft\RAC\Temp\sqlB35D.tmp
        15.1s C:\Users\USER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q5MH94PT\up64[1]
        19.1s C:\FRST\Logs\ct
        19.5s C:\Users\USER\Downloads\Virenscan\Fixlog.txt
        20.0s C:\FRST\Quarantine\C\
        20.0s C:\FRST\Quarantine\C\Windows\System32\Tasks\
        20.0s C:\FRST\Quarantine\C\Windows\
        20.0s C:\FRST\Quarantine\C\Windows\System32\
        20.2s C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\9wc6i27g.default\prefs.js
        20.4s C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.314.gthr
        20.4s C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.314.Crwl

  C:\Windows\SysWOW64\dbclient.dll
      Size . . . . . . . : 211.056 bytes
      Age  . . . . . . . : 536.2 days (2014-04-22 18:37:16)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 86744D1E4CD885DC1ABBFB5F438E81C8553B5D072741C151F76BFC551819469D
      Publisher  . . . . : Inprise Corporation
      Description  . . . : Borland Database Engine
      Version  . . . . . : 5.0.1.32
      Copyright  . . . . : Copyright Inprise Corp. 1991-1998
      RSA Key Size . . . : 512
      Authenticode . . . : Self-signed
      Fuzzy  . . . . . . : 26.0
        Program is code signed with a weak certificate. This is common to malware.
        Program is code self-signed.
        The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.

  C:\Windows\SysWOW64\stdvcl32.dll
      Size . . . . . . . : 343.480 bytes
      Age  . . . . . . . : 536.2 days (2014-04-22 18:37:16)
      Entropy  . . . . . : 6.5
      SHA-256  . . . . . : C8DA47044346BFF233A997B14CC193EDD71EFCB0CE1B92010D88B348B86FD389
      Product  . . . . . : Delphi standard VCL type library
      Publisher  . . . . : Borland International
      Description  . . . : Delphi standard VCL type library
      Version  . . . . . : 1.0.0.0
      Copyright  . . . . : Copyright © Borland International 1996-97
      RSA Key Size . . . : 512
      LanguageID . . . . : 1033
      Authenticode . . . : Invalid
      Fuzzy  . . . . . . : 43.0
        Program is code signed with a weak certificate. This is common to malware.
        Program is altered or corrupted since it was code signed by its author. This is typical for malware and pirated software.
        The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.

Schritt 5:
Erneuter FRST Scan

FRST Log
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:10-10-2015
durchgeführt von USER (Administrator) auf COMPUTER (11-10-2015 00:41:20)
Gestartet von C:\Users\USER\Downloads\Virenscan
Geladene Profile: USER & Administrator & Administrator (Verfügbare Profile: USER & Administrator & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 10 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Invincea, Inc.) C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe
 (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
 (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
 (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-07-30] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
BootExecute: autocheck autochk:cf * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] ***.***.***.***
Tcpip\..\Interfaces\{71A0E7E8-E6B4-4338-8501-233684B540FE}: [DhcpNameServer] ***.***.***.***

Internet Explorer:
==================
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.at/?gfe_rd=ssl&ei=j8IXVvKSE4uEaIK6tMgL
HKU\S-1-5-21-3347640149-618416472-1368429990-1176\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com/?pc=DCJB
HKU\S-1-5-21-3347640149-618416472-1368429990-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dell13.msn.com/?pc=DCJB
HKU\S-1-5-21-3347640149-618416472-1368429990-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com/?pc=DCJB
HKU\S-1-5-21-4246694115-3229728745-2940103716-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dell13.msn.com/?pc=DCJB
HKU\S-1-5-21-4246694115-3229728745-2940103716-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com/?pc=DCJB
HKU\S-1-5-21-4246694115-3229728745-2940103716-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://dell13.msn.com/?pc=DCJB
HKU\S-1-5-21-4246694115-3229728745-2940103716-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com/?pc=DCJB
SearchScopes: HKU\S-1-5-21-3347640149-618416472-1368429990-500 -> DefaultScope {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
SearchScopes: HKU\S-1-5-21-3347640149-618416472-1368429990-500 -> {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
SearchScopes: HKU\S-1-5-21-4246694115-3229728745-2940103716-1000 -> DefaultScope {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
SearchScopes: HKU\S-1-5-21-4246694115-3229728745-2940103716-1000 -> {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
SearchScopes: HKU\S-1-5-21-4246694115-3229728745-2940103716-500 -> DefaultScope {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
SearchScopes: HKU\S-1-5-21-4246694115-3229728745-2940103716-500 -> {AB6345E8-AE38-45A0-BEC0-AB30139FEDFB} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-08-12] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-09-22] (Eyeo GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-10-09] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-09] (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)

FireFox:
========
FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\9wc6i27g.default
FF Homepage: hxxps://www.google.at/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-22] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-22] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-10-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files (x86)\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-10-09] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)
FF Extension: Firefox Old Version Update Hotfix - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\9wc6i27g.default\Extensions\firefox-hotfix@mozilla.org.xpi [2014-09-02]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => nicht gefunden

Chrome:
=======
CHR Profile: C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-12]
CHR Extension: (Google Drive) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-12]
CHR Extension: (YouTube) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-12]
CHR Extension: (Google Search) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-12]
CHR Extension: (Google Docs Offline) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-10-09]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-10-09]
CHR Extension: (Chrome Web Store Payments) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-09]
CHR Extension: (Gmail) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
S2 InvProtectSvc; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectSvc64.exe [3485512 2015-08-20] (Invincea, Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-22] (Intel Corporation)
S4 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)
S4 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)
R2 SboxSvc; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxSvc.exe [174920 2015-08-20] (Invincea, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-03-20] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTDVHD64.sys [2192088 2013-08-24] (Realtek Semiconductor Corp.)
S3 InvProtectDrv; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrv64.sys [64648 2015-08-20] (Invincea, Inc.)
S3 InvProtectDrvNet; C:\Program Files (x86)\Invincea\Enterprise\X64\InvProtectDrvNet64.sys [24200 2015-08-20] (Invincea, Inc.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-08-22] (Intel Corporation)
R3 SboxDrv; C:\Program Files (x86)\Invincea\Enterprise\Sandbox\SboxDrv.sys [187528 2015-08-20] (Invincea, Inc.)
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2014-03-20] (Microsoft Corporation) [Datei ist nicht signiert]
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2014-03-20] (Microsoft Corporation) [Datei ist nicht signiert]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-11 00:28 - 2015-10-11 00:36 - 00000000 ____D C:\ProgramData\HitmanPro
2015-10-11 00:16 - 2015-10-11 00:16 - 00000085 _____ C:\Windows\wininit.ini
2015-10-10 03:28 - 2015-10-11 00:16 - 00000000 ____D C:\Users\USER\Downloads\Virenscan
2015-10-10 02:50 - 2015-10-11 00:41 - 00000000 ____D C:\FRST
2015-10-09 17:44 - 2014-04-22 17:01 - 00001485 _____ C:\Users\USER\Desktop\Internet Explorer.lnk
2015-10-09 15:00 - 2015-10-09 15:00 - 00000952 _____ C:\Windows\system32\TmInstall.log
2015-10-09 14:48 - 2015-10-11 00:08 - 00267596 _____ C:\Windows\PFRO.log
2015-10-09 14:48 - 2015-10-11 00:08 - 00000168 _____ C:\Windows\setupact.log
2015-10-09 14:48 - 2015-10-09 14:48 - 00000000 _____ C:\Windows\setuperr.log
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default\AppData\Roaming\Invincea
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default\AppData\Local\Invincea
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Invincea
2015-10-09 13:52 - 2015-10-09 13:52 - 00000000 ____D C:\Users\Default User\AppData\Local\Invincea
2015-10-09 13:50 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2015-10-09 13:50 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2015-10-09 13:47 - 2015-10-09 13:47 - 00000000 ____D C:\Program Files\Common Files\AV
2015-10-09 13:42 - 2015-10-11 00:16 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-10-09 13:42 - 2015-10-11 00:16 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-10-09 13:42 - 2015-10-09 13:42 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2015-10-09 13:22 - 2015-10-09 13:22 - 00000000 ____D C:\Users\USER\AppData\Roaming\Sun
2015-10-09 13:22 - 2015-10-09 13:22 - 00000000 ____D C:\Users\USER\.oracle_jre_usage
2015-10-09 13:21 - 2015-10-09 13:21 - 01682432 _____ C:\Users\USER\Downloads\adwcleaner_5.013.exe
2015-10-09 13:21 - 2015-10-09 13:21 - 00000000 ____D C:\Users\USER\AppData\LocalLow\Oracle
2015-10-09 13:16 - 2015-10-09 13:20 - 49695840 _____ (Oracle Corporation) C:\Users\USER\Downloads\jre-8u60-windows-i586.exe
2015-10-09 09:09 - 2015-10-09 09:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-10-08 03:00 - 2015-10-08 03:00 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2015-10-08 03:00 - 2015-10-08 03:00 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2015-10-07 15:29 - 2015-08-05 19:56 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-10-07 15:29 - 2015-08-05 19:56 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-10-07 15:29 - 2015-08-05 19:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-10-07 15:28 - 2015-08-05 19:56 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-10-07 15:28 - 2015-07-15 05:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-10-07 15:28 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-10-07 15:27 - 2015-10-07 15:27 - 00002864 _____ C:\Users\USER\Desktop\Outlook 2013.lnk
2015-10-07 15:26 - 2015-09-02 05:04 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-10-07 15:26 - 2015-09-02 05:04 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-10-07 15:26 - 2015-09-02 05:04 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-10-07 15:26 - 2015-09-02 05:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-10-07 15:26 - 2015-09-02 04:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-10-07 15:26 - 2015-09-02 04:48 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-10-07 15:26 - 2015-09-02 04:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-10-07 15:26 - 2015-09-02 04:47 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-10-07 15:26 - 2015-09-02 03:51 - 03209216 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-10-07 15:26 - 2015-09-02 03:47 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-10-07 15:26 - 2015-09-02 03:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-10-07 15:26 - 2015-08-22 16:40 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-10-07 15:26 - 2015-08-22 15:51 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-10-07 15:26 - 2015-08-22 15:50 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-10-07 15:26 - 2015-08-22 15:50 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-10-07 15:26 - 2015-08-20 20:53 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-10-07 15:26 - 2015-08-20 20:46 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-10-07 15:26 - 2015-08-20 20:21 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-10-07 15:26 - 2015-08-20 20:19 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-10-07 15:26 - 2015-08-04 20:03 - 00692672 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-10-07 15:26 - 2015-08-04 20:00 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-10-07 15:26 - 2015-08-04 19:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-10-07 15:26 - 2015-08-04 19:56 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-10-07 15:26 - 2015-08-04 19:56 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-10-07 15:26 - 2015-08-04 19:55 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-10-07 15:26 - 2015-08-04 19:55 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-10-07 15:26 - 2015-08-04 19:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-10-07 15:26 - 2015-08-04 18:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-10-07 15:25 - 2015-08-26 20:07 - 03165696 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-10-07 15:25 - 2015-08-26 20:07 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-10-07 15:25 - 2015-08-26 20:06 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-10-07 15:25 - 2015-08-26 20:06 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-10-07 15:25 - 2015-08-26 20:06 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-10-07 15:25 - 2015-08-26 20:06 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-10-07 15:25 - 2015-08-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-10-07 15:25 - 2015-08-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-10-07 15:25 - 2015-08-22 16:40 - 14383616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 13774848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 02865664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 02056704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 01763328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-10-07 15:25 - 2015-08-22 16:40 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00718848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00525312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-10-07 15:25 - 2015-08-22 16:40 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-10-07 15:25 - 2015-08-22 15:51 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-10-07 15:25 - 2015-08-22 15:51 - 01409024 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-10-07 15:25 - 2015-08-22 15:51 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 19291648 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 02657280 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-10-07 15:25 - 2015-08-22 15:50 - 00857600 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-10-07 15:25 - 2015-08-22 15:50 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-10-07 15:25 - 2015-08-20 19:56 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2015-10-07 15:25 - 2015-08-20 19:55 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-10-07 15:14 - 2015-10-08 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-10-07 15:13 - 2015-10-07 15:13 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2015-10-07 15:12 - 2015-10-07 15:12 - 00000000 __RHD C:\MSOCache
2015-10-07 15:12 - 2015-10-07 15:12 - 00000000 ____D C:\Program Files\Microsoft Office
2015-10-07 15:12 - 2015-10-07 15:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2015-10-07 15:04 - 2015-10-07 15:04 - 00002143 _____ C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-10-07 15:04 - 2015-10-07 15:04 - 00002122 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-10-07 15:04 - 2015-10-07 15:04 - 00002122 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-10-07 15:04 - 2015-10-07 15:04 - 00000000 ___RD C:\Users\USER\OneDrive
2015-10-07 15:04 - 2015-10-07 15:04 - 00000000 ____D C:\Program Files (x86)\Microsoft OneDrive
2015-10-07 10:14 - 2015-10-07 11:25 - 00000000 ____D C:\Users\USER\Downloads\Office_H&B_2013_x32
2015-10-02 14:46 - 2015-10-02 14:45 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\mbam-setup-2.1.8.1057.exe

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-10-11 00:28 - 2009-07-14 06:45 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-11 00:28 - 2009-07-14 06:45 - 00021088 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-11 00:20 - 2014-03-19 19:23 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-10-11 00:15 - 2011-03-01 06:56 - 00769884 _____ C:\Windows\system32\perfh007.dat
2015-10-11 00:15 - 2011-03-01 06:56 - 00167176 _____ C:\Windows\system32\perfc007.dat
2015-10-11 00:15 - 2009-07-14 07:13 - 01785240 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-11 00:12 - 2014-11-12 08:11 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-10-11 00:08 - 2014-04-22 16:34 - 00000136 _____ C:\Windows\system32\config\netlogon.ftl
2015-10-11 00:08 - 2014-03-20 03:17 - 01119551 _____ C:\Windows\WindowsUpdate.log
2015-10-11 00:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-10 23:59 - 2014-11-12 08:11 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-09 13:52 - 2014-03-19 19:36 - 00002014 _____ C:\Users\Public\Desktop\Protected Workspace.lnk
2015-10-09 13:52 - 2014-03-19 19:36 - 00000000 ____D C:\Program Files (x86)\Invincea
2015-10-09 13:52 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2015-10-09 13:52 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2015-10-09 13:41 - 2014-12-05 16:02 - 00000000 ____D C:\Windows\pss
2015-10-09 13:37 - 2014-07-01 08:49 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2015-10-09 13:37 - 2014-06-23 13:00 - 00000000 ____D C:\Users\USER\AppData\Local\CrashDumps
2015-10-09 13:37 - 2011-02-10 16:25 - 00000000 ____D C:\Windows\panther
2015-10-09 13:36 - 2014-12-05 15:42 - 00000000 ____D C:\temp
2015-10-09 13:25 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-10-09 13:24 - 2014-11-28 14:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-10-09 13:24 - 2014-04-22 09:55 - 00000000 ____D C:\ProgramData\Oracle
2015-10-09 13:22 - 2014-04-22 17:01 - 00000000 ____D C:\Users\USER
2015-10-09 13:22 - 2014-04-22 09:55 - 00274016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-10-09 13:22 - 2014-04-22 09:55 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-10-09 13:22 - 2014-04-22 09:55 - 00000000 ____D C:\Program Files (x86)\Java
2015-10-09 09:35 - 2014-12-02 14:46 - 00000000 ____D C:\Users\USER\AppData\LocalLow\Adblock Plus for IE
2015-10-09 09:34 - 2014-12-02 14:46 - 00000000 ____D C:\Program Files\Adblock Plus for IE
2015-10-08 16:05 - 2014-04-23 09:33 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-10-08 16:02 - 2009-07-14 04:34 - 00000510 _____ C:\Windows\win.ini
2015-10-08 15:58 - 2014-09-25 14:22 - 00000000 ____D C:\ProgramData\firebird
2015-10-08 08:02 - 2014-04-22 17:15 - 00141376 _____ C:\Users\USER\AppData\Local\GDIPFONTCACHEV1.DAT
2015-10-08 03:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-10-08 03:11 - 2010-11-21 09:17 - 00000000 ____D C:\Program Files\Windows Journal
2015-10-08 03:11 - 2009-07-14 06:45 - 00549832 _____ C:\Windows\system32\FNTCACHE.DAT
2015-10-08 03:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-10-07 15:24 - 2011-02-10 16:33 - 01804514 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-10-07 15:20 - 2014-04-23 13:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-07 15:13 - 2014-03-19 19:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2015-10-07 15:13 - 2010-11-21 09:17 - 00000000 ____D C:\Windows\ShellNew
2015-10-07 15:12 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-10-02 13:03 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-10-01 17:12 - 2014-04-23 10:09 - 00000000 ____D C:\ProgramData\FLEXnet
2015-10-01 17:12 - 2014-04-22 18:38 - 00000000 ____D C:\ProgramData\SQL Anywhere 11
2015-10-01 17:12 - 2014-04-22 18:31 - 00000000 ____D C:\Users\Administrator.COMPUTER
2015-10-01 17:12 - 2014-04-22 18:22 - 00000000 ____D C:\Users\USER\AppData\Roaming\SQL Anywhere 12
2015-10-01 17:12 - 2014-04-22 16:36 - 00000000 ____D C:\Users\administrator
2015-10-01 17:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-09-30 17:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\security
2015-09-30 17:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2015-09-30 12:08 - 2015-04-30 12:36 - 00008132 _____ C:\Users\USER\0.mbs.txt
2015-09-28 08:00 - 2014-11-12 08:13 - 00002177 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-22 08:22 - 2014-03-19 19:23 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-09-22 08:22 - 2014-03-19 19:23 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-22 08:22 - 2014-03-19 19:23 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-09-15 12:54 - 2014-11-12 08:11 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-15 12:54 - 2014-11-12 08:11 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

Einige Dateien in TEMP:
====================
C:\Users\Administrator.COMPUTER\AppData\Local\Temp\drm_dialogs.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-10-02 12:16

==================== Ende von FRST.txt ============================

deeprybka 11.10.2015 10:57
Schritt 1

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

RehIT 11.10.2015 16:11
ESET Scan
 
Guten Tag.

Der ESET Scan wurde durchgeführt. Dabei wurden keine Bedrohungen gefunden.

ESET Log:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=3994f278fe0d6a44a3093ce96d66ba81
# end=init
# utc_time=2015-10-11 01:33:37
# local_time=2015-10-11 03:33:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 26183
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=3994f278fe0d6a44a3093ce96d66ba81
# end=updated
# utc_time=2015-10-11 01:39:58
# local_time=2015-10-11 03:39:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=3994f278fe0d6a44a3093ce96d66ba81
# engine=26183
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-10-11 02:12:03
# local_time=2015-10-11 04:12:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=519 16777213 100 93 10017 158021299 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 0 196202573 0 0
# scanned=156763
# found=0
# cleaned=0
# scan_time=1924


Ich habe danach wieder die Webseite der Volksbank aufgerufen.
Die Meldung des Virus wurde nicht mehr angezeigt.
Danke für die Hilfe. :dankeschoen:

deeprybka 11.10.2015 16:16
Ja, das haben wir mit dem FRST-Fix schon entfernt.
Firefox und Internet-Explorer updaten, Antivirusgrogramm installieren. Keine Anhänge von unbekannten Emails mehr öffnen, auch wenn als Absender eine Bank steht. ;)


http://deeprybka.trojaner-board.de/b...ndeeprybka.gif
Wir haben es geschafft! :abklatsch:
Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:
Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. ;)



http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.


http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
 Flash-Player
PDF-Reader

Sicherheitslücken (z.B. hier) in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.

Meine Kauf-Empfehlung:

http://deeprybka.trojaner-board.de/eset/ESS.png
ESET Smart Security

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

RehIT 11.10.2015 16:58
Afterwork
 
Guten Tag.

Sehr gut. (:
Danke noch einmal.

Ich habe jetzt erst einmal ein Update von Adobe Flashplayer, Adobe Reader und IE ausgeführt.

Danach habe ich DelFix ausgeführt.



Ich wünsche noch einen schönen Sonntag (;

____________________________________
LG Rene

deeprybka 11.10.2015 16:59
Virenscanner und Firefox nicht vergessen. ;)

Alles Gute!


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:20 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19