Home » Viren, Trojaner & Malware Forum » Win32/Olmarik.AYA oder evtl andere Tierchen? » Themenansicht

Win32/Olmarik.AYA oder evtl andere Tierchen?
#0
09.01.2012, 12:36
bluepill
Member

Beiträge: 15
#1 Grüße

Ich habe ein Problem mit mit der entfernung des Win32/Olmarik.AYA.

Problembeschreibung:

• Seit wann tritt das Problem auf?

Bin mir nicht ganz sicher... ich habe vor ca 1- 1 ½ Monaten meinen Rechner komplett neu aufgesetzt. Nun wird mein Rechner seit ca einer Woche immer langsamer und das Bild friert ab und an ca 1 sekunde ein wenn ich viele Programme und tabs geöffnet habe. Habe das bislang immer auf die sehr alle Festplatte geschoben doch nun hat mein ESET NOD 32 einen Olmarik.AYA gefunden im Bootsector auf Datenträger 2 den er nicht entfernen kann.

Habe schon verschiedene scanner drüberlaufen lassen unter anderem Nod komplettscann(olmarik gefunden. Nicht entfernbar), Antivir(nix gefunden), Antivir rescue disc(nix gefunden), Eset rescue disc(nix gefunden). Eset standallone olmarik removal tool(hat nix gefunden) Malwarebytes(nix gefunden), MBRCheck

Habe den Bootsector neugeschrieben mit Bootrec.exe /FixMbr und /FixBoot
danach wurde er wieder gefunden diesesmal im Bootsector auf Datenträger 0
Nach einem run von combofix findet er den olmarik jetzt komischerweise wieder im Bootsec auf Datenträger 2 ?!


• Wie äussert sich das Problem?
Siehe oben

• Wurde durch Virenscanner Funde gemeldet? (Genauen Pfad und Datei angeben)
Ja siehe oben
ESET NOD 32 einen Olmarik.AYA gefunden im Bootsector auf Datenträger 2

• Kommen Pop ups?
Nein nicht mehr als sonst üblich im heutigen Werbechaos

• Was hat sich seit dem Problem am System verändert?

Nicht viel außer die oben beschrieben mini freezes und evtl ein selbständiger neustart (bin mir aber nicht sicher ob dieser nicht auch von einem windows update gekommen ist)

OTL.TXT:

Code


OTL logfile created on: 09.01.2012 12:14:33 - Run 2
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\six\Downloads\sicher
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,98 Gb Available Physical Memory | 49,56% Memory free
8,00 Gb Paging File | 5,67 Gb Available in Paging File | 70,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 12,83 Gb Free Space | 13,14% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 5,25 Gb Free Space | 1,13% Space Free | Partition Type: NTFS
Drive E: | 368,10 Gb Total Space | 1,64 Gb Free Space | 0,45% Space Free | Partition Type: NTFS
Drive F: | 268,28 Gb Total Space | 1,85 Gb Free Space | 0,69% Space Free | Partition Type: NTFS
Drive H: | 29,81 Gb Total Space | 0,38 Gb Free Space | 1,28% Space Free | Partition Type: NTFS
Drive I: | 1,53 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: SIXER | User Name: six | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - C:\Users\six\Downloads\sicher\SystemLook.exe ()
PRC - C:\Users\six\Downloads\sicher\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Unified Remote\RemoteServer.exe (Unified Remote)
PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\XWidget\xwidget.exe (xwidget.com)
PRC - C:\Program Files (x86)\Mumble\murmur.exe (Thorvald Natvig)
PRC - C:\Programme\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Users\six\Downloads\sicher\gmer\gmer.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe (OpenOffice.org)
PRC - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Everything\Everything.exe ()
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - C:\Users\six\Downloads\sicher\SystemLook.exe ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\fa45e7d581b80c34cb0d5518491c7387\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\57596d4d226b474561784317266604ab\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\90223e809b1ff291a7f65509702e2fa1\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a48e483c6b13da563725d72ec518a0bb\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\fd0f015bc4324d8b9716ae38083a4e4d\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\100121f0f4e55a3e85a886f4968dedfc\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\69adb8f9940fa1330f6f1b706e3dc31e\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\2b1af7649e57195b4b85bbf4c5cb7c90\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxslt.dll ()
MOD - C:\Program Files (x86)\Mumble\QtPlugins\imageformats\qtiff4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtPlugins\imageformats\qmng4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtPlugins\imageformats\qsvg4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtPlugins\imageformats\qjpeg4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtPlugins\imageformats\qico4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtPlugins\imageformats\qgif4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtSvg4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtGui4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtSql4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtNetwork4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtXml4.dll ()
MOD - C:\Program Files (x86)\Mumble\QtCore4.dll ()
MOD - C:\Users\six\Downloads\sicher\gmer\gmer.exe ()
MOD - C:\Program Files (x86)\Mumble\libmysql.dll ()
MOD - C:\Program Files (x86)\Mumble\ZLIB1.dll ()
MOD - C:\Program Files (x86)\Mumble\bzip2.dll ()
MOD - C:\Program Files (x86)\XWidget\Res\Lib\lib.dll ()
MOD - C:\Program Files (x86)\Everything\Everything.exe ()
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV:[b]64bit:[/b] - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:[b]64bit:[/b] - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:[b]64bit:[/b] - (ekrn) -- C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (ESET)
SRV:[b]64bit:[/b] - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (TunngleService) -- C:\Program Files (x86)\Tunngle\TnglCtrl.exe (Tunngle.net GmbH)
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (btwdins) -- C:\Programme\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV:[b]64bit:[/b] - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:[b]64bit:[/b] - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:[b]64bit:[/b] - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:[b]64bit:[/b] - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:[b]64bit:[/b] - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:[b]64bit:[/b] - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:[b]64bit:[/b] - (ssudobex) SAMSUNG Mobile USB OBEX Serial Port(DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudobex.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:[b]64bit:[/b] - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:[b]64bit:[/b] - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:[b]64bit:[/b] - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:[b]64bit:[/b] - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation)
DRV:[b]64bit:[/b] - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:[b]64bit:[/b] - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:[b]64bit:[/b] - (eamonm) -- C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:[b]64bit:[/b] - (ehdrv) -- C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:[b]64bit:[/b] - (epfwwfpr) -- C:\Windows\SysNative\drivers\epfwwfpr.sys (ESET)
DRV:[b]64bit:[/b] - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:[b]64bit:[/b] - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) -- C:\Windows\SysNative\drivers\tap0901t.sys (Tunngle.net)
DRV:[b]64bit:[/b] - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:[b]64bit:[/b] - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:[b]64bit:[/b] - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:[b]64bit:[/b] - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:[b]64bit:[/b] - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:[b]64bit:[/b] - (BTPROT) -- C:\Windows\SysNative\drivers\btprot.sys (iAnywhere Solutions)
DRV:[b]64bit:[/b] - (BTIAUSB) -- C:\Windows\SysNative\drivers\btiausb.sys (iAnywhere Solutions)
DRV:[b]64bit:[/b] - (btiaspp) -- C:\Windows\SysNative\drivers\btiaspp.sys (iAnywhere Solutions)
DRV:[b]64bit:[/b] - (btiaa2dp) -- C:\Windows\SysNative\drivers\btiaa2dp.sys (iAnywhere Solutions)
DRV:[b]64bit:[/b] - (BTiAPan) -- C:\Windows\SysNative\drivers\btiapan.sys (iAnywhere Solutions)
DRV:[b]64bit:[/b] - (BTKRNL) -- C:\Windows\SysNative\drivers\btkrnl.sys (Broadcom Corporation.)
DRV:[b]64bit:[/b] - (iAnywhere_btAudio) -- C:\Windows\SysNative\drivers\btiasco.sys (iAnywhere Solutions)
DRV:[b]64bit:[/b] - (btiarcp) -- C:\Windows\SysNative\drivers\btiarcp.sys (iAnywhere Solutions)
DRV:[b]64bit:[/b] - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (AODDriver4.01) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 26 A9 5C 9B 52 9B CC 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..network.proxy.type: 0
 
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.2.1: C:\Windows\system32\npDeployJava1.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.2.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\six\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\six\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\six\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\six\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\six\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.17 01:11:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.01.01 16:25:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.08 13:32:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011.11.05 01:40:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}: C:\Program Files (x86)\Mobile Master\ext\1\ [2011.12.21 14:54:06 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{d591241b-9967-418c-9b7d-ee128131d60d}: C:\Program Files (x86)\GMX\GMX MultiMessenger\ThunderbirdSyncProxy [2011.12.05 18:28:49 | 000,000,000 | ---D | M]
 
[2011.11.05 15:23:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\six\AppData\Roaming\mozilla\Extensions
[2012.01.05 21:48:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\six\AppData\Roaming\mozilla\Firefox\Profiles\mdsyc49z.default\extensions
[2011.12.05 18:34:03 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\six\AppData\Roaming\mozilla\Firefox\Profiles\mdsyc49z.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2011.12.03 15:09:10 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\six\AppData\Roaming\mozilla\Firefox\Profiles\mdsyc49z.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.12.19 22:14:48 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\six\AppData\Roaming\mozilla\Firefox\Profiles\mdsyc49z.default\extensions\foxyproxy@eric.h.jung
[2012.01.01 16:25:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
() (No name found) -- C:\USERS\SIX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MDSYC49Z.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.01.01 16:25:30 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.11.07 19:40:45 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.01.09 11:08:27 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:[b]64bit:[/b] - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:[b]64bit:[/b] - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Everything] C:\Program Files (x86)\Everything\Everything.exe ()
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [Unified Remote v2] C:\Program Files (x86)\Unified Remote\RemoteServer.exe (Unified Remote)
O4 - HKCU..\Run: [XWidget] C:\Program Files (x86)\XWidget\xwidget.exe (xwidget.com)
O4 - Startup: C:\Users\six\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Murmur.lnk = C:\Windows\Installer\{CEECECD5-A430-4451-8D62-7C4ACB30F93B}\murmur.ico ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:[b]64bit:[/b] - Extra context menu item: Free YouTube Download - C:\Users\six\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\six\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Senden an Bluetooth - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\six\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\six\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:[b]64bit:[/b] - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.1)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{87F5DE40-5BB1-4134-A5D8-CB135724B9D9}: DhcpNameServer = 7.254.254.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9AC39815-0286-4A14-AABE-EE39F0BB042E}: DhcpNameServer = 192.168.2.1
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = ComFile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2012.01.09 12:14:57 | 000,000,000 | ---D | C] -- C:\Users\six\Desktop\Neuer Ordner
[2012.01.09 11:44:55 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2012.01.09 11:44:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2012.01.09 11:21:33 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.01.09 11:15:04 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN
[2012.01.09 10:59:14 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.01.09 10:59:14 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.01.09 10:59:14 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.01.09 10:53:15 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.01.09 10:52:45 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.01.09 10:15:55 | 000,000,000 | ---D | C] -- C:\Users\six\Documents\SelfMV
[2012.01.09 00:51:48 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{412C6784-EBE2-4544-ACC9-5FAD724D5391}
[2012.01.09 00:51:36 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{5655DFB6-40CB-43EF-8093-56213E9A47B2}
[2012.01.08 12:51:23 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{F03BB730-05CE-45CA-A2FB-A8C5FB89070E}
[2012.01.08 12:51:12 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{C6CEB15C-97DA-40FD-A3D2-EBC6CE05182D}
[2012.01.08 00:50:57 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{334519C8-6204-4106-9A98-35189B4E4B92}
[2012.01.08 00:50:45 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{4FF445F3-A0DC-4652-8B1E-2A71395F3666}
[2012.01.07 09:10:23 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{4099E1AC-51B2-4699-B9E9-3A74C89BD4AE}
[2012.01.07 09:10:11 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{D7A3DADD-3134-436A-B310-637B1780EA77}
[2012.01.06 21:09:58 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{5D7761D8-623D-404A-BAFF-7FE609D69D17}
[2012.01.06 21:09:46 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{51098CBD-296F-4C7B-961C-3AB61F182C2B}
[2012.01.06 08:59:33 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{77CC5BDC-B012-4311-8BD5-D10C95DAFB0D}
[2012.01.06 08:59:21 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{E1C39317-91DC-4612-ADF5-5E63F889D89E}
[2012.01.06 04:57:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LSoft Technologies
[2012.01.06 04:57:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Active@ ISO Burner
[2012.01.06 04:12:45 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Avira
[2012.01.06 04:08:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.01.06 04:08:22 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.01.06 04:08:21 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.01.06 04:08:21 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.01.06 04:08:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.01.06 04:08:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.01.06 03:42:01 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\ElevatedDiagnostics
[2012.01.06 03:04:04 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Malwarebytes
[2012.01.06 03:04:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.01.06 03:03:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.06 03:03:58 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.01.06 03:03:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.01.05 20:58:55 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{E013078E-3D28-491D-A2F8-E3F74A969EA7}
[2012.01.05 20:58:43 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{3F118DC2-4C64-45A1-B384-761EF1CC5F78}
[2012.01.05 06:47:52 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{988EDF95-D921-4426-8C87-68AA089EE3E8}
[2012.01.05 06:47:41 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{F52A7F28-2824-473F-B08D-09C7C0D1F50C}
[2012.01.05 05:57:30 | 000,000,000 | ---D | C] -- C:\Users\six\Desktop\usb win7
[2012.01.05 02:36:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Windows AIK
[2012.01.05 02:36:43 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Imaging
[2012.01.04 22:23:33 | 000,000,000 | ---D | C] -- C:\Program Files\Windows AIK
[2012.01.04 00:31:16 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Oblivion
[2012.01.03 08:10:32 | 000,000,000 | ---D | C] -- C:\Users\six\Documents\cifi
[2012.01.03 07:49:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAXON
[2012.01.03 07:29:25 | 000,000,000 | ---D | C] -- C:\Program Files\MAXON
[2012.01.03 07:23:54 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\MAXON
[2012.01.03 05:53:43 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{A0DCB215-DE40-4BD4-9A6B-71239C170109}
[2012.01.03 05:53:30 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{7A94A206-C879-4840-ADC2-6D0883812916}
[2012.01.02 17:53:17 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{1B0D1DA8-D080-4D55-8008-ACBEA69594A4}
[2012.01.02 17:53:05 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{C0250990-ABBF-471B-A43C-D6107885D807}
[2012.01.01 21:41:28 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{324C93CA-7D28-41E6-A524-A7877C4AC252}
[2012.01.01 21:41:15 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{E4232BBC-A87B-441E-893D-30FA7C1EC5AC}
[2012.01.01 09:41:00 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{C59151C7-503F-4BB2-BF02-6EFEC02EF371}
[2012.01.01 09:40:47 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{DF55AA55-B14F-4B33-BF45-B1A570EC6CED}
[2011.12.31 21:40:32 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{F1CC9032-624A-4DED-8089-2A97622F17AA}
[2011.12.31 21:40:20 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{B3CB0D27-4B94-4ADC-8332-A687D9CC143E}
[2011.12.31 09:40:06 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{580725BB-214A-4956-BD07-AD7866650CF3}
[2011.12.31 09:39:54 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{5F2023B6-D7A7-4496-B219-16F37453E258}
[2011.12.30 21:39:40 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{9A1DBE5E-02EA-46C5-ACBB-90397C96C9F7}
[2011.12.30 21:39:29 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{CCE71E78-B5D1-4B65-9D61-CD092BA9B5BD}
[2011.12.29 23:53:43 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011.12.29 23:53:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Farm Frenzy 2
[2011.12.29 23:52:39 | 000,000,000 | ---D | C] -- C:\crap
[2011.12.29 23:51:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Big Fish Games
[2011.12.29 23:51:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\bfgclient
[2011.12.29 23:50:32 | 000,000,000 | ---D | C] -- C:\BigFishGamesCache
[2011.12.29 23:33:24 | 000,000,000 | ---D | C] -- C:\ProgramData\FarmFrenzy2
[2011.12.29 23:33:08 | 000,000,000 | ---D | C] -- C:\Windows\Farm Frenzy 2
[2011.12.29 06:53:33 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Mobile Master
[2011.12.28 20:45:17 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{D5D56D81-DFF6-4506-9CB8-DE648F1887D4}
[2011.12.28 20:44:54 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{13AB096C-EC72-4FD4-B0AC-5A00140887BC}
[2011.12.28 08:44:39 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{03C5AE14-56E5-404A-BA9D-B53E68BB9951}
[2011.12.28 08:44:15 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{66DE7025-436C-4CF1-818C-88F5E3398920}
[2011.12.27 20:44:01 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{74122EC3-2B18-420E-975B-202E9F144535}
[2011.12.27 20:43:37 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{7E623ACE-E362-46CA-BFF7-A52BAA3275DC}
[2011.12.27 12:33:14 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\thumbs
[2011.12.27 08:43:23 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{B5754E85-E4A0-47BF-8C4A-B1C21CBB42F1}
[2011.12.27 08:43:00 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{D1815EAA-7031-4933-B56E-6C8CD9684FD4}
[2011.12.26 20:42:46 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{5182BD70-E1C9-42F3-A79F-92514A5D9CA7}
[2011.12.26 20:42:32 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{0895F221-928B-4F04-9559-365AAE170E47}
[2011.12.26 02:43:11 | 000,139,264 | ---- | C] (Neoact) -- C:\Windows\NeoUninstall.exe
[2011.12.26 02:43:11 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Carom3D
[2011.12.26 02:43:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Carom3D
[2011.12.26 02:42:36 | 000,000,000 | ---D | C] -- C:\Users\six\Desktop\Carom3D V5.25
[2011.12.26 00:27:57 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{AD78D0DD-9246-4D62-B359-BF11DC277407}
[2011.12.26 00:27:22 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{07B203DB-8D69-4925-A91D-FD4112115A0A}
[2011.12.25 23:27:49 | 000,000,000 | ---D | C] -- C:\Users\six\Documents\ANNO 1404 Venedig
[2011.12.25 22:58:21 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Ubisoft
[2011.12.25 22:57:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield
[2011.12.25 12:27:10 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{68A488AD-6CBF-4A46-8B5F-9BA631CA2D13}
[2011.12.25 12:26:58 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{F3720A97-B9EF-48E1-B450-19276D95EC88}
[2011.12.25 00:26:43 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{A7A63929-80AE-4DCA-8180-B735AF6D23CF}
[2011.12.25 00:26:31 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{1EB5096E-E896-4EAB-93AC-C823773499B5}
[2011.12.24 22:21:41 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Ubisoft Game Launcher
[2011.12.24 22:19:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2011.12.24 12:26:19 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{B0D865C8-B2CF-4F7A-8D1E-1ADD1B90CCCD}
[2011.12.24 12:26:08 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{40C4814D-03C9-4D50-965A-B614EC059815}
[2011.12.24 00:25:54 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{0F846E2B-C0D3-4F29-B27D-678ABA6AFB71}
[2011.12.24 00:25:42 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{D6D598D8-3BAD-4706-8A61-2313FB97CA63}
[2011.12.23 12:25:29 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{442C05D9-7781-4B39-89B8-1ACCEA55433C}
[2011.12.23 12:25:17 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{871A0E30-8445-44F8-A049-25002DCEEAF5}
[2011.12.23 11:00:31 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2011.12.23 09:05:06 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Google
[2011.12.23 00:25:04 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{D736D7D7-23EC-473B-B99E-104E4580A9C7}
[2011.12.23 00:24:53 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{224D81F4-D1AE-4E8F-BA04-29D42E11BD84}
[2011.12.22 17:37:25 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\2DBoy
[2011.12.22 17:37:25 | 000,000,000 | ---D | C] -- C:\ProgramData\2DBoy
[2011.12.22 12:24:39 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{09D244C1-3D85-4362-BBF2-CF4074A36911}
[2011.12.22 12:24:27 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{777D398C-24A5-4A8C-B11E-64EB6060A69D}
[2011.12.22 00:24:13 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{359C714E-F6F5-480C-9105-39C43E74BDCE}
[2011.12.22 00:24:01 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{E6C1A897-E5A8-4581-BF75-D471230D12B3}
[2011.12.21 15:28:30 | 000,000,000 | ---D | C] -- C:\Windows\WindowsMobile
[2011.12.21 15:21:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2011.12.21 15:13:48 | 000,156,584 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btwdndis.sys
[2011.12.21 15:13:48 | 000,135,208 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btaudio.sys
[2011.12.21 15:13:48 | 000,071,592 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btwhid.sys
[2011.12.21 15:13:48 | 000,069,672 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btwsecfl.sys
[2011.12.21 15:13:48 | 000,056,104 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btwusb.sys
[2011.12.21 15:13:48 | 000,044,200 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btport.sys
[2011.12.21 15:13:48 | 000,043,944 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btwmodem.sys
[2011.12.21 15:09:55 | 001,283,368 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\drivers\btkrnl.sys
[2011.12.21 15:09:55 | 000,114,176 | ---- | C] (Broadcom Corporation.) -- C:\Windows\SysNative\btw_ci.dll
[2011.12.21 15:09:48 | 000,000,000 | ---D | C] -- C:\Program Files\ThinkPad
[2011.12.21 14:54:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Mobile Master
[2011.12.21 14:54:27 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Mobile Master
[2011.12.21 14:54:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Jumping Bytes
[2011.12.21 14:53:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Master
[2011.12.21 14:53:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mobile Master
[2011.12.21 14:53:12 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Jumping Bytes
[2011.12.21 14:08:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blue Manager Suite
[2011.12.21 14:08:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Blue Manager Suite
[2011.12.21 12:23:34 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{739FC547-7982-4A4A-9F7B-2DB3B3263C64}
[2011.12.21 12:23:11 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{8C81A53E-1B16-44AF-916C-EF9CE13B8ECB}
[2011.12.20 23:24:58 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{050177CE-CEC1-44FB-BAEA-889BB45280EF}
[2011.12.20 23:24:35 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{23A2D97F-FCA4-439D-8473-3E67F2AEF5F2}
[2011.12.20 11:24:20 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{8189613E-F019-43A8-8864-C04BD52A2F41}
[2011.12.20 11:23:57 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{68503735-0CC4-45BF-9723-3D52B55468B9}
[2011.12.19 23:23:44 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{4111FCF5-2B5A-4D4D-B8E1-777D01E77FC7}
[2011.12.19 23:23:21 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{3D187A94-A296-48CA-A6CA-D9FD382BE387}
[2011.12.19 11:23:08 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{411E426D-3686-4226-B22E-D5D2740E1146}
[2011.12.19 11:22:46 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{B623457F-598C-48DE-B140-1F27ABC29EEE}
[2011.12.18 23:22:31 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{74ADE434-2348-447B-AA1C-041138E295D6}
[2011.12.18 23:22:08 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{036985BE-3AC0-4BFD-9A9E-4AFF64FDA132}
[2011.12.18 13:40:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.18 13:40:56 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.18 11:21:54 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{28E8587B-3747-4141-BB4C-170EE532188B}
[2011.12.18 11:21:32 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{A87674BB-F31D-4BAF-95A8-DF88DDD998DD}
[2011.12.17 23:21:19 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{0BE1A226-101E-44E9-9CFC-A7D7A7CBBAEA}
[2011.12.17 23:20:44 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{28918409-E426-4650-B514-9ECCCF6FC4C2}
[2011.12.17 15:21:53 | 000,000,000 | ---D | C] -- C:\Users\six\.android
[2011.12.17 15:21:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Android SDK Tools
[2011.12.17 15:21:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Android
[2011.12.17 15:19:22 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle
[2011.12.17 15:18:16 | 000,750,488 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\npdeployJava1.dll
[2011.12.17 15:18:16 | 000,263,560 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2011.12.17 15:18:16 | 000,188,808 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2011.12.17 11:20:31 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{F712DDA7-A472-48D7-BE97-1E89AD536841}
[2011.12.17 11:20:20 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{6F618093-15F7-4618-8F0E-82A4B423AA0F}
[2011.12.17 01:13:24 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\DDMSettings
[2011.12.16 23:20:06 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{802F67DA-FC5D-4B59-82E5-B1E4C0B0EBC8}
[2011.12.16 23:19:55 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{14E519D0-D21A-4EF6-B537-6E2F91C76BAE}
[2011.12.16 17:44:18 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Unified Remote
[2011.12.16 17:43:22 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unified Remote
[2011.12.16 17:43:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Unified Remote
[2011.12.16 14:12:42 | 000,000,000 | ---D | C] -- C:\Users\six\Desktop\root
[2011.12.16 11:19:41 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{FD56B2E4-817E-46B7-BC66-13C2072E9D0B}
[2011.12.16 11:19:29 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{83F11DDC-C872-4270-BB5F-81FC41A5106F}
[2011.12.15 23:19:16 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{7523FEB2-FF3C-4A90-A16F-62947BFA5180}
[2011.12.15 23:19:05 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{F9A79BE0-E9AB-49BC-AF59-3900CD549953}
[2011.12.15 11:18:51 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{22AD479A-457A-4204-A7D8-BE76C79E6E22}
[2011.12.15 11:18:40 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{D68DD594-3288-483B-A969-6B55DB767B0E}
[2011.12.15 03:01:13 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.12.15 03:01:13 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.12.15 03:01:12 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.12.15 03:01:12 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.12.15 03:01:12 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.12.15 03:01:12 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.12.15 03:01:11 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2011.12.15 03:01:11 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011.12.15 03:01:10 | 002,309,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2011.12.15 03:01:10 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2011.12.15 03:01:10 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011.12.15 02:21:45 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.15 02:21:42 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.15 02:21:41 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.14 22:10:55 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\PokerStars
[2011.12.14 22:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars
[2011.12.14 22:05:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PokerStars
[2011.12.14 21:11:30 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{405E1723-F2C0-4402-AE72-00634F9980C9}
[2011.12.14 21:11:18 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{79735D04-428C-4335-A05B-573DFE920156}
[2011.12.13 21:34:13 | 000,000,000 | ---D | C] -- C:\Temp
[2011.12.13 21:31:27 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Samsung
[2011.12.13 21:31:16 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Samsung
[2011.12.13 21:31:15 | 000,000,000 | ---D | C] -- C:\Users\six\Documents\samsung
[2011.12.13 21:28:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2011.12.13 21:28:37 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2011.12.13 21:28:06 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2011.12.13 21:28:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MarkAny
[2011.12.13 21:27:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2011.12.13 21:27:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung
[2011.12.13 21:26:02 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Downloaded Installations
[2011.12.13 11:42:29 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{953B8E7E-6E94-47DD-86BE-A71FDCDA943E}
[2011.12.13 11:42:18 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{438BECF3-8F41-4C9E-ABF0-981A828A8C63}
[2011.12.12 23:42:03 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{A6E119AA-FBCB-45FB-9DD7-EB3991EBCC50}
[2011.12.12 23:41:51 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{04C6E00B-B52F-48E3-944D-C1C8AE22A21A}
[2011.12.12 18:35:17 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse
[2011.12.12 18:34:14 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Apps
[2011.12.12 18:34:12 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\Deployment
[2011.12.12 11:41:37 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{6360CA0E-68D0-4D1C-9292-9CE029F23C80}
[2011.12.12 11:41:25 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{361C6648-88E8-45A8-8A56-7FCC347D9825}
[2011.12.11 23:41:11 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{6991EF83-53EE-4AF2-BEB8-5BB764B72D28}
[2011.12.11 23:40:59 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{7EB3B5EC-AD7B-41D6-BF17-7B0D67F285E9}
[2011.12.11 15:34:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2011
[2011.12.11 11:40:46 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{D7C3B76F-1C41-4AC0-8058-C90D51EE8614}
[2011.12.11 11:40:35 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{CCB017A2-47A8-46AB-9DB2-11F74B9A6CDC}
[2011.12.10 23:40:21 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{ACB516A2-D245-4248-91C9-1BF1A278CB94}
[2011.12.10 23:40:09 | 000,000,000 | ---D | C] -- C:\Users\six\AppData\Local\{357E5FA0-725F-4927-ACC4-F61D114AF727}
[2011.12.10 14:36:20 | 000,000,000 | ---D | C] -- C:\Users\six\Desktop\apps
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2012.01.09 12:10:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059813294-1679485015-2318070993-1000UA.job
[2012.01.09 11:44:55 | 000,002,965 | ---- | M] () -- C:\Users\six\Desktop\HiJackThis.lnk
[2012.01.09 11:19:33 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.09 11:19:33 | 000,017,136 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.09 11:14:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.09 11:13:49 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.09 11:08:27 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.01.09 10:35:29 | 001,590,298 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.01.09 10:35:29 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.01.09 10:35:29 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.01.09 10:35:29 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.01.09 10:35:29 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.01.09 10:35:24 | 001,590,298 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.01.09 09:10:00 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059813294-1679485015-2318070993-1000Core.job
[2012.01.06 04:47:47 | 000,013,201 | ---- | M] () -- C:\Users\six\Documents\ticket eset.odt
[2012.01.06 03:04:00 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.04 09:07:39 | 000,007,596 | ---- | M] () -- C:\Users\six\AppData\Local\Resmon.ResmonCfg
[2012.01.04 08:52:14 | 000,001,011 | ---- | M] () -- C:\Users\six\Desktop\CINEMA 4D 64 Bit.lnk
[2012.01.04 00:48:48 | 000,000,023 | ---- | M] () -- C:\Windows\BlendSettings.ini
[2011.12.29 23:33:13 | 000,000,722 | ---- | M] () -- C:\Users\six\Desktop\Farm Frenzy 2.lnk
[2011.12.29 06:52:51 | 004,858,128 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.28 22:56:34 | 000,000,967 | ---- | M] () -- C:\Users\six\Desktop\Addon.exe - Verknüpfung.lnk
[2011.12.27 12:51:37 | 000,000,906 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
[2011.12.26 02:43:11 | 000,000,624 | ---- | M] () -- C:\Users\six\Desktop\Carom3D.lnk
[2011.12.26 02:43:10 | 000,000,026 | ---- | M] () -- C:\Windows\NeoSetup.INI
[2011.12.25 23:21:49 | 000,001,333 | ---- | M] () -- C:\Users\six\AppData\Local\bmarchive.bms
[2011.12.25 22:28:27 | 000,314,016 | ---- | M] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2011.12.25 22:28:26 | 000,043,680 | ---- | M] () -- C:\Windows\SysNative\drivers\lirsgt.sys
[2011.12.23 22:41:26 | 000,028,246 | ---- | M] () -- C:\Users\six\Documents\hey weihnachten.odt
[2011.12.21 14:54:07 | 000,001,088 | ---- | M] () -- C:\Users\Public\Desktop\Mobile Master.lnk
[2011.12.21 14:46:05 | 000,001,829 | ---- | M] () -- C:\Users\six\AppData\Local\MECARD_N_015143100121_TE.png
[2011.12.21 14:21:51 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_btiaspp_01005.Wdf
[2011.12.21 14:21:19 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_btprot_01005.Wdf
[2011.12.21 14:10:46 | 000,001,132 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Blue Manager Suite.lnk
[2011.12.21 14:08:45 | 000,001,814 | ---- | M] () -- C:\Users\Public\Desktop\Launch Blue Manager Suite.lnk
[2011.12.20 11:25:24 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.12.18 13:40:57 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.17 15:18:08 | 000,188,808 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2011.12.16 17:43:22 | 000,001,111 | ---- | M] () -- C:\Users\six\Desktop\Unified Remote.lnk
[2011.12.15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.12.15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.12.15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.12.15 07:20:12 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\Access.dat
[2011.12.15 03:03:38 | 000,000,129 | ---- | M] () -- C:\Windows\SysNative\MRT.INI
[2011.12.14 22:06:08 | 000,001,065 | ---- | M] () -- C:\Users\Public\Desktop\PokerStars.lnk
[2011.12.13 21:32:44 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_WinUSB_01007.Wdf
[2011.12.11 15:34:40 | 000,000,852 | ---- | M] () -- C:\Users\six\Desktop\Landwirtschafts Simulator 2011 .lnk
[2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2012.01.09 11:44:55 | 000,002,965 | ---- | C] () -- C:\Users\six\Desktop\HiJackThis.lnk
[2012.01.09 10:59:14 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.01.09 10:59:14 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.01.09 10:59:14 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.01.09 10:59:14 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.01.09 10:59:14 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.01.06 04:47:45 | 000,013,201 | ---- | C] () -- C:\Users\six\Documents\ticket eset.odt
[2012.01.06 03:04:00 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.04 08:52:14 | 000,001,011 | ---- | C] () -- C:\Users\six\Desktop\CINEMA 4D 64 Bit.lnk
[2012.01.04 00:34:44 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2011.12.29 23:52:03 | 000,001,931 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Manager.lnk
[2011.12.29 23:52:03 | 000,001,248 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Weitere fantastische Spiele.lnk
[2011.12.29 23:33:13 | 000,000,722 | ---- | C] () -- C:\Users\six\Desktop\Farm Frenzy 2.lnk
[2011.12.29 23:31:38 | 036,467,550 | ---- | C] () -- C:\Users\six\Desktop\Farm Frenzy 2.exe
[2011.12.29 06:52:21 | 004,858,128 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.28 22:56:34 | 000,000,967 | ---- | C] () -- C:\Users\six\Desktop\Addon.exe - Verknüpfung.lnk
[2011.12.27 12:52:16 | 000,001,475 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bluetooth-Umgebung.lnk
[2011.12.26 02:43:11 | 000,000,624 | ---- | C] () -- C:\Users\six\Desktop\Carom3D.lnk
[2011.12.26 02:43:10 | 000,000,026 | ---- | C] () -- C:\Windows\NeoSetup.INI
[2011.12.25 22:28:27 | 000,314,016 | ---- | C] () -- C:\Windows\SysNative\drivers\atksgt.sys
[2011.12.25 22:28:26 | 000,043,680 | ---- | C] () -- C:\Windows\SysNative\drivers\lirsgt.sys
[2011.12.23 22:41:24 | 000,028,246 | ---- | C] () -- C:\Users\six\Documents\hey weihnachten.odt
[2011.12.23 09:05:09 | 000,001,112 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059813294-1679485015-2318070993-1000UA.job
[2011.12.23 09:05:07 | 000,001,060 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2059813294-1679485015-2318070993-1000Core.job
[2011.12.21 15:30:32 | 000,002,419 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Mobile Device Center.lnk
[2011.12.21 15:09:50 | 000,000,906 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
[2011.12.21 14:54:07 | 000,001,088 | ---- | C] () -- C:\Users\Public\Desktop\Mobile Master.lnk
[2011.12.21 14:45:23 | 000,001,829 | ---- | C] () -- C:\Users\six\AppData\Local\MECARD_N_015143100121_TE.png
[2011.12.21 14:23:39 | 000,001,132 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Blue Manager Suite.lnk
[2011.12.21 14:21:51 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_btiaspp_01005.Wdf
[2011.12.21 14:21:19 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_btprot_01005.Wdf
[2011.12.21 14:08:45 | 000,001,814 | ---- | C] () -- C:\Users\Public\Desktop\Launch Blue Manager Suite.lnk
[2011.12.18 13:40:57 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.16 17:43:22 | 000,001,111 | ---- | C] () -- C:\Users\six\Desktop\Unified Remote.lnk
[2011.12.14 22:06:08 | 000,001,065 | ---- | C] () -- C:\Users\Public\Desktop\PokerStars.lnk
[2011.12.13 21:32:44 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_WinUSB_01007.Wdf
[2011.12.11 15:34:40 | 000,000,852 | ---- | C] () -- C:\Users\six\Desktop\Landwirtschafts Simulator 2011 .lnk
[2011.12.07 09:06:58 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.12.03 14:38:38 | 000,000,132 | ---- | C] () -- C:\Users\six\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011.11.30 14:44:56 | 000,004,608 | ---- | C] () -- C:\Users\six\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.29 16:38:18 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.11.29 16:38:12 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.11.29 16:38:12 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.11.29 16:38:12 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.11.29 16:38:12 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.11.21 01:35:05 | 000,001,456 | ---- | C] () -- C:\Users\six\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2011.11.08 15:34:07 | 000,007,596 | ---- | C] () -- C:\Users\six\AppData\Local\Resmon.ResmonCfg
[2011.11.08 15:09:38 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2011.11.05 01:58:15 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.11.05 01:46:53 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.11.05 01:46:53 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.10.26 02:38:38 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.10.26 02:38:38 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.10.25 21:21:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.14 11:47:40 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2008.08.18 18:44:34 | 002,854,912 | ---- | C] () -- C:\Windows\SysWow64\btwicons.dll
[2008.05.09 16:08:32 | 000,001,333 | ---- | C] () -- C:\Users\six\AppData\Local\bmarchive.bms
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2012.01.01 18:45:17 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\.minecraft
[2011.11.14 01:46:58 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Babylon
[2011.11.12 21:30:45 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\CasaPortale.de
[2011.12.26 17:21:18 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\DAEMON Tools Lite
[2011.12.18 17:30:49 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\DVDVideoSoft
[2011.12.03 15:09:10 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.12.05 18:29:59 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\GMX
[2011.12.21 14:53:12 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Jumping Bytes
[2012.01.03 07:49:19 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\MAXON
[2012.01.05 11:03:10 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Mobile Master
[2011.12.06 12:12:22 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Mumble
[2011.11.30 13:10:04 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\OpenOffice.org
[2011.11.19 21:56:20 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\PACE Anti-Piracy
[2011.11.18 06:10:28 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\poclbm
[2011.11.27 13:32:41 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Polynomial
[2011.12.05 18:34:56 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\QIP
[2011.12.05 18:34:11 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\QipGuard
[2011.12.13 21:31:16 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Samsung
[2011.12.08 22:20:15 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\TeamViewer
[2011.11.05 18:12:36 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\ts3overlay
[2011.12.26 06:05:38 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Tunngle
[2011.12.25 22:59:37 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Ubisoft
[2011.12.16 17:44:22 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Unified Remote
[2011.11.19 21:56:38 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Unity
[2011.11.07 14:33:31 | 000,000,000 | ---D | M] -- C:\Users\six\AppData\Roaming\Windows Live Writer
[2009.07.14 06:08:49 | 000,014,238 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 1294 bytes -> C:\ProgramData\Microsoft:dYLfeDA3ze7QYXqzP1EPNcmWPz
@Alternate Data Stream - 1203 bytes -> C:\ProgramData\Microsoft:GbZ1bVRthEvyuGcnzo0TJW
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:8140CB50

< End of report >
EXTRAS.TXT

Code


OTL Extras logfile created on: 09.01.2012 12:14:33 - Run 2
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\six\Downloads\sicher
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,98 Gb Available Physical Memory | 49,56% Memory free
8,00 Gb Paging File | 5,67 Gb Available in Paging File | 70,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 12,83 Gb Free Space | 13,14% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 5,25 Gb Free Space | 1,13% Space Free | Partition Type: NTFS
Drive E: | 368,10 Gb Total Space | 1,64 Gb Free Space | 0,45% Space Free | Partition Type: NTFS
Drive F: | 268,28 Gb Total Space | 1,85 Gb Free Space | 0,69% Space Free | Partition Type: NTFS
Drive H: | 29,81 Gb Total Space | 0,38 Gb Free Space | 1,28% Space Free | Partition Type: NTFS
Drive I: | 1,53 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: SIXER | User Name: six | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== File Associations ==========[/color]
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[color=#E56717]========== Shell Spawning ==========[/color]
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[color=#E56717]========== Security Center Settings ==========[/color]
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[color=#E56717]========== System Restore Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[color=#E56717]========== Firewall Settings ==========[/color]
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[color=#E56717]========== Authorized Applications List ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{07E674CF-C77E-4915-A110-A7556F4AB118}" = ESET NOD32 Antivirus
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1111706F-666A-4037-7777-202648764D10}" = JavaFX 2.0.2 (64-bit)
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{2222706F-666A-4037-7777-202648764D10}" = JavaFX 2.0.2 SDK (64-bit)
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417002FF}" = Java(TM) 7 Update 2 (64-bit)
"{28B0F39B-C0C6-4CC5-902B-9BF20111804C}" = Blue Manager Suite
"{31E8F586-4EF7-4500-844D-BA8756474FF1}" = Windows Automated Installation Kit
"{3A8386F4-A9CC-4395-B9D2-C7E864260B51}" = Windows Mobile-Gerätecenter: Treiberupdate
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4BE9F0B8-FF3D-5CAA-9BF2-CB6F3DF75D3B}" = ccc-utility64
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{52FB2985-F3AD-DAA7-7645-4E38A5B96E17}" = AMD Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{64A3A4F4-B792-11D6-A78A-00B0D0170020}" = Java(TM) SE Development Kit 7 Update 2 (64-bit)
"{67303AC9-A9BA-E413-0001-AAC1C812947C}" = AMD Fuel
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{84814E6B-2581-46EC-926A-823BD1C670F6}" = ThinkPad Bluetooth with Enhanced Data Rate Software
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F809FFB5-6F9B-AFDE-6048-5D9E95A85505}" = AMD Drag and Drop Transcoding
"{FA54C4B1-98E3-AEFA-7254-C4038DC739AF}" = AMD Media Foundation Decoders
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"MAXON8C02D5E0" = CINEMA 4D 12.016
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{19A492A0-888F-44A0-9B21-D91700763F62}" = Catalyst Control Center - Branding
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1BF82343-8EE6-8B76-90CF-31059B9D1842}" = CCC Help English
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2E295B5B-1AD4-4d36-97C2-A316084722CF}" = Python 2.7.2
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F7F52F2-DFD5-4FE3-8D24-2B7CEB9980C8}_is1" = Der Herr der Ringe Der Krieg im Norden Version v1.0
"{5CF6EEE9-86B1-3DB6-A07C-8F6C079C39BA}" = Google Talk Plugin
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{70C3CC75-9E14-D215-8FAD-5ABEAE3125D9}" = AMD VISION Engine Control Center
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{75F509C3-5F01-48C1-ACB9-B9B38A952E6C}" = Unified Remote
"{7694E0B1-2332-448B-9235-929F84B41E3F}" = Active@ ISO Burner
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A6E16998-A241-438F-A916-5CD59B5506C0}_is1" = XWidget Ver1.23
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C496ED25-F3EC-0CBC-37DB-B31C6E6592C9}" = Application Profiles
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CEECECD5-A430-4451-8D62-7C4ACB30F93B}" = Mumble 1.2.4
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D927E738-8B89-4281-AE9B-CC3A279C286D}" = Mobile Master
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE042823-C359-4B87-B66B-308057E8B6AF}" = Camtasia Studio 7
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E9A1960E-7756-2299-C700-DC7CA6EDD6E4}" = Catalyst Control Center InstallProxy
"{E9D98510-A8B6-E39C-B8BA-BA9A511E040C}" = Catalyst Control Center Graphics Previews Common
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Android SDK Tools" = Android SDK Tools
"Avira AntiVir Desktop" = Avira Free Antivirus
"BFGC" = Big Fish Games: Game Manager
"BFG-Farm Frenzy 2" = Farm Frenzy 2
"Carom3D" = Carom3D
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Setup" = DivX-Setup
"Everything" = Everything 1.2.1.371
"Farm Frenzy 21.0" = Farm Frenzy 2
"FarmingSimulator2011DE_is1" = Landwirtschafts Simulator 2011
"Free Studio_is1" = Free Studio version 5.3.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.14.1206
"GMX MultiMessenger" = GMX MultiMessenger
"Hard Reset_is1" = Hard Reset
"HijackThis" = HijackThis 1.99.1
"InstallShield_{28B0F39B-C0C6-4CC5-902B-9BF20111804C}" = Blue Manager Suite
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800
"Mobile Master" = Mobile Master 7.9.10
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"OpenAL" = OpenAL
"PokerStars" = PokerStars
"PSPad editor_is1" = PSPad editor
"Saints Row The Third_is1" = Saints Row The Third
"Steam App 105600" = Terraria
"Steam App 113400" = APB Reloaded
"Steam App 15120" = Tom Clancy's Rainbow Six: Vegas 2
"Steam App 1520" = DEFCON
"Steam App 22330" = The Elder Scrolls IV: Oblivion 
"Steam App 22350" = Brink
"Steam App 2810" = X3: Reunion
"Steam App 2820" = X3: Terran Conflict
"Steam App 380" = Half-Life 2: Episode One
"Steam App 48000" = LIMBO
"Steam App 48180" = Tom Clancy's H.A.W.X. 2
"Steam App 67000" = The Polynomial
"TeamViewer 7" = TeamViewer 7
"Tunngle beta_is1" = Tunngle beta
"UltraISO_is1" = UltraISO Premium V9.52
"Unity" = Unity
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite" = Windows Live Essentials
 
[color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color]
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"Bitcoin" = Bitcoin
"QIP Infium" = QIP Infium 3.0.9044
"QipGuard" = QIP Internet Guardian
"UnityWebPlayer" = Unity Web Player
 
[color=#E56717]========== Last 10 Event Log Errors ==========[/color]
 
[ Application Events ]
Error - 27.12.2011 07:34:07 | Computer Name = sixer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,
 Zeitstempel: 0x4d672ee4  Name des fehlerhaften Moduls: MFC42.dll, Version: 6.6.8064.0,
 Zeitstempel: 0x4d79bfc5  Ausnahmecode: 0xc000041d  Fehleroffset: 0x000000000003e5c8
ID
 des fehlerhaften Prozesses: 0x35f0  Startzeit der fehlerhaften Anwendung: 0x01ccc34e52bbe993
Pfad
 der fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls:
 C:\Windows\system32\MFC42.dll  Berichtskennung: af3a43ff-307e-11e1-9c84-001966c34856
 
Error - 27.12.2011 07:39:38 | Computer Name = sixer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Kies.exe, Version: 1.0.0.304, Zeitstempel:
 0x4ed4a4d5  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc000041d  Fehleroffset: 0x75424d62  ID des fehlerhaften Prozesses:
 0x1010  Startzeit der fehlerhaften Anwendung: 0x01ccc48a96af6a84  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Samsung\Kies\Kies.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: 74e6c20f-307f-11e1-9c84-001966c34856
 
Error - 29.12.2011 01:37:50 | Computer Name = sixer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16421,
 Zeitstempel: 0x4d76255d  Name des fehlerhaften Moduls: atidxx32.dll, Version: 8.17.10.401,
 Zeitstempel: 0x4ea768a3  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00239acd  ID des fehlerhaften
 Prozesses: 0x191c  Startzeit der fehlerhaften Anwendung: 0x01ccc5d1558e38c4  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe  Pfad
 des fehlerhaften Moduls: C:\Windows\system32\atidxx32.dll  Berichtskennung: 3e94f74a-31df-11e1-9c84-001966c34856
 
Error - 29.12.2011 01:42:09 | Computer Name = sixer | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 2a34    Startzeit: 01ccc5ec8d2ee086    Endzeit: 32    Anwendungspfad:
 C:\Program Files (x86)\Internet Explorer\iexplore.exe    Berichts-ID:   
 
Error - 29.12.2011 01:49:45 | Computer Name = sixer | Source = Wininit | ID = 1015
Description = Ein kritischer Systemprozess C:\Windows\system32\lsm.exe ist fehlgeschlagen
 mit den Statuscode 1. Der Computer muss neu gestartet werden.
 
Error - 01.01.2012 11:09:57 | Computer Name = sixer | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 1158    Startzeit: 01ccc7e9455520cf    Endzeit: 2320    Anwendungspfad:
 C:\Program Files (x86)\Internet Explorer\iexplore.exe    Berichts-ID:   
 
Error - 01.01.2012 13:13:10 | Computer Name = sixer | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 1d6c    Startzeit: 01ccc8a79a8e7b77    Endzeit: 12    Anwendungspfad:
 C:\Program Files (x86)\Internet Explorer\iexplore.exe    Berichts-ID:   
 
Error - 03.01.2012 19:53:00 | Computer Name = sixer | Source = Application Hang | ID = 1002
Description = Programm 7zFM.exe, Version 9.20.0.0 kann nicht mehr unter Windows 
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 3d64    Startzeit:
 01ccca7290c636cc    Endzeit: 4    Anwendungspfad: C:\Program Files\7-Zip\7zFM.exe    Berichts-ID:
 0c401179-3666-11e1-8067-001966c34856  
 
Error - 04.01.2012 17:40:44 | Computer Name = sixer | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 9.0.1.4371 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 4b0c    Startzeit:
 01ccc8d205e4784b    Endzeit: 393    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 bd242cdf-371c-11e1-8067-001966c34856  
 
Error - 04.01.2012 17:41:47 | Computer Name = sixer | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
 Zeitstempel: 0x4ea76d02  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7c8f9  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000004e4b4
ID
 des fehlerhaften Prozesses: 0x60c  Startzeit der fehlerhaften Anwendung: 0x01ccc5ee11a93c36
Pfad
 der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: e6949c25-371c-11e1-8067-001966c34856
 
[ System Events ]
Error - 24.12.2011 20:09:22 | Computer Name = sixer | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 25.12.2011 19:15:00 | Computer Name = sixer | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 27.12.2011 07:32:47 | Computer Name = sixer | Source = Service Control Manager | ID = 7000
Description = Der Dienst "dgderdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%2
 
Error - 29.12.2011 01:48:40 | Computer Name = sixer | Source = Service Control Manager | ID = 7034
Description = Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 29.12.2011 01:50:28 | Computer Name = sixer | Source = Service Control Manager | ID = 7031
Description = Der Dienst "TeamViewer 7" wurde unerwartet beendet. Dies ist bereits
 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 2000 Millisekunden durchgeführt:
 Neustart des Diensts.
 
Error - 29.12.2011 01:52:35 | Computer Name = sixer | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?29.?12.?2011 um 06:50:10 unerwartet heruntergefahren.
 
Error - 29.12.2011 20:34:36 | Computer Name = sixer | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 02.01.2012 05:33:18 | Computer Name = sixer | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 02.01.2012 23:30:21 | Computer Name = sixer | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 04.01.2012 16:58:31 | Computer Name = sixer | Source = VDS Basic Provider | ID = 33554433
Description = 
 
 
< End of report >


COMBOFIX.TXT

Code


ComboFix 12-01-09.02 - six 09.01.2012  11:01:24.1.4 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.4095.2153 [GMT 1:00]
ausgeführt von:: c:\users\six\Downloads\sicher\test.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\six\AppData\Local\TempDIR
c:\users\six\AppData\Local\TempDIR\BetterInstaller.exe
c:\users\six\AppData\Roaming\Bitcoin
c:\users\six\AppData\Roaming\Bitcoin\.lock
c:\users\six\AppData\Roaming\Bitcoin\__db.001
c:\users\six\AppData\Roaming\Bitcoin\__db.002
c:\users\six\AppData\Roaming\Bitcoin\__db.003
c:\users\six\AppData\Roaming\Bitcoin\__db.004
c:\users\six\AppData\Roaming\Bitcoin\__db.005
c:\users\six\AppData\Roaming\Bitcoin\__db.006
c:\users\six\AppData\Roaming\Bitcoin\addr.dat
c:\users\six\AppData\Roaming\Bitcoin\bitcoin.conf
c:\users\six\AppData\Roaming\Bitcoin\blk0001.dat
c:\users\six\AppData\Roaming\Bitcoin\blkindex.dat
c:\users\six\AppData\Roaming\Bitcoin\database\log.0000000021
c:\users\six\AppData\Roaming\Bitcoin\database\log.0000000022
c:\users\six\AppData\Roaming\Bitcoin\database\log.0000000023
c:\users\six\AppData\Roaming\Bitcoin\db.log
c:\users\six\AppData\Roaming\Bitcoin\debug.log
c:\users\six\AppData\Roaming\Bitcoin\wallet.dat
c:\windows\system32\java.exe
c:\windows\SysWow64\muzapp.exe
c:\windows\SysWow64\system32
c:\windows\SysWow64\system32\3DAudio.ax
c:\windows\SysWow64\system32\avrt.dll
c:\windows\SysWow64\system32\cis-2.4.dll
c:\windows\SysWow64\system32\issacapi_bs-2.3.dll
c:\windows\SysWow64\system32\issacapi_pe-2.3.dll
c:\windows\SysWow64\system32\issacapi_se-2.3.dll
c:\windows\SysWow64\system32\MACXMLProto.dll
c:\windows\SysWow64\system32\MaDRM.dll
c:\windows\SysWow64\system32\MaJGUILib.dll
c:\windows\SysWow64\system32\MAMACExtract.dll
c:\windows\SysWow64\system32\MASetupCleaner.exe
c:\windows\SysWow64\system32\MaXMLProto.dll
c:\windows\SysWow64\system32\mfplat.dll
c:\windows\SysWow64\system32\MK_Lyric.dll
c:\windows\SysWow64\system32\MSCLib.dll
c:\windows\SysWow64\system32\MSFLib.dll
c:\windows\SysWow64\system32\MSLUR71.dll
c:\windows\SysWow64\system32\msvcp60.dll
c:\windows\SysWow64\system32\MTTELECHIP.dll
c:\windows\SysWow64\system32\MTXSYNCICON.dll
c:\windows\SysWow64\system32\muzaf1.dll
c:\windows\SysWow64\system32\muzapp.dll
c:\windows\SysWow64\system32\muzapp.exe
c:\windows\SysWow64\system32\muzdecode.ax
c:\windows\SysWow64\system32\muzeffect.ax
c:\windows\SysWow64\system32\muzmp4sp.ax
c:\windows\SysWow64\system32\muzmpgsp.ax
c:\windows\SysWow64\system32\muzoggsp.ax
c:\windows\SysWow64\system32\muzwmts.dll
c:\windows\SysWow64\system32\psapi.dll
H:\Setup.Exe
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_0
-------\Service_1
-------\Service_5
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-12-09 bis 2012-01-09  ))))))))))))))))))))))))))))))
.
.
2012-01-09 10:07 . 2012-01-09 10:07    --------    d-----w-    c:\users\Default\AppData\Local\temp
2012-01-07 00:10 . 2011-11-21 11:40    8822856    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{9A29344E-39E8-440A-AE2B-1A6AC360599A}\mpengine.dll
2012-01-06 03:57 . 2012-01-06 03:57    --------    d-----w-    c:\program files (x86)\LSoft Technologies
2012-01-06 03:12 . 2012-01-06 03:12    --------    d-----w-    c:\users\six\AppData\Roaming\Avira
2012-01-06 03:08 . 2011-12-15 14:00    27760    ----a-w-    c:\windows\system32\drivers\avkmgr.sys
2012-01-06 03:08 . 2011-12-15 13:59    97312    ----a-w-    c:\windows\system32\drivers\avgntflt.sys
2012-01-06 03:08 . 2011-12-15 13:59    130760    ----a-w-    c:\windows\system32\drivers\avipbb.sys
2012-01-06 03:08 . 2012-01-06 03:08    --------    d-----w-    c:\programdata\Avira
2012-01-06 03:08 . 2012-01-06 03:08    --------    d-----w-    c:\program files (x86)\Avira
2012-01-06 02:42 . 2012-01-06 02:42    --------    d-----w-    c:\users\six\AppData\Local\ElevatedDiagnostics
2012-01-06 02:04 . 2012-01-06 02:04    --------    d-----w-    c:\users\six\AppData\Roaming\Malwarebytes
2012-01-06 02:03 . 2012-01-06 02:03    --------    d-----w-    c:\programdata\Malwarebytes
2012-01-06 02:03 . 2011-12-10 14:24    23152    ----a-w-    c:\windows\system32\drivers\mbam.sys
2012-01-06 02:03 . 2012-01-06 02:04    --------    d-----w-    c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-05 01:36 . 2012-01-05 01:36    --------    d-----w-    c:\program files\Windows Imaging
2012-01-04 21:23 . 2012-01-05 01:36    --------    d-----w-    c:\program files\Windows AIK
2012-01-03 23:31 . 2012-01-03 23:31    --------    d-----w-    c:\users\six\AppData\Local\Oblivion
2012-01-03 06:29 . 2012-01-03 06:29    --------    d-----w-    c:\program files\MAXON
2012-01-03 06:23 . 2012-01-03 06:49    --------    d-----w-    c:\users\six\AppData\Roaming\MAXON
2012-01-01 15:25 . 2012-01-01 15:25    626688    ----a-w-    c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-01-01 15:25 . 2012-01-01 15:25    548864    ----a-w-    c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-01-01 15:25 . 2012-01-01 15:25    479232    ----a-w-    c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-01-01 15:25 . 2012-01-01 15:25    43992    ----a-w-    c:\program files (x86)\Mozilla Firefox\mozutils.dll
2011-12-29 22:52 . 2011-12-29 22:53    --------    d-----w-    C:\crap
2011-12-29 22:51 . 2011-12-29 22:51    --------    d-----w-    c:\programdata\Big Fish Games
2011-12-29 22:51 . 2011-12-29 22:52    --------    d-----w-    c:\program files (x86)\bfgclient
2011-12-29 22:50 . 2011-12-29 22:53    --------    d-----w-    C:\BigFishGamesCache
2011-12-29 22:33 . 2011-12-29 22:54    --------    d-----w-    c:\programdata\FarmFrenzy2
2011-12-29 22:33 . 2011-12-29 22:33    --------    d-----w-    c:\windows\Farm Frenzy 2
2011-12-29 05:53 . 2012-01-05 10:02    --------    d-----w-    c:\users\six\AppData\Local\Mobile Master
2011-12-27 11:33 . 2011-12-27 11:33    --------    d-----w-    c:\users\six\AppData\Local\thumbs
2011-12-26 01:43 . 2009-07-16 15:32    139264    ----a-w-    c:\windows\NeoUninstall.exe
2011-12-25 21:58 . 2011-12-25 21:59    --------    d-----w-    c:\users\six\AppData\Roaming\Ubisoft
2011-12-25 21:57 . 2011-12-25 21:57    --------    d-----w-    c:\programdata\Solidshield
2011-12-25 21:28 . 2011-12-25 21:28    314016    ----a-w-    c:\windows\system32\drivers\atksgt.sys
2011-12-25 21:28 . 2011-12-25 21:28    43680    ----a-w-    c:\windows\system32\drivers\lirsgt.sys
2011-12-24 21:21 . 2011-12-24 21:32    --------    d-----w-    c:\users\six\AppData\Local\Ubisoft Game Launcher
2011-12-24 21:19 . 2011-12-24 21:19    --------    d-----w-    c:\program files (x86)\Ubisoft
2011-12-23 08:05 . 2011-12-23 08:05    --------    d-----w-    c:\users\six\AppData\Local\Google
2011-12-22 16:37 . 2011-12-22 16:37    --------    d-----w-    c:\users\six\AppData\Local\2DBoy
2011-12-22 16:37 . 2011-12-22 16:37    --------    d-----w-    c:\programdata\2DBoy
2011-12-21 14:28 . 2011-12-21 14:30    --------    d-----w-    c:\windows\WindowsMobile
2011-12-21 14:13 . 2008-08-19 20:15    56104    ----a-w-    c:\windows\system32\drivers\btwusb.sys
2011-12-21 14:13 . 2008-07-24 16:37    156584    ----a-w-    c:\windows\system32\drivers\btwdndis.sys
2011-12-21 14:13 . 2008-06-11 13:14    69672    ----a-w-    c:\windows\system32\drivers\btwsecfl.sys
2011-12-21 14:13 . 2008-05-30 10:46    135208    ----a-w-    c:\windows\system32\drivers\btaudio.sys
2011-12-21 14:13 . 2008-03-10 17:18    71592    ----a-w-    c:\windows\system32\drivers\btwhid.sys
2011-12-21 14:13 . 2008-02-04 16:58    44200    ----a-w-    c:\windows\system32\drivers\btport.sys
2011-12-21 14:13 . 2008-02-04 16:58    43944    ----a-w-    c:\windows\system32\drivers\btwmodem.sys
2011-12-21 14:09 . 2008-08-19 20:15    1283368    ----a-w-    c:\windows\system32\drivers\btkrnl.sys
2011-12-21 14:09 . 2007-09-20 10:59    114176    ----a-w-    c:\windows\system32\btw_ci.dll
2011-12-21 14:09 . 2011-12-21 14:09    --------    d-----w-    c:\program files\ThinkPad
2011-12-21 13:54 . 2011-12-21 13:54    --------    d-----w-    c:\programdata\Mobile Master
2011-12-21 13:54 . 2012-01-05 10:03    --------    d-----w-    c:\users\six\AppData\Roaming\Mobile Master
2011-12-21 13:54 . 2011-12-21 13:54    --------    d-----w-    c:\program files (x86)\Common Files\Jumping Bytes
2011-12-21 13:53 . 2011-12-27 11:39    --------    d-----w-    c:\program files (x86)\Mobile Master
2011-12-21 13:53 . 2011-12-21 13:53    --------    d-----w-    c:\users\six\AppData\Roaming\Jumping Bytes
2011-12-21 13:08 . 2011-12-21 13:10    --------    d-----w-    c:\program files (x86)\Blue Manager Suite
2011-12-18 12:40 . 2011-12-18 12:40    --------    d-----w-    c:\program files\CCleaner
2011-12-17 14:21 . 2011-12-17 14:36    --------    d-----w-    c:\users\six\.android
2011-12-17 14:21 . 2011-12-17 14:21    --------    d-----w-    c:\program files (x86)\Android
2011-12-17 14:19 . 2011-12-17 14:20    --------    d-----w-    c:\program files\Oracle
2011-12-17 14:18 . 2011-11-08 18:40    750488    ----a-w-    c:\windows\system32\npdeployJava1.dll
2011-12-17 00:13 . 2011-12-17 00:13    --------    d-----w-    c:\users\six\AppData\Local\DDMSettings
2011-12-16 16:44 . 2011-12-16 16:44    --------    d-----w-    c:\users\six\AppData\Roaming\Unified Remote
2011-12-16 16:43 . 2011-12-16 16:43    --------    d-----w-    c:\program files (x86)\Unified Remote
2011-12-15 01:21 . 2011-10-26 05:21    43520    ----a-w-    c:\windows\system32\csrsrv.dll
2011-12-15 01:21 . 2011-11-24 04:52    3145216    ----a-w-    c:\windows\system32\win32k.sys
2011-12-15 01:21 . 2011-10-15 06:31    723456    ----a-w-    c:\windows\system32\EncDec.dll
2011-12-15 01:21 . 2011-10-15 05:38    534528    ----a-w-    c:\windows\SysWow64\EncDec.dll
2011-12-15 01:21 . 2011-11-05 05:32    2048    ----a-w-    c:\windows\system32\tzres.dll
2011-12-15 01:21 . 2011-11-05 04:26    2048    ----a-w-    c:\windows\SysWow64\tzres.dll
2011-12-14 21:10 . 2011-12-14 21:10    --------    d-----w-    c:\users\six\AppData\Local\PokerStars
2011-12-14 21:05 . 2011-12-14 21:10    --------    d-----w-    c:\program files (x86)\PokerStars
2011-12-13 20:34 . 2011-12-13 20:34    --------    d-----w-    C:\Temp
2011-12-13 20:31 . 2012-01-09 09:29    --------    d-----w-    c:\users\six\AppData\Local\Samsung
2011-12-13 20:31 . 2011-12-13 20:31    --------    d-----w-    c:\users\six\AppData\Roaming\Samsung
2011-12-13 20:28 . 2011-11-29 15:39    4659712    ----a-w-    c:\windows\SysWow64\Redemption.dll
2011-12-13 20:28 . 2011-12-13 20:28    --------    d-----w-    c:\program files (x86)\MarkAny
2011-12-13 20:28 . 2011-11-29 15:38    821824    ----a-w-    c:\windows\SysWow64\dgderapi.dll
2011-12-13 20:27 . 2011-12-13 20:29    --------    d-----w-    c:\program files (x86)\Samsung
2011-12-13 20:27 . 2011-12-13 20:29    --------    d-----w-    c:\programdata\Samsung
2011-12-13 20:26 . 2011-12-13 20:26    --------    d-----w-    c:\users\six\AppData\Local\Downloaded Installations
2011-12-12 17:34 . 2011-12-12 17:34    --------    d-----w-    c:\users\six\AppData\Local\Apps
2011-12-12 17:34 . 2011-12-23 08:05    --------    d-----w-    c:\users\six\AppData\Local\Deployment
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-20 10:25 . 2011-11-05 03:25    414368    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-29 15:38 . 2011-11-29 15:38    90112    ----a-w-    c:\windows\MAMCityDownload.ocx
2011-11-29 15:38 . 2011-11-29 15:38    325552    ----a-w-    c:\windows\MASetupCaller.dll
2011-11-29 15:38 . 2011-11-29 15:38    30568    ----a-w-    c:\windows\MusiccityDownload.exe
2011-11-29 15:38 . 2011-11-29 15:38    974848    ----a-w-    c:\windows\SysWow64\cis-2.4.dll
2011-11-29 15:38 . 2011-11-29 15:38    81920    ----a-w-    c:\windows\SysWow64\issacapi_bs-2.3.dll
2011-11-29 15:38 . 2011-11-29 15:38    65536    ----a-w-    c:\windows\SysWow64\issacapi_pe-2.3.dll
2011-11-29 15:38 . 2011-11-29 15:38    57344    ----a-w-    c:\windows\SysWow64\MTXSYNCICON.dll
2011-11-29 15:38 . 2011-11-29 15:38    57344    ----a-w-    c:\windows\SysWow64\MK_Lyric.dll
2011-11-29 15:38 . 2011-11-29 15:38    57344    ----a-w-    c:\windows\SysWow64\issacapi_se-2.3.dll
2011-11-29 15:38 . 2011-11-29 15:38    569344    ----a-w-    c:\windows\SysWow64\muzdecode.ax
2011-11-29 15:38 . 2011-11-29 15:38    491520    ----a-w-    c:\windows\SysWow64\muzapp.dll
2011-11-29 15:38 . 2011-11-29 15:38    49152    ----a-w-    c:\windows\SysWow64\MaJGUILib.dll
2011-11-29 15:38 . 2011-11-29 15:38    45056    ----a-w-    c:\windows\SysWow64\MaXMLProto.dll
2011-11-29 15:38 . 2011-11-29 15:38    45056    ----a-w-    c:\windows\SysWow64\MACXMLProto.dll
2011-11-29 15:38 . 2011-11-29 15:38    40960    ----a-w-    c:\windows\SysWow64\MTTELECHIP.dll
2011-11-29 15:38 . 2011-11-29 15:38    40960    ----a-w-    c:\windows\SysWow64\MAMACExtract.dll
2011-11-29 15:38 . 2011-11-29 15:38    352256    ----a-w-    c:\windows\SysWow64\MSLUR71.dll
2011-11-29 15:38 . 2011-11-29 15:38    258048    ----a-w-    c:\windows\SysWow64\muzoggsp.ax
2011-11-29 15:38 . 2011-11-29 15:38    245760    ----a-w-    c:\windows\SysWow64\MSCLib.dll
2011-11-29 15:38 . 2011-11-29 15:38    24576    ----a-w-    c:\windows\SysWow64\MASetupCleaner.exe
2011-11-29 15:38 . 2011-11-29 15:38    200704    ----a-w-    c:\windows\SysWow64\muzwmts.dll
2011-11-29 15:38 . 2011-11-29 15:38    155648    ----a-w-    c:\windows\SysWow64\MSFLib.dll
2011-11-29 15:38 . 2011-11-29 15:38    143360    ----a-w-    c:\windows\SysWow64\3DAudio.ax
2011-11-29 15:38 . 2011-11-29 15:38    135168    ----a-w-    c:\windows\SysWow64\muzaf1.dll
2011-11-29 15:38 . 2011-11-29 15:38    131072    ----a-w-    c:\windows\SysWow64\muzmpgsp.ax
2011-11-29 15:38 . 2011-11-29 15:38    122880    ----a-w-    c:\windows\SysWow64\muzeffect.ax
2011-11-29 15:38 . 2011-11-29 15:38    118784    ----a-w-    c:\windows\SysWow64\MaDRM.dll
2011-11-29 15:38 . 2011-11-29 15:38    110592    ----a-w-    c:\windows\SysWow64\muzmp4sp.ax
2011-11-24 21:23 . 2011-11-24 21:23    203320    ----a-w-    c:\windows\system32\drivers\ssudobex.sys
2011-11-24 21:23 . 2011-11-24 21:23    203320    ----a-w-    c:\windows\system32\drivers\ssudmdm.sys
2011-11-24 21:23 . 2011-11-24 21:23    98616    ----a-w-    c:\windows\system32\drivers\ssudbus.sys
2011-11-08 18:40 . 2011-11-05 15:30    660368    ----a-w-    c:\windows\system32\deployJava1.dll
2011-11-07 18:40 . 2011-11-07 18:40    472808    ----a-w-    c:\windows\SysWow64\deployJava1.dll
2011-11-07 13:20 . 2011-03-28 17:36    18328    ----a-w-    c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-05 20:12 . 2011-11-05 20:12    419840    ----a-w-    c:\windows\system32\wrap_oal.dll
2011-11-05 20:12 . 2011-11-05 20:12    413696    ----a-w-    c:\windows\SysWow64\wrap_oal.dll
2011-11-05 20:12 . 2011-11-05 20:12    133632    ----a-w-    c:\windows\system32\OpenAL32.dll
2011-11-05 20:12 . 2011-11-05 20:12    110592    ----a-w-    c:\windows\SysWow64\OpenAL32.dll
2011-11-05 04:02 . 2009-07-14 02:36    152576    ----a-w-    c:\windows\SysWow64\msclmd.dll
2011-11-05 04:02 . 2009-07-14 02:36    175616    ----a-w-    c:\windows\system32\msclmd.dll
2011-11-05 02:22 . 2011-11-05 02:22    86528    ----a-w-    c:\windows\SysWow64\iesysprep.dll
2011-11-05 02:22 . 2011-11-05 02:22    76800    ----a-w-    c:\windows\SysWow64\SetIEInstalledDate.exe
2011-11-05 02:22 . 2011-11-05 02:22    74752    ----a-w-    c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-11-05 02:22 . 2011-11-05 02:22    74752    ----a-w-    c:\windows\SysWow64\iesetup.dll
2011-11-05 02:22 . 2011-11-05 02:22    63488    ----a-w-    c:\windows\SysWow64\tdc.ocx
2011-11-05 02:22 . 2011-11-05 02:22    48640    ----a-w-    c:\windows\SysWow64\mshtmler.dll
2011-11-05 02:22 . 2011-11-05 02:22    420864    ----a-w-    c:\windows\SysWow64\vbscript.dll
2011-11-05 02:22 . 2011-11-05 02:22    367104    ----a-w-    c:\windows\SysWow64\html.iec
2011-11-05 02:22 . 2011-11-05 02:22    35840    ----a-w-    c:\windows\SysWow64\imgutil.dll
2011-11-05 02:22 . 2011-11-05 02:22    23552    ----a-w-    c:\windows\SysWow64\licmgr10.dll
2011-11-05 02:22 . 2011-11-05 02:22    161792    ----a-w-    c:\windows\SysWow64\msls31.dll
2011-11-05 02:22 . 2011-11-05 02:22    152064    ----a-w-    c:\windows\SysWow64\wextract.exe
2011-11-05 02:22 . 2011-11-05 02:22    150528    ----a-w-    c:\windows\SysWow64\iexpress.exe
2011-11-05 02:22 . 2011-11-05 02:22    142848    ----a-w-    c:\windows\SysWow64\ieUnatt.exe
2011-11-05 02:22 . 2011-11-05 02:22    11776    ----a-w-    c:\windows\SysWow64\mshta.exe
2011-11-05 02:22 . 2011-11-05 02:22    110592    ----a-w-    c:\windows\SysWow64\IEAdvpack.dll
2011-11-05 02:22 . 2011-11-05 02:22    101888    ----a-w-    c:\windows\SysWow64\admparse.dll
2011-11-05 02:22 . 2011-11-05 02:22    91648    ----a-w-    c:\windows\system32\SetIEInstalledDate.exe
2011-11-05 02:22 . 2011-11-05 02:22    89088    ----a-w-    c:\windows\system32\RegisterIEPKEYs.exe
2011-11-05 02:22 . 2011-11-05 02:22    85504    ----a-w-    c:\windows\system32\iesetup.dll
2011-11-05 02:22 . 2011-11-05 02:22    76800    ----a-w-    c:\windows\system32\tdc.ocx
2011-11-05 02:22 . 2011-11-05 02:22    603648    ----a-w-    c:\windows\system32\vbscript.dll
2011-11-05 02:22 . 2011-11-05 02:22    49664    ----a-w-    c:\windows\system32\imgutil.dll
2011-11-05 02:22 . 2011-11-05 02:22    48640    ----a-w-    c:\windows\system32\mshtmler.dll
2011-11-05 02:22 . 2011-11-05 02:22    448512    ----a-w-    c:\windows\system32\html.iec
2011-11-05 02:22 . 2011-11-05 02:22    30720    ----a-w-    c:\windows\system32\licmgr10.dll
2011-11-05 02:22 . 2011-11-05 02:22    222208    ----a-w-    c:\windows\system32\msls31.dll
2011-11-05 02:22 . 2011-11-05 02:22    173056    ----a-w-    c:\windows\system32\ieUnatt.exe
2011-11-05 02:22 . 2011-11-05 02:22    165888    ----a-w-    c:\windows\system32\iexpress.exe
2011-11-05 02:22 . 2011-11-05 02:22    160256    ----a-w-    c:\windows\system32\wextract.exe
2011-11-05 02:22 . 2011-11-05 02:22    135168    ----a-w-    c:\windows\system32\IEAdvpack.dll
2011-11-05 02:22 . 2011-11-05 02:22    12288    ----a-w-    c:\windows\system32\mshta.exe
2011-11-05 02:22 . 2011-11-05 02:22    114176    ----a-w-    c:\windows\system32\admparse.dll
2011-11-05 02:22 . 2011-11-05 02:22    111616    ----a-w-    c:\windows\system32\iesysprep.dll
2011-11-05 00:45 . 2009-06-28 23:36    28704    ----a-w-    c:\windows\system32\drivers\nvsmu.sys
2011-11-05 00:45 . 2009-06-26 15:15    167936    ----a-w-    c:\windows\system32\NVCOSMU.DLL
2011-11-05 00:45 . 2009-06-26 15:15    539168    ----a-w-    c:\windows\system32\nvusmu.exe
2011-11-05 00:44 . 2011-11-05 00:45    704000    ----a-w-    c:\windows\system32\cohelper.dll
2011-11-05 00:44 . 2009-07-01 11:20    339744    ----a-w-    c:\windows\system32\drivers\nvmf6264.sys
2011-11-05 00:44 . 2009-07-01 10:55    898560    ----a-w-    c:\windows\system32\fdco1.dll
2011-11-05 00:44 . 2009-07-01 06:00    845736    ----a-w-    c:\windows\system32\eDPInst.exe
2011-11-05 00:44 . 2009-06-30 23:42    167936    ----a-w-    c:\windows\system32\nvconrm.dll
2011-11-05 00:44 . 2009-06-30 23:42    539168    ----a-w-    c:\windows\system32\nvunrm.exe
2011-10-26 03:05 . 2011-10-26 03:05    10496512    ----a-w-    c:\windows\system32\drivers\atikmdag.sys
2011-10-26 02:16 . 2011-10-26 02:16    24866816    ----a-w-    c:\windows\system32\atio6axx.dll
2011-10-26 02:06 . 2011-10-26 02:06    159744    ----a-w-    c:\windows\system32\atiapfxx.exe
2011-10-26 02:05 . 2011-09-08 17:34    748544    ----a-w-    c:\windows\SysWow64\aticfx32.dll
2011-10-26 02:04 . 2011-09-08 17:32    892416    ----a-w-    c:\windows\system32\aticfx64.dll
2011-10-26 02:01 . 2011-10-26 02:01    466944    ----a-w-    c:\windows\system32\ATIDEMGX.dll
2011-10-26 02:01 . 2011-10-26 02:01    517120    ----a-w-    c:\windows\system32\atieclxx.exe
2011-10-26 02:00 . 2011-10-26 02:00    204288    ----a-w-    c:\windows\system32\atiesrxx.exe
2011-10-26 01:59 . 2011-10-26 01:59    18757120    ----a-w-    c:\windows\SysWow64\atioglxx.dll
2011-10-26 01:59 . 2011-10-26 01:59    120320    ----a-w-    c:\windows\system32\atitmm64.dll
2011-10-26 01:59 . 2011-10-26 01:59    423424    ----a-w-    c:\windows\system32\atipdl64.dll
2011-10-26 01:59 . 2011-10-26 01:59    356352    ----a-w-    c:\windows\SysWow64\atipdlxx.dll
2011-10-26 01:59 . 2011-10-26 01:59    278528    ----a-w-    c:\windows\SysWow64\Oemdspif.dll
2011-10-26 01:58 . 2011-10-26 01:58    21504    ----a-w-    c:\windows\system32\atimuixx.dll
2011-10-26 01:58 . 2011-10-26 01:58    59392    ----a-w-    c:\windows\system32\atiedu64.dll
2011-10-26 01:58 . 2011-10-26 01:58    43520    ----a-w-    c:\windows\SysWow64\ati2edxx.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-10-13 17351304]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"XWidget"="c:\program files (x86)\XWidget\xwidget.exe" [2011-11-19 4785664]
"Unified Remote v2"="c:\program files (x86)\Unified Remote\RemoteServer.exe" [2011-12-02 226816]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-01-04 937872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 343168]
"Everything"="c:\program files (x86)\Everything\Everything.exe" [2009-03-13 602624]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-01-04 3508624]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]
.
c:\users\six\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Murmur.lnk - c:\windows\Installer\{CEECECD5-A430-4451-8D62-7C4ACB30F93B}\murmur.ico [2011-11-5 9326]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Blue Manager Suite.lnk -  [N/A]
BTTray.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2008-8-18 835624]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages    REG_MULTI_SZ       kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R3 btiaa2dp;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btiaa2dp.sys [x]
R3 BTiAPan;Bluetooth PAN Miniport;c:\windows\system32\DRIVERS\btiapan.sys [x]
R3 btiarcp;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btiarcp.sys [x]
R3 btiaspp;Bluetooth Serial driver;c:\windows\system32\DRIVERS\btiaspp.sys [x]
R3 BTIAUSB;Generic Bluetooth Device;c:\windows\system32\DRIVERS\btiausb.sys [x]
R3 BTPROT;Generic Bluetooth Filter;c:\windows\system32\DRIVERS\btprot.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 iAnywhere_btAudio;Bluetooth Virtual SCO Device;c:\windows\system32\drivers\btiasco.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe [2011-12-12 751464]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-10-25 361984]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2011-06-24 55424]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-09-22 974944]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-02 2923392]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x]
S3 ssudobex;SAMSUNG Mobile USB OBEX Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudobex.sys [x]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2059813294-1679485015-2318070993-1000Core.job
- c:\users\six\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-23 08:05]
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2059813294-1679485015-2318070993-1000UA.job
- c:\users\six\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-23 08:05]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 4035152]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-18 8067616]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"combofix"="c:\test\CF7102.3XE" [2010-11-20 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube Download - c:\users\six\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\six\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Senden an &Bluetooth-Gerät... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\six\AppData\Roaming\Mozilla\Firefox\Profiles\mdsyc49z.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2059813294-1679485015-2318070993-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2059813294-1679485015-2318070993-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-2059813294-1679485015-2318070993-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*BUÕ]**€#]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2059813294-1679485015-2318070993-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*BUÕ]**€#\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Mumble\murmur.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-09  11:21:31 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-09 10:21
.
Vor Suchlauf: 14 Verzeichnis(se), 11.757.211.648 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 13.836.853.248 Bytes frei
.
- - End Of File - - 2A08B134F3920529EBE2CBD18B9ACAD4


Ich habe auch schon an eine false positive gedacht aber hmm irgendwie bin ich mir nicht sicher...
hoffe ihr könnt mir bei diesem problem helfen und bedanke mich schonmal dafür

MfG
Seitenanfang Seitenende
09.01.2012, 21:20
Swisstreasure
Moderator

Beiträge: 5694
#2 Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
• Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja.
( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )

Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.
Seitenanfang Seitenende
09.01.2012, 22:34
bluepill
Member

Themenstarter

Beiträge: 15
#3 Tatsächlich habe ich das heute Abend schon gemacht und er hat auch was gefunden. zum glück hab ich noch nicht auf fix gedrückt^^

AswMBR.txt

Code

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-09 17:56:21
-----------------------------
17:56:21.552    OS Version: Windows x64 6.1.7601 Service Pack 1
17:56:21.552    Number of processors: 4 586 0x403
17:56:21.553    ComputerName: SIXER  UserName: six
17:56:22.995    Initialize success
17:57:13.999    AVAST engine defs: 12010900
17:57:41.824    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3
17:57:41.826    Disk 0 Vendor: SAMSUNG_HD501LJ CR100-13 Size: 476940MB BusType: 3
17:57:41.829    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-5
17:57:41.831    Disk 1 Vendor: SAMSUNG_HD321KJ CP100-10 Size: 305245MB BusType: 3
17:57:41.833    Disk 2  \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-7
17:57:41.835    Disk 2 Vendor: SAMSUNG_HD502HJ 1AJ100E4 Size: 476940MB BusType: 3
17:57:41.852    Disk 0 MBR read successfully
17:57:41.854    Disk 0 MBR scan
17:57:41.880    Disk 0 Windows 7 default MBR code
17:57:41.897    Disk 0 Partition 1 00     07    HPFS/NTFS NTFS        99999 MB offset 2048
17:57:41.923    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       376937 MB offset 204800400
17:57:41.981    Disk 0 Partition 3 80 (A) 17 Hidd HPFS/NTFS NTFS            1 MB offset 976769136
17:57:42.323    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
17:57:42.338    Service scanning
17:57:57.923    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
17:58:00.212    Modules scanning
17:58:00.225    Disk 0 trace - called modules:
17:58:00.238    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa8003a7b2c0]<<
17:58:00.243    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004683060]
17:58:00.248    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8003a8ee40]
17:58:00.252    5 ACPI.sys[fffff880011727a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-3[0xfffffa80043ff060]
17:58:00.257    \Driver\atapi[0xfffffa80043e54d0] -> IRP_MJ_CREATE -> 0xfffffa8003a7b2c0
17:58:00.517    AVAST engine scan C:\Windows
17:58:11.642    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
17:58:13.896    AVAST engine scan C:\Windows\system32
18:01:01.629    AVAST engine scan C:\Windows\system32\drivers
18:01:18.838    AVAST engine scan C:\Users\six
18:12:23.730    File: C:\Users\six\Downloads\EOlmarikTdl4Cleaner.exe  **INFECTED** MBR:Alureon-K [Rtk]
18:13:05.508    File: C:\Users\six\Downloads\sicher\gmer\EOlmarikTdl4Cleaner.exe  **INFECTED** MBR:Alureon-K [Rtk]
18:15:59.664    AVAST engine scan C:\ProgramData
18:17:36.647    Scan finished successfully
18:20:33.662    Disk 0 MBR has been saved successfully to "C:\Users\six\Downloads\sicher\MBR.dat"
18:20:33.666    The log file has been saved successfully to "C:\Users\six\Downloads\sicher\aswMBR.txt"
EOlmarikTdl4Cleaner.exe ist das removal tool von der eset hompage...
File: C:\Windows\PEV.exe bin ich mir nicht sicher aber denke das ist von combofix

Disk 0 Partition 3 **INFECTED** MBR:Alureon-K [Rtk] wird wohl der olmarik sein?!
und bei dem rest keine ahnung ob das so passt
Dieser Beitrag wurde am 09.01.2012 um 23:49 Uhr von bluepill editiert.
Seitenanfang Seitenende
09.01.2012, 23:50
Swisstreasure
Moderator

Beiträge: 5694
#4 1.

• aswMBR.exe erneut ausführen.
• Auf [Scan] klicken
• Nach Abschluss der Prüfung auf [Fix] für TDL4 (MBRoot) klicken.



• Danach: starten Sie den Computer neu und führen aswMBR.exe erneut aus und poste das neue Log.


2.
Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
• Starte die TDSSKiller.exe
• Drücke Start Scan
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile.

TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ )
Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.
Seitenanfang Seitenende
10.01.2012, 00:20
bluepill
Member

Themenstarter

Beiträge: 15
#5 es gibt ein Problem... ich habe aswMBR.exe als Admin ausgeführt.. der scan ist fertig und der[FIX] Knopf ist ausgeblendet alles was ich klicken könnte wäre [FIXMBR]
was nun?

Habe bis jetzt noch nix gemacht aber hier trotzdem noch der tdsskiller log

Code

00:28:20.0328 5672    TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
00:28:20.0422 5672    ============================================================
00:28:20.0422 5672    Current date / time: 2012/01/10 00:28:20.0422
00:28:20.0422 5672    SystemInfo:
00:28:20.0422 5672    
00:28:20.0422 5672    OS Version: 6.1.7601 ServicePack: 1.0
00:28:20.0422 5672    Product type: Workstation
00:28:20.0422 5672    ComputerName: SIXER
00:28:20.0422 5672    UserName: six
00:28:20.0422 5672    Windows directory: C:\Windows
00:28:20.0422 5672    System windows directory: C:\Windows
00:28:20.0422 5672    Running under WOW64
00:28:20.0422 5672    Processor architecture: Intel x64
00:28:20.0422 5672    Number of processors: 4
00:28:20.0422 5672    Page size: 0x1000
00:28:20.0422 5672    Boot type: Normal boot
00:28:20.0422 5672    ============================================================
00:28:21.0434 5672    Initialize success
00:28:44.0623 5692    ============================================================
00:28:44.0623 5692    Scan started
00:28:44.0623 5692    Mode: Manual; 
00:28:44.0623 5692    ============================================================
00:28:45.0290 5692    1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
00:28:45.0296 5692    1394ohci - ok
00:28:45.0340 5692    ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
00:28:45.0345 5692    ACPI - ok
00:28:45.0375 5692    AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
00:28:45.0376 5692    AcpiPmi - ok
00:28:45.0429 5692    adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
00:28:45.0436 5692    adp94xx - ok
00:28:45.0465 5692    adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
00:28:45.0470 5692    adpahci - ok
00:28:45.0486 5692    adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
00:28:45.0489 5692    adpu320 - ok
00:28:45.0548 5692    AFD             (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
00:28:45.0559 5692    AFD - ok
00:28:45.0583 5692    agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
00:28:45.0585 5692    agp440 - ok
00:28:45.0605 5692    aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
00:28:45.0606 5692    aliide - ok
00:28:45.0663 5692    amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
00:28:45.0664 5692    amdide - ok
00:28:45.0710 5692    amdiox64        (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
00:28:45.0711 5692    amdiox64 - ok
00:28:45.0740 5692    AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
00:28:45.0742 5692    AmdK8 - ok
00:28:45.0964 5692    amdkmdag        (0415ffe1b6a6ea141feafca57567f57f) C:\Windows\system32\DRIVERS\atikmdag.sys
00:28:46.0089 5692    amdkmdag - ok
00:28:46.0115 5692    amdkmdap        (dc24d6f38f17c0d643d9aa8a6852f8d0) C:\Windows\system32\DRIVERS\atikmpag.sys
00:28:46.0119 5692    amdkmdap - ok
00:28:46.0165 5692    AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
00:28:46.0166 5692    AmdPPM - ok
00:28:46.0210 5692    amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
00:28:46.0215 5692    amdsata - ok
00:28:46.0246 5692    amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
00:28:46.0251 5692    amdsbs - ok
00:28:46.0292 5692    amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
00:28:46.0295 5692    amdxata - ok
00:28:46.0378 5692    AODDriver4.01   (f312fad7dbd49ed21a194ac71b497832) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
00:28:46.0382 5692    AODDriver4.01 - ok
00:28:46.0430 5692    AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
00:28:46.0434 5692    AppID - ok
00:28:46.0483 5692    arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
00:28:46.0485 5692    arc - ok
00:28:46.0504 5692    arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
00:28:46.0507 5692    arcsas - ok
00:28:46.0553 5692    aswFsBlk        (ce6d8bcc4787704ea4feeb92b0d0caf8) C:\Windows\system32\drivers\aswFsBlk.sys
00:28:46.0555 5692    aswFsBlk - ok
00:28:46.0615 5692    aswMonFlt       (0debeb2e3fbd0bf5343125cce617f105) C:\Windows\system32\drivers\aswMonFlt.sys
00:28:46.0619 5692    aswMonFlt - ok
00:28:46.0664 5692    aswRdr          (952edc2e81f85d1781958d4128bf59f8) C:\Windows\system32\drivers\aswRdr.sys
00:28:46.0667 5692    aswRdr - ok
00:28:46.0728 5692    aswSnx          (dd383e2ac941c545a85ab72503da6c12) C:\Windows\system32\drivers\aswSnx.sys
00:28:46.0743 5692    aswSnx - ok
00:28:46.0787 5692    aswSP           (ef5403fb8b2dcb791ec365fdf6040a4a) C:\Windows\system32\drivers\aswSP.sys
00:28:46.0795 5692    aswSP - ok
00:28:46.0817 5692    aswTdi          (34165da5c6b30c0f9d61246bf8a28040) C:\Windows\system32\drivers\aswTdi.sys
00:28:46.0821 5692    aswTdi - ok
00:28:46.0841 5692    AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
00:28:46.0845 5692    AsyncMac - ok
00:28:46.0879 5692    atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
00:28:46.0881 5692    atapi - ok
00:28:46.0940 5692    AtiHDAudioService (dbb487d09f56c674430ac454fd8bcab9) C:\Windows\system32\drivers\AtihdW76.sys
00:28:46.0944 5692    AtiHDAudioService - ok
00:28:46.0992 5692    atksgt          (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys
00:28:47.0000 5692    atksgt - ok
00:28:47.0038 5692    avkmgr - ok
00:28:47.0093 5692    b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
00:28:47.0105 5692    b06bdrv - ok
00:28:47.0135 5692    b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
00:28:47.0144 5692    b57nd60a - ok
00:28:47.0181 5692    Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
00:28:47.0183 5692    Beep - ok
00:28:47.0242 5692    blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
00:28:47.0245 5692    blbdrive - ok
00:28:47.0279 5692    bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
00:28:47.0283 5692    bowser - ok
00:28:47.0308 5692    BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
00:28:47.0311 5692    BrFiltLo - ok
00:28:47.0342 5692    BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
00:28:47.0345 5692    BrFiltUp - ok
00:28:47.0375 5692    BridgeMP        (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
00:28:47.0378 5692    BridgeMP - ok
00:28:47.0416 5692    Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
00:28:47.0419 5692    Brserid - ok
00:28:47.0435 5692    BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
00:28:47.0437 5692    BrSerWdm - ok
00:28:47.0449 5692    BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
00:28:47.0450 5692    BrUsbMdm - ok
00:28:47.0463 5692    BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
00:28:47.0465 5692    BrUsbSer - ok
00:28:47.0509 5692    BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys
00:28:47.0510 5692    BthEnum - ok
00:28:47.0535 5692    BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
00:28:47.0537 5692    BTHMODEM - ok
00:28:47.0552 5692    BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
00:28:47.0554 5692    BthPan - ok
00:28:47.0603 5692    BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\system32\Drivers\BTHport.sys
00:28:47.0616 5692    BTHPORT - ok
00:28:47.0642 5692    BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\system32\Drivers\BTHUSB.sys
00:28:47.0643 5692    BTHUSB - ok
00:28:47.0671 5692    btiaa2dp        (2e5a2233303800c7c2e9999fc6bf9b27) C:\Windows\system32\drivers\btiaa2dp.sys
00:28:47.0673 5692    btiaa2dp - ok
00:28:47.0703 5692    BTiAPan         (a0dd67f9683e6e533dd5e49059e42359) C:\Windows\system32\DRIVERS\btiapan.sys
00:28:47.0705 5692    BTiAPan - ok
00:28:47.0740 5692    btiarcp         (babab04a469845c1a3e7ed4f28b7e654) C:\Windows\system32\DRIVERS\btiarcp.sys
00:28:47.0741 5692    btiarcp - ok
00:28:47.0769 5692    btiaspp         (bf43aa9ea27ec82f37938a52ddaef53b) C:\Windows\system32\DRIVERS\btiaspp.sys
00:28:47.0771 5692    btiaspp - ok
00:28:47.0793 5692    BTIAUSB         (6db8264c3e751648bf69d1d23fce8b10) C:\Windows\system32\DRIVERS\btiausb.sys
00:28:47.0795 5692    BTIAUSB - ok
00:28:47.0884 5692    BTKRNL          (dd5e46fdcd91d4fc2c5e07af7b27e172) C:\Windows\system32\DRIVERS\btkrnl.sys
00:28:47.0910 5692    BTKRNL - ok
00:28:47.0953 5692    BTPROT          (d9c0214aa868a8cc8b39815e8e12e3d8) C:\Windows\system32\DRIVERS\btprot.sys
00:28:47.0959 5692    BTPROT - ok
00:28:47.0987 5692    catchme - ok
00:28:48.0027 5692    cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
00:28:48.0030 5692    cdfs - ok
00:28:48.0078 5692    cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
00:28:48.0083 5692    cdrom - ok
00:28:48.0117 5692    circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
00:28:48.0119 5692    circlass - ok
00:28:48.0157 5692    CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
00:28:48.0162 5692    CLFS - ok
00:28:48.0219 5692    CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
00:28:48.0220 5692    CmBatt - ok
00:28:48.0238 5692    cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
00:28:48.0239 5692    cmdide - ok
00:28:48.0267 5692    CNG             (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
00:28:48.0274 5692    CNG - ok
00:28:48.0291 5692    Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
00:28:48.0292 5692    Compbatt - ok
00:28:48.0308 5692    CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
00:28:48.0309 5692    CompositeBus - ok
00:28:48.0332 5692    crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
00:28:48.0333 5692    crcdisk - ok
00:28:48.0368 5692    CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
00:28:48.0375 5692    CSC - ok
00:28:48.0410 5692    DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
00:28:48.0411 5692    DfsC - ok
00:28:48.0431 5692    dgderdrv - ok
00:28:48.0459 5692    dg_ssudbus      (388039f99ce8769024ee0438352aca99) C:\Windows\system32\DRIVERS\ssudbus.sys
00:28:48.0460 5692    dg_ssudbus - ok
00:28:48.0477 5692    discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
00:28:48.0479 5692    discache - ok
00:28:48.0511 5692    Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
00:28:48.0512 5692    Disk - ok
00:28:48.0564 5692    drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
00:28:48.0565 5692    drmkaud - ok
00:28:48.0601 5692    DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
00:28:48.0613 5692    DXGKrnl - ok
00:28:48.0648 5692    E1G60           (edc6e9c057c9d7f83eea22b4cef5dcad) C:\Windows\system32\DRIVERS\E1G6032E.sys
00:28:48.0651 5692    E1G60 - ok
00:28:48.0685 5692    eamonm          (13533557d01b88c83110d5cf749f14d7) C:\Windows\system32\DRIVERS\eamonm.sys
00:28:48.0689 5692    eamonm - ok
00:28:48.0764 5692    ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
00:28:48.0801 5692    ebdrv - ok
00:28:48.0848 5692    ehdrv           (e097728129e7b79bf1089d7aef42332b) C:\Windows\system32\DRIVERS\ehdrv.sys
00:28:48.0853 5692    ehdrv - ok
00:28:48.0921 5692    elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
00:28:48.0929 5692    elxstor - ok
00:28:48.0946 5692    epfwwfpr        (2380976cf8a4a56611f35633acd2a74f) C:\Windows\system32\DRIVERS\epfwwfpr.sys
00:28:48.0948 5692    epfwwfpr - ok
00:28:48.0973 5692    ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
00:28:48.0974 5692    ErrDev - ok
00:28:49.0013 5692    exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
00:28:49.0016 5692    exfat - ok
00:28:49.0042 5692    fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
00:28:49.0045 5692    fastfat - ok
00:28:49.0077 5692    fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
00:28:49.0078 5692    fdc - ok
00:28:49.0099 5692    FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
00:28:49.0101 5692    FileInfo - ok
00:28:49.0114 5692    Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
00:28:49.0115 5692    Filetrace - ok
00:28:49.0124 5692    flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
00:28:49.0125 5692    flpydisk - ok
00:28:49.0156 5692    FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
00:28:49.0160 5692    FltMgr - ok
00:28:49.0172 5692    FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
00:28:49.0173 5692    FsDepends - ok
00:28:49.0187 5692    Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
00:28:49.0189 5692    Fs_Rec - ok
00:28:49.0218 5692    fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
00:28:49.0221 5692    fvevol - ok
00:28:49.0236 5692    gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
00:28:49.0238 5692    gagp30kx - ok
00:28:49.0248 5692    hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
00:28:49.0250 5692    hcw85cir - ok
00:28:49.0291 5692    HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
00:28:49.0295 5692    HdAudAddService - ok
00:28:49.0317 5692    HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
00:28:49.0320 5692    HDAudBus - ok
00:28:49.0333 5692    HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
00:28:49.0335 5692    HidBatt - ok
00:28:49.0349 5692    HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
00:28:49.0352 5692    HidBth - ok
00:28:49.0360 5692    HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
00:28:49.0362 5692    HidIr - ok
00:28:49.0403 5692    HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
00:28:49.0405 5692    HidUsb - ok
00:28:49.0444 5692    HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
00:28:49.0446 5692    HpSAMD - ok
00:28:49.0486 5692    HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
00:28:49.0496 5692    HTTP - ok
00:28:49.0527 5692    hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
00:28:49.0528 5692    hwpolicy - ok
00:28:49.0559 5692    i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
00:28:49.0561 5692    i8042prt - ok
00:28:49.0606 5692    iAnywhere_btAudio (8287222c98db780a5b6107a6ac7db0ea) C:\Windows\system32\drivers\btiasco.sys
00:28:49.0608 5692    iAnywhere_btAudio - ok
00:28:49.0628 5692    iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
00:28:49.0634 5692    iaStorV - ok
00:28:49.0656 5692    iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
00:28:49.0657 5692    iirsp - ok
00:28:49.0740 5692    IntcAzAudAddService (f04d22d7a49a1b2210dbadf0b803e870) C:\Windows\system32\drivers\RTKVHD64.sys
00:28:49.0762 5692    IntcAzAudAddService - ok
00:28:49.0770 5692    intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
00:28:49.0772 5692    intelide - ok
00:28:49.0811 5692    intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
00:28:49.0813 5692    intelppm - ok
00:28:49.0841 5692    IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
00:28:49.0842 5692    IpFilterDriver - ok
00:28:49.0860 5692    IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
00:28:49.0863 5692    IPMIDRV - ok
00:28:49.0876 5692    IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
00:28:49.0878 5692    IPNAT - ok
00:28:49.0909 5692    IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
00:28:49.0910 5692    IRENUM - ok
00:28:49.0924 5692    isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
00:28:49.0925 5692    isapnp - ok
00:28:49.0949 5692    iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
00:28:49.0953 5692    iScsiPrt - ok
00:28:49.0978 5692    kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
00:28:49.0980 5692    kbdclass - ok
00:28:50.0012 5692    kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
00:28:50.0014 5692    kbdhid - ok
00:28:50.0036 5692    KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
00:28:50.0038 5692    KSecDD - ok
00:28:50.0074 5692    KSecPkg         (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
00:28:50.0076 5692    KSecPkg - ok
00:28:50.0093 5692    ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
00:28:50.0094 5692    ksthunk - ok
00:28:50.0153 5692    lirsgt          (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys
00:28:50.0154 5692    lirsgt - ok
00:28:50.0193 5692    lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
00:28:50.0197 5692    lltdio - ok
00:28:50.0246 5692    LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
00:28:50.0249 5692    LSI_FC - ok
00:28:50.0262 5692    LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
00:28:50.0265 5692    LSI_SAS - ok
00:28:50.0281 5692    LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
00:28:50.0283 5692    LSI_SAS2 - ok
00:28:50.0301 5692    LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
00:28:50.0304 5692    LSI_SCSI - ok
00:28:50.0336 5692    luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
00:28:50.0338 5692    luafv - ok
00:28:50.0394 5692    MBAMProtector   (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys
00:28:50.0398 5692    MBAMProtector - ok
00:28:50.0428 5692    megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
00:28:50.0430 5692    megasas - ok
00:28:50.0456 5692    MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
00:28:50.0459 5692    MegaSR - ok
00:28:50.0482 5692    Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
00:28:50.0483 5692    Modem - ok
00:28:50.0511 5692    monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
00:28:50.0513 5692    monitor - ok
00:28:50.0546 5692    mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
00:28:50.0549 5692    mouclass - ok
00:28:50.0585 5692    mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
00:28:50.0588 5692    mouhid - ok
00:28:50.0619 5692    mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
00:28:50.0623 5692    mountmgr - ok
00:28:50.0649 5692    mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
00:28:50.0652 5692    mpio - ok
00:28:50.0666 5692    mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
00:28:50.0667 5692    mpsdrv - ok
00:28:50.0702 5692    MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
00:28:50.0704 5692    MRxDAV - ok
00:28:50.0732 5692    mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
00:28:50.0735 5692    mrxsmb - ok
00:28:50.0756 5692    mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
00:28:50.0760 5692    mrxsmb10 - ok
00:28:50.0776 5692    mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
00:28:50.0778 5692    mrxsmb20 - ok
00:28:50.0796 5692    msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
00:28:50.0798 5692    msahci - ok
00:28:50.0818 5692    msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
00:28:50.0820 5692    msdsm - ok
00:28:50.0841 5692    Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
00:28:50.0843 5692    Msfs - ok
00:28:50.0859 5692    mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
00:28:50.0860 5692    mshidkmdf - ok
00:28:50.0882 5692    msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
00:28:50.0883 5692    msisadrv - ok
00:28:50.0936 5692    MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
00:28:50.0937 5692    MSKSSRV - ok
00:28:50.0957 5692    MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
00:28:50.0959 5692    MSPCLOCK - ok
00:28:50.0978 5692    MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
00:28:50.0981 5692    MSPQM - ok
00:28:51.0012 5692    MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
00:28:51.0017 5692    MsRPC - ok
00:28:51.0028 5692    mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
00:28:51.0029 5692    mssmbios - ok
00:28:51.0043 5692    MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
00:28:51.0044 5692    MSTEE - ok
00:28:51.0065 5692    MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
00:28:51.0066 5692    MTConfig - ok
00:28:51.0085 5692    Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
00:28:51.0087 5692    Mup - ok
00:28:51.0121 5692    NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
00:28:51.0125 5692    NativeWifiP - ok
00:28:51.0183 5692    NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
00:28:51.0205 5692    NDIS - ok
00:28:51.0232 5692    NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
00:28:51.0236 5692    NdisCap - ok
00:28:51.0280 5692    NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
00:28:51.0283 5692    NdisTapi - ok
00:28:51.0326 5692    Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
00:28:51.0330 5692    Ndisuio - ok
00:28:51.0360 5692    NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
00:28:51.0365 5692    NdisWan - ok
00:28:51.0397 5692    NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
00:28:51.0399 5692    NDProxy - ok
00:28:51.0412 5692    NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
00:28:51.0413 5692    NetBIOS - ok
00:28:51.0433 5692    NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
00:28:51.0436 5692    NetBT - ok
00:28:51.0496 5692    nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
00:28:51.0497 5692    nfrd960 - ok
00:28:51.0521 5692    Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
00:28:51.0523 5692    Npfs - ok
00:28:51.0542 5692    nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
00:28:51.0543 5692    nsiproxy - ok
00:28:51.0597 5692    Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
00:28:51.0618 5692    Ntfs - ok
00:28:51.0634 5692    Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
00:28:51.0635 5692    Null - ok
00:28:51.0692 5692    NVENETFD        (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
00:28:51.0703 5692    NVENETFD - ok
00:28:51.0753 5692    NVNET           (0aa2a6aae14bdf0bea29056ee759b200) C:\Windows\system32\DRIVERS\nvmf6264.sys
00:28:51.0762 5692    NVNET - ok
00:28:51.0795 5692    nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
00:28:51.0800 5692    nvraid - ok
00:28:51.0848 5692    nvsmu           (e58d81fb8616d0cb55c1e36aa0b213c9) C:\Windows\system32\DRIVERS\nvsmu.sys
00:28:51.0852 5692    nvsmu - ok
00:28:51.0882 5692    nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
00:28:51.0887 5692    nvstor - ok
00:28:51.0929 5692    nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
00:28:51.0933 5692    nv_agp - ok
00:28:51.0966 5692    ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
00:28:51.0969 5692    ohci1394 - ok
00:28:52.0018 5692    Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
00:28:52.0022 5692    Parport - ok
00:28:52.0053 5692    partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
00:28:52.0056 5692    partmgr - ok
00:28:52.0088 5692    pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
00:28:52.0090 5692    pci - ok
00:28:52.0106 5692    pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
00:28:52.0107 5692    pciide - ok
00:28:52.0127 5692    pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
00:28:52.0130 5692    pcmcia - ok
00:28:52.0154 5692    pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
00:28:52.0156 5692    pcw - ok
00:28:52.0187 5692    PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
00:28:52.0195 5692    PEAUTH - ok
00:28:52.0250 5692    PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
00:28:52.0251 5692    PptpMiniport - ok
00:28:52.0271 5692    Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
00:28:52.0272 5692    Processor - ok
00:28:52.0313 5692    Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
00:28:52.0315 5692    Psched - ok
00:28:52.0372 5692    ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
00:28:52.0391 5692    ql2300 - ok
00:28:52.0411 5692    ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
00:28:52.0413 5692    ql40xx - ok
00:28:52.0441 5692    QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
00:28:52.0443 5692    QWAVEdrv - ok
00:28:52.0475 5692    RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
00:28:52.0476 5692    RasAcd - ok
00:28:52.0510 5692    RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
00:28:52.0512 5692    RasAgileVpn - ok
00:28:52.0535 5692    Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
00:28:52.0537 5692    Rasl2tp - ok
00:28:52.0555 5692    RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
00:28:52.0556 5692    RasPppoe - ok
00:28:52.0565 5692    RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
00:28:52.0567 5692    RasSstp - ok
00:28:52.0598 5692    rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
00:28:52.0603 5692    rdbss - ok
00:28:52.0622 5692    rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
00:28:52.0623 5692    rdpbus - ok
00:28:52.0638 5692    RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
00:28:52.0639 5692    RDPCDD - ok
00:28:52.0673 5692    RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
00:28:52.0676 5692    RDPDR - ok
00:28:52.0713 5692    RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
00:28:52.0716 5692    RDPENCDD - ok
00:28:52.0739 5692    RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
00:28:52.0742 5692    RDPREFMP - ok
00:28:52.0795 5692    RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
00:28:52.0798 5692    RdpVideoMiniport - ok
00:28:52.0823 5692    RDPWD           (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
00:28:52.0829 5692    RDPWD - ok
00:28:52.0852 5692    rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
00:28:52.0855 5692    rdyboost - ok
00:28:52.0904 5692    RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
00:28:52.0906 5692    RFCOMM - ok
00:28:52.0947 5692    rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
00:28:52.0949 5692    rspndr - ok
00:28:52.0971 5692    s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
00:28:52.0972 5692    s3cap - ok
00:28:53.0002 5692    sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
00:28:53.0004 5692    sbp2port - ok
00:28:53.0033 5692    scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
00:28:53.0035 5692    scfilter - ok
00:28:53.0057 5692    secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
00:28:53.0059 5692    secdrv - ok
00:28:53.0083 5692    Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
00:28:53.0084 5692    Serenum - ok
00:28:53.0093 5692    Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
00:28:53.0095 5692    Serial - ok
00:28:53.0115 5692    sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
00:28:53.0116 5692    sermouse - ok
00:28:53.0141 5692    sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
00:28:53.0142 5692    sffdisk - ok
00:28:53.0164 5692    sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
00:28:53.0165 5692    sffp_mmc - ok
00:28:53.0184 5692    sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
00:28:53.0185 5692    sffp_sd - ok
00:28:53.0213 5692    sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
00:28:53.0214 5692    sfloppy - ok
00:28:53.0252 5692    SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
00:28:53.0253 5692    SiSRaid2 - ok
00:28:53.0272 5692    SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
00:28:53.0274 5692    SiSRaid4 - ok
00:28:53.0298 5692    Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
00:28:53.0300 5692    Smb - ok
00:28:53.0333 5692    spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
00:28:53.0334 5692    spldr - ok
00:28:53.0394 5692    sptd            (a6cff1af7664627a296b6a0a96cf876e) C:\Windows\System32\Drivers\sptd.sys
00:28:53.0395 5692    Suspicious file (NoAccess): C:\Windows\System32\Drivers\sptd.sys. md5: a6cff1af7664627a296b6a0a96cf876e
00:28:53.0396 5692    sptd ( LockedFile.Multi.Generic ) - warning
00:28:53.0397 5692    sptd - detected LockedFile.Multi.Generic (1)
00:28:53.0434 5692    srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
00:28:53.0441 5692    srv - ok
00:28:53.0483 5692    srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
00:28:53.0488 5692    srv2 - ok
00:28:53.0506 5692    srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
00:28:53.0509 5692    srvnet - ok
00:28:53.0567 5692    ssudmdm         (ad42ca614e086bcadbd53fffc404ac24) C:\Windows\system32\DRIVERS\ssudmdm.sys
00:28:53.0571 5692    ssudmdm - ok
00:28:53.0605 5692    ssudobex        (a23bc4049f6a1820bc82eab492950890) C:\Windows\system32\DRIVERS\ssudobex.sys
00:28:53.0611 5692    ssudobex - ok
00:28:53.0635 5692    stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
00:28:53.0637 5692    stexstor - ok
00:28:53.0684 5692    storflt         (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
00:28:53.0686 5692    storflt - ok
00:28:53.0710 5692    storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
00:28:53.0712 5692    storvsc - ok
00:28:53.0732 5692    swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
00:28:53.0733 5692    swenum - ok
00:28:53.0783 5692    Synth3dVsc - ok
00:28:53.0825 5692    tap0901t        (b08740047145b9bce15bf75ca0f9718a) C:\Windows\system32\DRIVERS\tap0901t.sys
00:28:53.0827 5692    tap0901t - ok
00:28:53.0908 5692    Tcpip           (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
00:28:53.0929 5692    Tcpip - ok
00:28:53.0973 5692    TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
00:28:53.0986 5692    TCPIP6 - ok
00:28:54.0013 5692    tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
00:28:54.0015 5692    tcpipreg - ok
00:28:54.0035 5692    TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
00:28:54.0037 5692    TDPIPE - ok
00:28:54.0054 5692    TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
00:28:54.0055 5692    TDTCP - ok
00:28:54.0089 5692    tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
00:28:54.0093 5692    tdx - ok
00:28:54.0121 5692    TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
00:28:54.0122 5692    TermDD - ok
00:28:54.0167 5692    tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
00:28:54.0168 5692    tssecsrv - ok
00:28:54.0224 5692    TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
00:28:54.0228 5692    TsUsbFlt - ok
00:28:54.0242 5692    tsusbhub - ok
00:28:54.0292 5692    tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
00:28:54.0297 5692    tunnel - ok
00:28:54.0333 5692    uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
00:28:54.0336 5692    uagp35 - ok
00:28:54.0381 5692    udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
00:28:54.0390 5692    udfs - ok
00:28:54.0444 5692    uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
00:28:54.0447 5692    uliagpkx - ok
00:28:54.0489 5692    umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
00:28:54.0492 5692    umbus - ok
00:28:54.0521 5692    UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
00:28:54.0523 5692    UmPass - ok
00:28:54.0554 5692    usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
00:28:54.0556 5692    usbccgp - ok
00:28:54.0592 5692    usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
00:28:54.0593 5692    usbcir - ok
00:28:54.0610 5692    usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
00:28:54.0612 5692    usbehci - ok
00:28:54.0631 5692    usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
00:28:54.0636 5692    usbhub - ok
00:28:54.0650 5692    usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
00:28:54.0651 5692    usbohci - ok
00:28:54.0675 5692    usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
00:28:54.0676 5692    usbprint - ok
00:28:54.0702 5692    USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
00:28:54.0704 5692    USBSTOR - ok
00:28:54.0725 5692    usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
00:28:54.0727 5692    usbuhci - ok
00:28:54.0776 5692    usb_rndisx      (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys
00:28:54.0777 5692    usb_rndisx - ok
00:28:54.0809 5692    vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
00:28:54.0811 5692    vdrvroot - ok
00:28:54.0836 5692    vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
00:28:54.0837 5692    vga - ok
00:28:54.0859 5692    VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
00:28:54.0861 5692    VgaSave - ok
00:28:54.0886 5692    VGPU - ok
00:28:54.0908 5692    vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
00:28:54.0911 5692    vhdmp - ok
00:28:54.0922 5692    viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
00:28:54.0923 5692    viaide - ok
00:28:54.0945 5692    vmbus           (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
00:28:54.0948 5692    vmbus - ok
00:28:54.0965 5692    VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
00:28:54.0966 5692    VMBusHID - ok
00:28:54.0988 5692    volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
00:28:54.0990 5692    volmgr - ok
00:28:55.0020 5692    volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
00:28:55.0025 5692    volmgrx - ok
00:28:55.0045 5692    volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
00:28:55.0049 5692    volsnap - ok
00:28:55.0083 5692    vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
00:28:55.0085 5692    vsmraid - ok
00:28:55.0107 5692    vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
00:28:55.0109 5692    vwifibus - ok
00:28:55.0136 5692    WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
00:28:55.0137 5692    WacomPen - ok
00:28:55.0173 5692    WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
00:28:55.0175 5692    WANARP - ok
00:28:55.0179 5692    Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
00:28:55.0180 5692    Wanarpv6 - ok
00:28:55.0230 5692    Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
00:28:55.0231 5692    Wd - ok
00:28:55.0258 5692    Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
00:28:55.0267 5692    Wdf01000 - ok
00:28:55.0311 5692    WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
00:28:55.0312 5692    WfpLwf - ok
00:28:55.0340 5692    WimFltr         (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
00:28:55.0343 5692    WimFltr - ok
00:28:55.0363 5692    WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
00:28:55.0364 5692    WIMMount - ok
00:28:55.0432 5692    WinUSB          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys
00:28:55.0434 5692    WinUSB - ok
00:28:55.0467 5692    WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
00:28:55.0468 5692    WmiAcpi - ok
00:28:55.0487 5692    ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
00:28:55.0488 5692    ws2ifsl - ok
00:28:55.0524 5692    WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
00:28:55.0525 5692    WudfPf - ok
00:28:55.0571 5692    WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
00:28:55.0577 5692    WUDFRd - ok
00:28:55.0634 5692    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
00:28:55.0663 5692    \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - infected
00:28:55.0663 5692    \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.b (0)
00:28:55.0666 5692    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1
00:28:55.0693 5692    \Device\Harddisk1\DR1 - ok
00:28:55.0696 5692    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk2\DR2
00:28:55.0700 5692    \Device\Harddisk2\DR2 - ok
00:28:55.0728 5692    Boot (0x1200)   (62df4fb253dda7d53501613927f5ce3c) \Device\Harddisk0\DR0\Partition0
00:28:55.0729 5692    \Device\Harddisk0\DR0\Partition0 - ok
00:28:55.0747 5692    Boot (0x1200)   (47cd7ea8508ea82cb372883c67949ea3) \Device\Harddisk0\DR0\Partition1
00:28:55.0748 5692    \Device\Harddisk0\DR0\Partition1 - ok
00:28:55.0750 5692    Boot (0x1200)   (66d76974dc4655b7869f8b1177edb6bf) \Device\Harddisk1\DR1\Partition0
00:28:55.0750 5692    \Device\Harddisk1\DR1\Partition0 - ok
00:28:55.0754 5692    Boot (0x1200)   (8209ac3f32b685b5b995d3cf212403a1) \Device\Harddisk1\DR1\Partition1
00:28:55.0755 5692    \Device\Harddisk1\DR1\Partition1 - ok
00:28:55.0759 5692    Boot (0x1200)   (87bd728fda51ea26db9b576395d507a0) \Device\Harddisk2\DR2\Partition0
00:28:55.0759 5692    \Device\Harddisk2\DR2\Partition0 - ok
00:28:55.0761 5692    ============================================================
00:28:55.0761 5692    Scan finished
00:28:55.0761 5692    ============================================================
00:28:55.0772 5364    Detected object count: 2
00:28:55.0772 5364    Actual detected object count: 2
00:29:16.0817 5364    sptd ( LockedFile.Multi.Generic ) - skipped by user
00:29:16.0817 5364    sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
00:29:16.0819 5364    \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - skipped by user
00:29:16.0819 5364    \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - User select action: Skip
Dieser Beitrag wurde am 10.01.2012 um 00:33 Uhr von bluepill editiert.
Seitenanfang Seitenende
10.01.2012, 09:17
Swisstreasure
Moderator

Beiträge: 5694
#6 Dann führe aswMBR nochmals aus und klicke auf Fixmbr.
Danach erstelle ein neues Log mit Kasperky TDSS Killer und wähle Cure.
Seitenanfang Seitenende
10.01.2012, 11:03
bluepill
Member

Themenstarter

Beiträge: 15
#7 Guten Morgen,
ich habe im Abgesichertenmodus mit aswMBR Fixmbr ausgeführt, hat nicht wirklich was gebracht(selben Funde keine bereinigung durch aswMBR und Eset möglich)
TDSSkiller hab ich noch nicht drüber laufen lassen.

Aber
ich habe etwas Recherche betrieben und bin der Sache evtl ein wenig näher gekommen...
Avast meldet ja das es sich um den MBR:Alureon-k handelt. Nun dieser scheint sich seine eigenen Partitionen zu erstellen. Gut geguckt welche Partitionen auf dem Datenträger sind.. 3 Stück wo im Grunde nur 2 seien sollten. Partition 1 hat 100GB, Partition 2 hat 370GB, Partition 3 ist aktiv geschaltet, versteckt und hat 2MB wo auch der Alureon drauf sein soll laut Avast.

Wo jetzt genau diese 3. 2MB Partition herkommt weiß ich leider nicht genau.. Evtl wurde sie damals von Windows xp erstellt als ich die Platte das erste mal eingebaut habe und sie durch die windows XP installation Partitionieren lies..(anmerkung: das ist schon ewig her und ich verwende nun win7 64bit aber habe weiter nix geändert an den platten). Evtl wurde sie aber auch durch den Alureon selbst erstellt, Auf jeden Fall kann ich mir nicht vorstellen das eine 2MB Partition Aktiv im System hängen muss. Sie Ist nur als Aktiv und Primäre Partition geflagt also nicht als die Startpartition. (Screenshot zur Verdeutlichung)

Ich habe jetzt aswMBR mit -ap 1 einfach mal Partition 1 aktiv setzen lassen. Es kommen die gleichen Funde und auch der [FIX] Button ist leider nicht anklickbar. Jetzt Findet ESET aber nix mehr also gehe ich davon aus dass wenn ich jetzt die 2MB Partition lösche der Verursacher weg ist?
Danach müsste ich evtl den MBR neu schreiben aber das wäre im Grunde kein Problem.
Liege ich richtig mit meiner Annahme das die Partition der Hauptverursacher ist und ich sie löschen sollte oder mach ich damit alles schlimmer?^^

EDIT:

habe eben nochmal den TDSSkiller laufen lassen..

ich kann nicht "cure" auswählen nur "copy to quarantine" (was wahrscheinlich auch nicht gehen wird... die erste datei ist locked der 2. fund ist ist der mbr)
ich glaube so langsam das ich ohne eine gute boot CD/USB die wirklich was drauf hat so nicht weiter komme.. irgendwelche Empfehlungen? Eset und ativir Boot recovery hab ich schon durch und hat nicht geholfen. gibt es das aswMBR und den TDSSkiller auch für linux? dann könnte ich mir da selber was basteln

hier nochmal der log nach der aktivierung der 1. Partition:
es wurden 2 sachen gefunden

11:30:02.0932 2848 sptd - detected LockedFile.Multi.Generic (1)
11:31:52.0870 3052 \Device\Harddisk0\DR0 - detected TDSS File System (1)

Code

11:29:38.0588 3144    TDSS rootkit removing tool 2.7.0.0 Jan 10 2012 09:14:26
11:29:38.0760 3144    ============================================================
11:29:38.0760 3144    Current date / time: 2012/01/10 11:29:38.0760
11:29:38.0760 3144    SystemInfo:
11:29:38.0760 3144    
11:29:38.0760 3144    OS Version: 6.1.7601 ServicePack: 1.0
11:29:38.0760 3144    Product type: Workstation
11:29:38.0760 3144    ComputerName: SIXER
11:29:38.0760 3144    UserName: six
11:29:38.0760 3144    Windows directory: C:\Windows
11:29:38.0760 3144    System windows directory: C:\Windows
11:29:38.0760 3144    Running under WOW64
11:29:38.0760 3144    Processor architecture: Intel x64
11:29:38.0760 3144    Number of processors: 4
11:29:38.0760 3144    Page size: 0x1000
11:29:38.0760 3144    Boot type: Normal boot
11:29:38.0760 3144    ============================================================
11:29:40.0870 3144    Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000, SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000040
11:29:40.0885 3144    Drive \Device\Harddisk1\DR1 - Size: 0x4A85D56000, SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000040
11:29:40.0885 3144    Drive \Device\Harddisk2\DR2 - Size: 0x7470C06000, SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K', Flags 0x00000040
11:29:41.0120 3144    Initialize success
11:29:50.0135 2848    ============================================================
11:29:50.0135 2848    Scan started
11:29:50.0135 2848    Mode: Manual; 
11:29:50.0135 2848    ============================================================
11:29:51.0401 2848    1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
11:29:51.0463 2848    1394ohci - ok
11:29:51.0495 2848    ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
11:29:51.0495 2848    ACPI - ok
11:29:51.0526 2848    AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
11:29:51.0541 2848    AcpiPmi - ok
11:29:51.0588 2848    adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
11:29:51.0666 2848    adp94xx - ok
11:29:51.0682 2848    adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
11:29:51.0713 2848    adpahci - ok
11:29:51.0729 2848    adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
11:29:51.0745 2848    adpu320 - ok
11:29:51.0807 2848    AFD             (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
11:29:51.0823 2848    AFD - ok
11:29:51.0870 2848    agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
11:29:51.0916 2848    agp440 - ok
11:29:51.0932 2848    aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
11:29:51.0979 2848    aliide - ok
11:29:52.0120 2848    amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
11:29:52.0166 2848    amdide - ok
11:29:52.0198 2848    amdiox64        (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
11:29:52.0229 2848    amdiox64 - ok
11:29:52.0260 2848    AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
11:29:52.0276 2848    AmdK8 - ok
11:29:52.0510 2848    amdkmdag        (0415ffe1b6a6ea141feafca57567f57f) C:\Windows\system32\DRIVERS\atikmdag.sys
11:29:52.0651 2848    amdkmdag - ok
11:29:52.0666 2848    amdkmdap        (dc24d6f38f17c0d643d9aa8a6852f8d0) C:\Windows\system32\DRIVERS\atikmpag.sys
11:29:52.0666 2848    amdkmdap - ok
11:29:52.0713 2848    AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
11:29:52.0760 2848    AmdPPM - ok
11:29:52.0776 2848    amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
11:29:52.0823 2848    amdsata - ok
11:29:52.0838 2848    amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
11:29:52.0854 2848    amdsbs - ok
11:29:52.0885 2848    amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
11:29:52.0901 2848    amdxata - ok
11:29:52.0979 2848    AODDriver4.01   (f312fad7dbd49ed21a194ac71b497832) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
11:29:52.0979 2848    AODDriver4.01 - ok
11:29:53.0026 2848    AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
11:29:53.0057 2848    AppID - ok
11:29:53.0088 2848    arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
11:29:53.0104 2848    arc - ok
11:29:53.0120 2848    arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
11:29:53.0120 2848    arcsas - ok
11:29:53.0151 2848    AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
11:29:53.0166 2848    AsyncMac - ok
11:29:53.0182 2848    atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
11:29:53.0182 2848    atapi - ok
11:29:53.0213 2848    AtiHDAudioService (dbb487d09f56c674430ac454fd8bcab9) C:\Windows\system32\drivers\AtihdW76.sys
11:29:53.0245 2848    AtiHDAudioService - ok
11:29:53.0291 2848    atksgt          (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys
11:29:53.0307 2848    atksgt - ok
11:29:53.0354 2848    b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
11:29:53.0354 2848    b06bdrv - ok
11:29:53.0401 2848    b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
11:29:53.0448 2848    b57nd60a - ok
11:29:53.0479 2848    Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
11:29:53.0479 2848    Beep - ok
11:29:53.0526 2848    blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
11:29:53.0573 2848    blbdrive - ok
11:29:53.0588 2848    bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
11:29:53.0682 2848    bowser - ok
11:29:53.0698 2848    BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
11:29:53.0698 2848    BrFiltLo - ok
11:29:53.0713 2848    BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
11:29:53.0713 2848    BrFiltUp - ok
11:29:53.0760 2848    BridgeMP        (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
11:29:53.0807 2848    BridgeMP - ok
11:29:53.0838 2848    Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
11:29:53.0885 2848    Brserid - ok
11:29:53.0901 2848    BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
11:29:53.0932 2848    BrSerWdm - ok
11:29:53.0932 2848    BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
11:29:53.0948 2848    BrUsbMdm - ok
11:29:53.0963 2848    BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
11:29:53.0979 2848    BrUsbSer - ok
11:29:54.0010 2848    BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys
11:29:54.0057 2848    BthEnum - ok
11:29:54.0088 2848    BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
11:29:54.0104 2848    BTHMODEM - ok
11:29:54.0120 2848    BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
11:29:54.0135 2848    BthPan - ok
11:29:54.0166 2848    BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\system32\Drivers\BTHport.sys
11:29:54.0198 2848    BTHPORT - ok
11:29:54.0213 2848    BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\system32\Drivers\BTHUSB.sys
11:29:54.0229 2848    BTHUSB - ok
11:29:54.0260 2848    btiaa2dp        (2e5a2233303800c7c2e9999fc6bf9b27) C:\Windows\system32\drivers\btiaa2dp.sys
11:29:54.0276 2848    btiaa2dp - ok
11:29:54.0307 2848    BTiAPan         (a0dd67f9683e6e533dd5e49059e42359) C:\Windows\system32\DRIVERS\btiapan.sys
11:29:54.0338 2848    BTiAPan - ok
11:29:54.0370 2848    btiarcp         (babab04a469845c1a3e7ed4f28b7e654) C:\Windows\system32\DRIVERS\btiarcp.sys
11:29:54.0370 2848    btiarcp - ok
11:29:54.0401 2848    btiaspp         (bf43aa9ea27ec82f37938a52ddaef53b) C:\Windows\system32\DRIVERS\btiaspp.sys
11:29:54.0448 2848    btiaspp - ok
11:29:54.0479 2848    BTIAUSB         (6db8264c3e751648bf69d1d23fce8b10) C:\Windows\system32\DRIVERS\btiausb.sys
11:29:54.0526 2848    BTIAUSB - ok
11:29:54.0604 2848    BTKRNL          (dd5e46fdcd91d4fc2c5e07af7b27e172) C:\Windows\system32\DRIVERS\btkrnl.sys
11:29:54.0620 2848    BTKRNL - ok
11:29:54.0651 2848    BTPROT          (d9c0214aa868a8cc8b39815e8e12e3d8) C:\Windows\system32\DRIVERS\btprot.sys
11:29:54.0666 2848    BTPROT - ok
11:29:54.0698 2848    catchme - ok
11:29:54.0729 2848    cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
11:29:54.0729 2848    cdfs - ok
11:29:54.0776 2848    cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
11:29:54.0807 2848    cdrom - ok
11:29:54.0838 2848    circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
11:29:54.0838 2848    circlass - ok
11:29:54.0885 2848    CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
11:29:54.0885 2848    CLFS - ok
11:29:54.0948 2848    CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
11:29:54.0963 2848    CmBatt - ok
11:29:54.0995 2848    cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
11:29:55.0010 2848    cmdide - ok
11:29:55.0041 2848    CNG             (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
11:29:55.0057 2848    CNG - ok
11:29:55.0088 2848    Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
11:29:55.0104 2848    Compbatt - ok
11:29:55.0135 2848    CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
11:29:55.0135 2848    CompositeBus - ok
11:29:55.0166 2848    crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
11:29:55.0166 2848    crcdisk - ok
11:29:55.0198 2848    CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
11:29:55.0213 2848    CSC - ok
11:29:55.0245 2848    DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
11:29:55.0245 2848    DfsC - ok
11:29:55.0260 2848    dgderdrv - ok
11:29:55.0276 2848    dg_ssudbus      (388039f99ce8769024ee0438352aca99) C:\Windows\system32\DRIVERS\ssudbus.sys
11:29:55.0307 2848    dg_ssudbus - ok
11:29:55.0323 2848    discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
11:29:55.0323 2848    discache - ok
11:29:55.0354 2848    Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
11:29:55.0354 2848    Disk - ok
11:29:55.0416 2848    drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
11:29:55.0416 2848    drmkaud - ok
11:29:55.0448 2848    DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
11:29:55.0463 2848    DXGKrnl - ok
11:29:55.0495 2848    E1G60           (edc6e9c057c9d7f83eea22b4cef5dcad) C:\Windows\system32\DRIVERS\E1G6032E.sys
11:29:55.0510 2848    E1G60 - ok
11:29:55.0541 2848    eamonm          (13533557d01b88c83110d5cf749f14d7) C:\Windows\system32\DRIVERS\eamonm.sys
11:29:55.0557 2848    eamonm - ok
11:29:55.0666 2848    ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
11:29:55.0729 2848    ebdrv - ok
11:29:55.0760 2848    ehdrv           (e097728129e7b79bf1089d7aef42332b) C:\Windows\system32\DRIVERS\ehdrv.sys
11:29:55.0776 2848    ehdrv - ok
11:29:55.0823 2848    elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
11:29:55.0823 2848    elxstor - ok
11:29:55.0838 2848    epfwwfpr        (2380976cf8a4a56611f35633acd2a74f) C:\Windows\system32\DRIVERS\epfwwfpr.sys
11:29:55.0838 2848    epfwwfpr - ok
11:29:55.0870 2848    ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
11:29:55.0885 2848    ErrDev - ok
11:29:55.0932 2848    exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
11:29:55.0963 2848    exfat - ok
11:29:55.0995 2848    fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
11:29:56.0041 2848    fastfat - ok
11:29:56.0073 2848    fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
11:29:56.0104 2848    fdc - ok
11:29:56.0120 2848    FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
11:29:56.0135 2848    FileInfo - ok
11:29:56.0135 2848    Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
11:29:56.0151 2848    Filetrace - ok
11:29:56.0166 2848    flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
11:29:56.0166 2848    flpydisk - ok
11:29:56.0198 2848    FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
11:29:56.0213 2848    FltMgr - ok
11:29:56.0229 2848    FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
11:29:56.0245 2848    FsDepends - ok
11:29:56.0245 2848    Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
11:29:56.0260 2848    Fs_Rec - ok
11:29:56.0276 2848    fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
11:29:56.0276 2848    fvevol - ok
11:29:56.0291 2848    gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
11:29:56.0354 2848    gagp30kx - ok
11:29:56.0370 2848    hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
11:29:56.0370 2848    hcw85cir - ok
11:29:56.0401 2848    HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
11:29:56.0401 2848    HdAudAddService - ok
11:29:56.0432 2848    HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
11:29:56.0432 2848    HDAudBus - ok
11:29:56.0448 2848    HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
11:29:56.0510 2848    HidBatt - ok
11:29:56.0526 2848    HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
11:29:56.0541 2848    HidBth - ok
11:29:56.0541 2848    HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
11:29:56.0573 2848    HidIr - ok
11:29:56.0604 2848    HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
11:29:56.0635 2848    HidUsb - ok
11:29:56.0682 2848    HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
11:29:56.0698 2848    HpSAMD - ok
11:29:56.0745 2848    HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
11:29:56.0760 2848    HTTP - ok
11:29:56.0791 2848    hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
11:29:56.0791 2848    hwpolicy - ok
11:29:56.0823 2848    i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
11:29:56.0870 2848    i8042prt - ok
11:29:56.0916 2848    iAnywhere_btAudio (8287222c98db780a5b6107a6ac7db0ea) C:\Windows\system32\drivers\btiasco.sys
11:29:56.0916 2848    iAnywhere_btAudio - ok
11:29:56.0948 2848    iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
11:29:56.0995 2848    iaStorV - ok
11:29:57.0010 2848    iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
11:29:57.0010 2848    iirsp - ok
11:29:57.0120 2848    IntcAzAudAddService (f04d22d7a49a1b2210dbadf0b803e870) C:\Windows\system32\drivers\RTKVHD64.sys
11:29:57.0166 2848    IntcAzAudAddService - ok
11:29:57.0182 2848    intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
11:29:57.0182 2848    intelide - ok
11:29:57.0198 2848    intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
11:29:57.0229 2848    intelppm - ok
11:29:57.0245 2848    IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:29:57.0260 2848    IpFilterDriver - ok
11:29:57.0276 2848    IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
11:29:57.0276 2848    IPMIDRV - ok
11:29:57.0291 2848    IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
11:29:57.0307 2848    IPNAT - ok
11:29:57.0338 2848    IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
11:29:57.0338 2848    IRENUM - ok
11:29:57.0354 2848    isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
11:29:57.0370 2848    isapnp - ok
11:29:57.0401 2848    iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
11:29:57.0416 2848    iScsiPrt - ok
11:29:57.0448 2848    kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
11:29:57.0448 2848    kbdclass - ok
11:29:57.0463 2848    kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
11:29:57.0463 2848    kbdhid - ok
11:29:57.0495 2848    KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
11:29:57.0495 2848    KSecDD - ok
11:29:57.0541 2848    KSecPkg         (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
11:29:57.0541 2848    KSecPkg - ok
11:29:57.0557 2848    ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
11:29:57.0604 2848    ksthunk - ok
11:29:57.0666 2848    lirsgt          (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys
11:29:57.0698 2848    lirsgt - ok
11:29:57.0713 2848    lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
11:29:57.0729 2848    lltdio - ok
11:29:57.0776 2848    LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
11:29:57.0791 2848    LSI_FC - ok
11:29:57.0807 2848    LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
11:29:57.0823 2848    LSI_SAS - ok
11:29:57.0838 2848    LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
11:29:57.0854 2848    LSI_SAS2 - ok
11:29:57.0870 2848    LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
11:29:57.0901 2848    LSI_SCSI - ok
11:29:57.0916 2848    luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
11:29:57.0916 2848    luafv - ok
11:29:57.0932 2848    megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
11:29:57.0963 2848    megasas - ok
11:29:57.0995 2848    MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
11:29:58.0010 2848    MegaSR - ok
11:29:58.0026 2848    Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
11:29:58.0041 2848    Modem - ok
11:29:58.0057 2848    monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
11:29:58.0073 2848    monitor - ok
11:29:58.0104 2848    mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
11:29:58.0104 2848    mouclass - ok
11:29:58.0135 2848    mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
11:29:58.0135 2848    mouhid - ok
11:29:58.0182 2848    mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
11:29:58.0182 2848    mountmgr - ok
11:29:58.0198 2848    mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
11:29:58.0213 2848    mpio - ok
11:29:58.0229 2848    mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
11:29:58.0245 2848    mpsdrv - ok
11:29:58.0291 2848    MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
11:29:58.0291 2848    MRxDAV - ok
11:29:58.0323 2848    mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
11:29:58.0338 2848    mrxsmb - ok
11:29:58.0354 2848    mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:29:58.0416 2848    mrxsmb10 - ok
11:29:58.0432 2848    mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:29:58.0448 2848    mrxsmb20 - ok
11:29:58.0463 2848    msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
11:29:58.0479 2848    msahci - ok
11:29:58.0495 2848    msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
11:29:58.0510 2848    msdsm - ok
11:29:58.0526 2848    Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
11:29:58.0526 2848    Msfs - ok
11:29:58.0541 2848    mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
11:29:58.0541 2848    mshidkmdf - ok
11:29:58.0573 2848    msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
11:29:58.0573 2848    msisadrv - ok
11:29:58.0604 2848    MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
11:29:58.0604 2848    MSKSSRV - ok
11:29:58.0620 2848    MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
11:29:58.0620 2848    MSPCLOCK - ok
11:29:58.0651 2848    MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
11:29:58.0666 2848    MSPQM - ok
11:29:58.0682 2848    MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
11:29:58.0698 2848    MsRPC - ok
11:29:58.0698 2848    mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
11:29:58.0713 2848    mssmbios - ok
11:29:58.0713 2848    MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
11:29:58.0713 2848    MSTEE - ok
11:29:58.0745 2848    MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
11:29:58.0745 2848    MTConfig - ok
11:29:58.0760 2848    Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
11:29:58.0776 2848    Mup - ok
11:29:58.0823 2848    NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
11:29:58.0870 2848    NativeWifiP - ok
11:29:58.0932 2848    NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
11:29:58.0948 2848    NDIS - ok
11:29:58.0979 2848    NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
11:29:58.0995 2848    NdisCap - ok
11:29:59.0026 2848    NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
11:29:59.0026 2848    NdisTapi - ok
11:29:59.0057 2848    Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
11:29:59.0057 2848    Ndisuio - ok
11:29:59.0088 2848    NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
11:29:59.0135 2848    NdisWan - ok
11:29:59.0166 2848    NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
11:29:59.0229 2848    NDProxy - ok
11:29:59.0229 2848    NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
11:29:59.0245 2848    NetBIOS - ok
11:29:59.0260 2848    NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
11:29:59.0260 2848    NetBT - ok
11:29:59.0307 2848    nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
11:29:59.0338 2848    nfrd960 - ok
11:29:59.0370 2848    Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
11:29:59.0401 2848    Npfs - ok
11:29:59.0432 2848    nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
11:29:59.0432 2848    nsiproxy - ok
11:29:59.0510 2848    Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
11:29:59.0557 2848    Ntfs - ok
11:29:59.0588 2848    Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
11:29:59.0604 2848    Null - ok
11:29:59.0651 2848    NVENETFD        (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
11:29:59.0666 2848    NVENETFD - ok
11:29:59.0713 2848    NVNET           (0aa2a6aae14bdf0bea29056ee759b200) C:\Windows\system32\DRIVERS\nvmf6264.sys
11:29:59.0745 2848    NVNET - ok
11:29:59.0776 2848    nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
11:29:59.0807 2848    nvraid - ok
11:29:59.0838 2848    nvsmu           (e58d81fb8616d0cb55c1e36aa0b213c9) C:\Windows\system32\DRIVERS\nvsmu.sys
11:29:59.0854 2848    nvsmu - ok
11:29:59.0870 2848    nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
11:29:59.0901 2848    nvstor - ok
11:29:59.0916 2848    nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
11:29:59.0932 2848    nv_agp - ok
11:29:59.0948 2848    ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
11:29:59.0963 2848    ohci1394 - ok
11:29:59.0995 2848    Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
11:30:00.0010 2848    Parport - ok
11:30:00.0041 2848    partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
11:30:00.0073 2848    partmgr - ok
11:30:00.0104 2848    pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
11:30:00.0135 2848    pci - ok
11:30:00.0151 2848    pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
11:30:00.0151 2848    pciide - ok
11:30:00.0182 2848    pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
11:30:00.0198 2848    pcmcia - ok
11:30:00.0213 2848    pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
11:30:00.0229 2848    pcw - ok
11:30:00.0245 2848    PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
11:30:00.0260 2848    PEAUTH - ok
11:30:00.0291 2848    PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
11:30:00.0338 2848    PptpMiniport - ok
11:30:00.0354 2848    Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
11:30:00.0370 2848    Processor - ok
11:30:00.0401 2848    Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
11:30:00.0401 2848    Psched - ok
11:30:00.0463 2848    ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
11:30:00.0495 2848    ql2300 - ok
11:30:00.0510 2848    ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
11:30:00.0510 2848    ql40xx - ok
11:30:00.0526 2848    QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
11:30:00.0526 2848    QWAVEdrv - ok
11:30:00.0573 2848    RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
11:30:00.0588 2848    RasAcd - ok
11:30:00.0620 2848    RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
11:30:00.0620 2848    RasAgileVpn - ok
11:30:00.0666 2848    Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
11:30:00.0729 2848    Rasl2tp - ok
11:30:00.0745 2848    RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
11:30:00.0745 2848    RasPppoe - ok
11:30:00.0760 2848    RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
11:30:00.0776 2848    RasSstp - ok
11:30:00.0807 2848    rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
11:30:00.0807 2848    rdbss - ok
11:30:00.0823 2848    rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
11:30:00.0854 2848    rdpbus - ok
11:30:00.0870 2848    RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
11:30:00.0870 2848    RDPCDD - ok
11:30:00.0901 2848    RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
11:30:00.0916 2848    RDPDR - ok
11:30:00.0948 2848    RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
11:30:00.0948 2848    RDPENCDD - ok
11:30:00.0963 2848    RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
11:30:00.0963 2848    RDPREFMP - ok
11:30:00.0995 2848    RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
11:30:01.0041 2848    RdpVideoMiniport - ok
11:30:01.0073 2848    RDPWD           (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
11:30:01.0120 2848    RDPWD - ok
11:30:01.0166 2848    rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
11:30:01.0166 2848    rdyboost - ok
11:30:01.0229 2848    RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
11:30:01.0276 2848    RFCOMM - ok
11:30:01.0307 2848    rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
11:30:01.0323 2848    rspndr - ok
11:30:01.0338 2848    s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
11:30:01.0338 2848    s3cap - ok
11:30:01.0370 2848    sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
11:30:01.0416 2848    sbp2port - ok
11:30:01.0448 2848    scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
11:30:01.0479 2848    scfilter - ok
11:30:01.0510 2848    secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
11:30:01.0526 2848    secdrv - ok
11:30:01.0541 2848    Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
11:30:01.0557 2848    Serenum - ok
11:30:01.0557 2848    Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
11:30:01.0588 2848    Serial - ok
11:30:01.0620 2848    sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
11:30:01.0635 2848    sermouse - ok
11:30:01.0651 2848    sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
11:30:01.0666 2848    sffdisk - ok
11:30:01.0682 2848    sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
11:30:01.0698 2848    sffp_mmc - ok
11:30:01.0713 2848    sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
11:30:01.0713 2848    sffp_sd - ok
11:30:01.0729 2848    sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
11:30:01.0745 2848    sfloppy - ok
11:30:01.0776 2848    SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
11:30:01.0791 2848    SiSRaid2 - ok
11:30:01.0807 2848    SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
11:30:01.0823 2848    SiSRaid4 - ok
11:30:01.0838 2848    Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
11:30:01.0854 2848    Smb - ok
11:30:01.0885 2848    spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
11:30:02.0791 2848    spldr - ok
11:30:02.0932 2848    sptd            (a6cff1af7664627a296b6a0a96cf876e) C:\Windows\System32\Drivers\sptd.sys
11:30:02.0932 2848    Suspicious file (NoAccess): C:\Windows\System32\Drivers\sptd.sys. md5: a6cff1af7664627a296b6a0a96cf876e
11:30:02.0932 2848    sptd ( LockedFile.Multi.Generic ) - warning
11:30:02.0932 2848    sptd - detected LockedFile.Multi.Generic (1)
11:30:02.0979 2848    srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
11:30:03.0057 2848    srv - ok
11:30:03.0104 2848    srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
11:30:03.0135 2848    srv2 - ok
11:30:03.0151 2848    srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
11:30:03.0166 2848    srvnet - ok
11:30:03.0198 2848    ssudmdm         (ad42ca614e086bcadbd53fffc404ac24) C:\Windows\system32\DRIVERS\ssudmdm.sys
11:30:03.0229 2848    ssudmdm - ok
11:30:03.0245 2848    ssudobex        (a23bc4049f6a1820bc82eab492950890) C:\Windows\system32\DRIVERS\ssudobex.sys
11:30:03.0276 2848    ssudobex - ok
11:30:03.0291 2848    stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
11:30:03.0291 2848    stexstor - ok
11:30:03.0338 2848    storflt         (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
11:30:03.0338 2848    storflt - ok
11:30:03.0354 2848    storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
11:30:03.0401 2848    storvsc - ok
11:30:03.0416 2848    swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
11:30:03.0432 2848    swenum - ok
11:30:03.0526 2848    Synth3dVsc - ok
11:30:03.0573 2848    tap0901t        (b08740047145b9bce15bf75ca0f9718a) C:\Windows\system32\DRIVERS\tap0901t.sys
11:30:03.0573 2848    tap0901t - ok
11:30:03.0651 2848    Tcpip           (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
11:30:03.0698 2848    Tcpip - ok
11:30:03.0760 2848    TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
11:30:03.0776 2848    TCPIP6 - ok
11:30:03.0807 2848    tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
11:30:03.0807 2848    tcpipreg - ok
11:30:03.0838 2848    TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
11:30:03.0854 2848    TDPIPE - ok
11:30:03.0870 2848    TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
11:30:03.0885 2848    TDTCP - ok
11:30:03.0901 2848    tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
11:30:03.0916 2848    tdx - ok
11:30:03.0948 2848    TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
11:30:03.0963 2848    TermDD - ok
11:30:03.0995 2848    tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
11:30:03.0995 2848    tssecsrv - ok
11:30:04.0041 2848    TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
11:30:04.0104 2848    TsUsbFlt - ok
11:30:04.0120 2848    tsusbhub - ok
11:30:04.0151 2848    tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
11:30:04.0198 2848    tunnel - ok
11:30:04.0213 2848    uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
11:30:04.0229 2848    uagp35 - ok
11:30:04.0260 2848    udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
11:30:04.0276 2848    udfs - ok
11:30:04.0323 2848    uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
11:30:04.0370 2848    uliagpkx - ok
11:30:04.0401 2848    umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
11:30:04.0432 2848    umbus - ok
11:30:04.0448 2848    UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
11:30:04.0463 2848    UmPass - ok
11:30:04.0495 2848    usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
11:30:04.0510 2848    usbccgp - ok
11:30:04.0526 2848    usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
11:30:04.0541 2848    usbcir - ok
11:30:04.0557 2848    usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
11:30:04.0573 2848    usbehci - ok
11:30:04.0588 2848    usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
11:30:04.0604 2848    usbhub - ok
11:30:04.0620 2848    usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
11:30:04.0635 2848    usbohci - ok
11:30:04.0651 2848    usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
11:30:04.0666 2848    usbprint - ok
11:30:04.0698 2848    USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:30:04.0729 2848    USBSTOR - ok
11:30:04.0745 2848    usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
11:30:04.0745 2848    usbuhci - ok
11:30:04.0791 2848    usb_rndisx      (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys
11:30:04.0838 2848    usb_rndisx - ok
11:30:04.0870 2848    vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
11:30:04.0901 2848    vdrvroot - ok
11:30:04.0932 2848    vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
11:30:04.0932 2848    vga - ok
11:30:04.0948 2848    VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
11:30:04.0963 2848    VgaSave - ok
11:30:04.0979 2848    VGPU - ok
11:30:05.0010 2848    vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
11:30:05.0026 2848    vhdmp - ok
11:30:05.0041 2848    viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
11:30:05.0041 2848    viaide - ok
11:30:05.0073 2848    vmbus           (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
11:30:05.0104 2848    vmbus - ok
11:30:05.0120 2848    VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
11:30:05.0135 2848    VMBusHID - ok
11:30:05.0151 2848    volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
11:30:05.0166 2848    volmgr - ok
11:30:05.0198 2848    volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
11:30:05.0198 2848    volmgrx - ok
11:30:05.0229 2848    volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
11:30:05.0245 2848    volsnap - ok
11:30:05.0276 2848    vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
11:30:05.0291 2848    vsmraid - ok
11:30:05.0307 2848    vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
11:30:05.0323 2848    vwifibus - ok
11:30:05.0338 2848    WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
11:30:05.0338 2848    WacomPen - ok
11:30:05.0385 2848    WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:30:05.0416 2848    WANARP - ok
11:30:05.0416 2848    Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:30:05.0416 2848    Wanarpv6 - ok
11:30:05.0463 2848    Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
11:30:05.0463 2848    Wd - ok
11:30:05.0495 2848    Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
11:30:05.0495 2848    Wdf01000 - ok
11:30:05.0526 2848    WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
11:30:05.0541 2848    WfpLwf - ok
11:30:05.0557 2848    WimFltr         (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
11:30:05.0635 2848    WimFltr - ok
11:30:05.0651 2848    WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
11:30:05.0666 2848    WIMMount - ok
11:30:05.0745 2848    WinUSB          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys
11:30:05.0760 2848    WinUSB - ok
11:30:05.0807 2848    WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
11:30:05.0823 2848    WmiAcpi - ok
11:30:05.0854 2848    ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
11:30:05.0854 2848    ws2ifsl - ok
11:30:05.0901 2848    WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
11:30:05.0916 2848    WudfPf - ok
11:30:05.0963 2848    WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
11:30:05.0995 2848    WUDFRd - ok
11:30:06.0026 2848    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
11:30:06.0088 2848    \Device\Harddisk0\DR0 - ok
11:30:06.0088 2848    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1
11:30:06.0120 2848    \Device\Harddisk1\DR1 - ok
11:30:06.0120 2848    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk2\DR2
11:30:06.0120 2848    \Device\Harddisk2\DR2 - ok
11:30:06.0135 2848    Boot (0x1200)   (62df4fb253dda7d53501613927f5ce3c) \Device\Harddisk0\DR0\Partition0
11:30:06.0135 2848    \Device\Harddisk0\DR0\Partition0 - ok
11:30:06.0151 2848    Boot (0x1200)   (47cd7ea8508ea82cb372883c67949ea3) \Device\Harddisk0\DR0\Partition1
11:30:06.0151 2848    \Device\Harddisk0\DR0\Partition1 - ok
11:30:06.0151 2848    Boot (0x1200)   (66d76974dc4655b7869f8b1177edb6bf) \Device\Harddisk1\DR1\Partition0
11:30:06.0151 2848    \Device\Harddisk1\DR1\Partition0 - ok
11:30:06.0166 2848    Boot (0x1200)   (8209ac3f32b685b5b995d3cf212403a1) \Device\Harddisk1\DR1\Partition1
11:30:06.0166 2848    \Device\Harddisk1\DR1\Partition1 - ok
11:30:06.0166 2848    Boot (0x1200)   (87bd728fda51ea26db9b576395d507a0) \Device\Harddisk2\DR2\Partition0
11:30:06.0166 2848    \Device\Harddisk2\DR2\Partition0 - ok
11:30:06.0166 2848    ============================================================
11:30:06.0166 2848    Scan finished
11:30:06.0166 2848    ============================================================
11:30:06.0182 5236    Detected object count: 1
11:30:06.0182 5236    Actual detected object count: 1
11:31:18.0354 5236    sptd ( LockedFile.Multi.Generic ) - skipped by user
11:31:18.0354 5236    sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
11:31:36.0401 3052    ============================================================
11:31:36.0401 3052    Scan started
11:31:36.0401 3052    Mode: Manual; SigCheck; TDLFS; 
11:31:36.0401 3052    ============================================================
11:31:37.0870 3052    1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
11:31:37.0979 3052    1394ohci - ok
11:31:38.0010 3052    ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
11:31:38.0010 3052    ACPI - ok
11:31:38.0041 3052    AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
11:31:38.0104 3052    AcpiPmi - ok
11:31:38.0151 3052    adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
11:31:38.0198 3052    adp94xx - ok
11:31:38.0229 3052    adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
11:31:38.0276 3052    adpahci - ok
11:31:38.0291 3052    adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
11:31:38.0291 3052    adpu320 - ok
11:31:38.0338 3052    AFD             (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
11:31:38.0385 3052    AFD - ok
11:31:38.0416 3052    agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
11:31:38.0432 3052    agp440 - ok
11:31:38.0448 3052    aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
11:31:38.0448 3052    aliide - ok
11:31:38.0463 3052    amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
11:31:38.0479 3052    amdide - ok
11:31:38.0495 3052    amdiox64        (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
11:31:38.0526 3052    amdiox64 - ok
11:31:38.0541 3052    AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
11:31:38.0588 3052    AmdK8 - ok
11:31:38.0823 3052    amdkmdag        (0415ffe1b6a6ea141feafca57567f57f) C:\Windows\system32\DRIVERS\atikmdag.sys
11:31:39.0073 3052    amdkmdag - ok
11:31:39.0182 3052    amdkmdap        (dc24d6f38f17c0d643d9aa8a6852f8d0) C:\Windows\system32\DRIVERS\atikmpag.sys
11:31:39.0229 3052    amdkmdap - ok
11:31:39.0245 3052    AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
11:31:39.0276 3052    AmdPPM - ok
11:31:39.0307 3052    amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
11:31:39.0307 3052    amdsata - ok
11:31:39.0323 3052    amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
11:31:39.0338 3052    amdsbs - ok
11:31:39.0354 3052    amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
11:31:39.0354 3052    amdxata - ok
11:31:39.0401 3052    AODDriver4.01   (f312fad7dbd49ed21a194ac71b497832) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
11:31:39.0416 3052    AODDriver4.01 - ok
11:31:39.0432 3052    AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
11:31:39.0588 3052    AppID - ok
11:31:39.0620 3052    arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
11:31:39.0620 3052    arc - ok
11:31:39.0635 3052    arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
11:31:39.0651 3052    arcsas - ok
11:31:39.0666 3052    AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
11:31:39.0838 3052    AsyncMac - ok
11:31:39.0870 3052    atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
11:31:39.0870 3052    atapi - ok
11:31:39.0901 3052    AtiHDAudioService (dbb487d09f56c674430ac454fd8bcab9) C:\Windows\system32\drivers\AtihdW76.sys
11:31:39.0916 3052    AtiHDAudioService - ok
11:31:39.0948 3052    atksgt          (fc0e8778c000291caf60eb88c011e931) C:\Windows\system32\DRIVERS\atksgt.sys
11:31:39.0963 3052    atksgt - ok
11:31:39.0995 3052    b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
11:31:40.0057 3052    b06bdrv - ok
11:31:40.0088 3052    b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
11:31:40.0151 3052    b57nd60a - ok
11:31:40.0182 3052    Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
11:31:40.0229 3052    Beep - ok
11:31:40.0245 3052    blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
11:31:40.0260 3052    blbdrive - ok
11:31:40.0291 3052    bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
11:31:40.0323 3052    bowser - ok
11:31:40.0354 3052    BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
11:31:40.0401 3052    BrFiltLo - ok
11:31:40.0432 3052    BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
11:31:40.0432 3052    BrFiltUp - ok
11:31:40.0463 3052    BridgeMP        (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
11:31:40.0495 3052    BridgeMP - ok
11:31:40.0526 3052    Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
11:31:40.0573 3052    Brserid - ok
11:31:40.0588 3052    BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
11:31:40.0604 3052    BrSerWdm - ok
11:31:40.0620 3052    BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
11:31:40.0651 3052    BrUsbMdm - ok
11:31:40.0666 3052    BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
11:31:40.0713 3052    BrUsbSer - ok
11:31:40.0745 3052    BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys
11:31:40.0791 3052    BthEnum - ok
11:31:40.0823 3052    BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
11:31:40.0870 3052    BTHMODEM - ok
11:31:40.0901 3052    BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
11:31:40.0948 3052    BthPan - ok
11:31:40.0995 3052    BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\system32\Drivers\BTHport.sys
11:31:41.0041 3052    BTHPORT - ok
11:31:41.0073 3052    BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\system32\Drivers\BTHUSB.sys
11:31:41.0104 3052    BTHUSB - ok
11:31:41.0135 3052    btiaa2dp        (2e5a2233303800c7c2e9999fc6bf9b27) C:\Windows\system32\drivers\btiaa2dp.sys
11:31:41.0182 3052    btiaa2dp - ok
11:31:41.0229 3052    BTiAPan         (a0dd67f9683e6e533dd5e49059e42359) C:\Windows\system32\DRIVERS\btiapan.sys
11:31:41.0276 3052    BTiAPan - ok
11:31:41.0291 3052    btiarcp         (babab04a469845c1a3e7ed4f28b7e654) C:\Windows\system32\DRIVERS\btiarcp.sys
11:31:41.0338 3052    btiarcp - ok
11:31:41.0370 3052    btiaspp         (bf43aa9ea27ec82f37938a52ddaef53b) C:\Windows\system32\DRIVERS\btiaspp.sys
11:31:41.0416 3052    btiaspp - ok
11:31:41.0448 3052    BTIAUSB         (6db8264c3e751648bf69d1d23fce8b10) C:\Windows\system32\DRIVERS\btiausb.sys
11:31:41.0495 3052    BTIAUSB - ok
11:31:41.0541 3052    BTKRNL          (dd5e46fdcd91d4fc2c5e07af7b27e172) C:\Windows\system32\DRIVERS\btkrnl.sys
11:31:41.0588 3052    BTKRNL - ok
11:31:41.0604 3052    BTPROT          (d9c0214aa868a8cc8b39815e8e12e3d8) C:\Windows\system32\DRIVERS\btprot.sys
11:31:41.0620 3052    BTPROT - ok
11:31:41.0635 3052    catchme - ok
11:31:41.0651 3052    cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
11:31:41.0698 3052    cdfs - ok
11:31:41.0729 3052    cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
11:31:41.0760 3052    cdrom - ok
11:31:41.0776 3052    circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
11:31:41.0791 3052    circlass - ok
11:31:41.0823 3052    CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
11:31:41.0854 3052    CLFS - ok
11:31:41.0885 3052    CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
11:31:41.0916 3052    CmBatt - ok
11:31:41.0948 3052    cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
11:31:41.0948 3052    cmdide - ok
11:31:41.0995 3052    CNG             (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
11:31:42.0026 3052    CNG - ok
11:31:42.0041 3052    Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
11:31:42.0057 3052    Compbatt - ok
11:31:42.0073 3052    CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
11:31:42.0088 3052    CompositeBus - ok
11:31:42.0104 3052    crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
11:31:42.0120 3052    crcdisk - ok
11:31:42.0151 3052    CSC             (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
11:31:42.0182 3052    CSC - ok
11:31:42.0229 3052    DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
11:31:42.0291 3052    DfsC - ok
11:31:42.0307 3052    dgderdrv - ok
11:31:42.0323 3052    dg_ssudbus      (388039f99ce8769024ee0438352aca99) C:\Windows\system32\DRIVERS\ssudbus.sys
11:31:42.0338 3052    dg_ssudbus - ok
11:31:42.0354 3052    discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
11:31:42.0385 3052    discache - ok
11:31:42.0385 3052    Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
11:31:42.0401 3052    Disk - ok
11:31:42.0432 3052    drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
11:31:42.0448 3052    drmkaud - ok
11:31:42.0495 3052    DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
11:31:42.0510 3052    DXGKrnl - ok
11:31:42.0541 3052    E1G60           (edc6e9c057c9d7f83eea22b4cef5dcad) C:\Windows\system32\DRIVERS\E1G6032E.sys
11:31:42.0573 3052    E1G60 - ok
11:31:42.0604 3052    eamonm          (13533557d01b88c83110d5cf749f14d7) C:\Windows\system32\DRIVERS\eamonm.sys
11:31:42.0604 3052    eamonm - ok
11:31:42.0713 3052    ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
11:31:42.0838 3052    ebdrv - ok
11:31:42.0870 3052    ehdrv           (e097728129e7b79bf1089d7aef42332b) C:\Windows\system32\DRIVERS\ehdrv.sys
11:31:42.0870 3052    ehdrv - ok
11:31:42.0901 3052    elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
11:31:42.0916 3052    elxstor - ok
11:31:42.0948 3052    epfwwfpr        (2380976cf8a4a56611f35633acd2a74f) C:\Windows\system32\DRIVERS\epfwwfpr.sys
11:31:42.0948 3052    epfwwfpr - ok
11:31:42.0979 3052    ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
11:31:43.0010 3052    ErrDev - ok
11:31:43.0057 3052    exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
11:31:43.0088 3052    exfat - ok
11:31:43.0104 3052    fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
11:31:43.0151 3052    fastfat - ok
11:31:43.0166 3052    fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
11:31:43.0182 3052    fdc - ok
11:31:43.0213 3052    FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
11:31:43.0213 3052    FileInfo - ok
11:31:43.0229 3052    Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
11:31:43.0291 3052    Filetrace - ok
11:31:43.0291 3052    flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
11:31:43.0307 3052    flpydisk - ok
11:31:43.0338 3052    FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
11:31:43.0338 3052    FltMgr - ok
11:31:43.0354 3052    FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
11:31:43.0370 3052    FsDepends - ok
11:31:43.0385 3052    Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
11:31:43.0385 3052    Fs_Rec - ok
11:31:43.0401 3052    fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
11:31:43.0416 3052    fvevol - ok
11:31:43.0432 3052    gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
11:31:43.0432 3052    gagp30kx - ok
11:31:43.0448 3052    hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
11:31:43.0479 3052    hcw85cir - ok
11:31:43.0495 3052    HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
11:31:43.0510 3052    HdAudAddService - ok
11:31:43.0526 3052    HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
11:31:43.0541 3052    HDAudBus - ok
11:31:43.0557 3052    HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
11:31:43.0573 3052    HidBatt - ok
11:31:43.0588 3052    HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
11:31:43.0635 3052    HidBth - ok
11:31:43.0651 3052    HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
11:31:43.0698 3052    HidIr - ok
11:31:43.0713 3052    HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
11:31:43.0729 3052    HidUsb - ok
11:31:43.0760 3052    HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
11:31:43.0760 3052    HpSAMD - ok
11:31:43.0807 3052    HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
11:31:43.0870 3052    HTTP - ok
11:31:43.0901 3052    hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
11:31:43.0901 3052    hwpolicy - ok
11:31:43.0916 3052    i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
11:31:43.0932 3052    i8042prt - ok
11:31:43.0963 3052    iAnywhere_btAudio (8287222c98db780a5b6107a6ac7db0ea) C:\Windows\system32\drivers\btiasco.sys
11:31:44.0010 3052    iAnywhere_btAudio - ok
11:31:44.0041 3052    iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
11:31:44.0073 3052    iaStorV - ok
11:31:44.0104 3052    iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
11:31:44.0135 3052    iirsp - ok
11:31:44.0229 3052    IntcAzAudAddService (f04d22d7a49a1b2210dbadf0b803e870) C:\Windows\system32\drivers\RTKVHD64.sys
11:31:44.0307 3052    IntcAzAudAddService - ok
11:31:44.0323 3052    intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
11:31:44.0338 3052    intelide - ok
11:31:44.0354 3052    intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
11:31:44.0370 3052    intelppm - ok
11:31:44.0401 3052    IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:31:44.0463 3052    IpFilterDriver - ok
11:31:44.0479 3052    IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
11:31:44.0495 3052    IPMIDRV - ok
11:31:44.0510 3052    IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
11:31:44.0557 3052    IPNAT - ok
11:31:44.0573 3052    IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
11:31:44.0635 3052    IRENUM - ok
11:31:44.0651 3052    isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
11:31:44.0666 3052    isapnp - ok
11:31:44.0698 3052    iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
11:31:44.0729 3052    iScsiPrt - ok
11:31:44.0745 3052    kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
11:31:44.0760 3052    kbdclass - ok
11:31:44.0791 3052    kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
11:31:44.0807 3052    kbdhid - ok
11:31:44.0854 3052    KSecDD          (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
11:31:44.0854 3052    KSecDD - ok
11:31:44.0885 3052    KSecPkg         (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
11:31:44.0901 3052    KSecPkg - ok
11:31:44.0916 3052    ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
11:31:44.0948 3052    ksthunk - ok
11:31:44.0995 3052    lirsgt          (156ab2e56dc3ca0b582e3362e07cded7) C:\Windows\system32\DRIVERS\lirsgt.sys
11:31:44.0995 3052    lirsgt - ok
11:31:45.0010 3052    lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
11:31:45.0057 3052    lltdio - ok
11:31:45.0073 3052    LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
11:31:45.0073 3052    LSI_FC - ok
11:31:45.0088 3052    LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
11:31:45.0088 3052    LSI_SAS - ok
11:31:45.0104 3052    LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
11:31:45.0104 3052    LSI_SAS2 - ok
11:31:45.0120 3052    LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
11:31:45.0135 3052    LSI_SCSI - ok
11:31:45.0151 3052    luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
11:31:45.0182 3052    luafv - ok
11:31:45.0198 3052    megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
11:31:45.0198 3052    megasas - ok
11:31:45.0213 3052    MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
11:31:45.0229 3052    MegaSR - ok
11:31:45.0245 3052    Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
11:31:45.0291 3052    Modem - ok
11:31:45.0307 3052    monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
11:31:45.0338 3052    monitor - ok
11:31:45.0370 3052    mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
11:31:45.0385 3052    mouclass - ok
11:31:45.0401 3052    mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
11:31:45.0432 3052    mouhid - ok
11:31:45.0463 3052    mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
11:31:45.0463 3052    mountmgr - ok
11:31:45.0495 3052    mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
11:31:45.0495 3052    mpio - ok
11:31:45.0510 3052    mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
11:31:45.0557 3052    mpsdrv - ok
11:31:45.0588 3052    MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
11:31:45.0604 3052    MRxDAV - ok
11:31:45.0635 3052    mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
11:31:45.0651 3052    mrxsmb - ok
11:31:45.0682 3052    mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:31:45.0713 3052    mrxsmb10 - ok
11:31:45.0729 3052    mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:31:45.0745 3052    mrxsmb20 - ok
11:31:45.0760 3052    msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
11:31:45.0776 3052    msahci - ok
11:31:45.0791 3052    msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
11:31:45.0807 3052    msdsm - ok
11:31:45.0823 3052    Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
11:31:45.0854 3052    Msfs - ok
11:31:45.0870 3052    mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
11:31:45.0901 3052    mshidkmdf - ok
11:31:45.0916 3052    msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
11:31:45.0932 3052    msisadrv - ok
11:31:45.0948 3052    MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
11:31:46.0026 3052    MSKSSRV - ok
11:31:46.0041 3052    MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
11:31:46.0073 3052    MSPCLOCK - ok
11:31:46.0088 3052    MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
11:31:46.0182 3052    MSPQM - ok
11:31:46.0213 3052    MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
11:31:46.0213 3052    MsRPC - ok
11:31:46.0229 3052    mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
11:31:46.0229 3052    mssmbios - ok
11:31:46.0245 3052    MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
11:31:46.0276 3052    MSTEE - ok
11:31:46.0291 3052    MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
11:31:46.0323 3052    MTConfig - ok
11:31:46.0338 3052    Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
11:31:46.0338 3052    Mup - ok
11:31:46.0370 3052    NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
11:31:46.0432 3052    NativeWifiP - ok
11:31:46.0463 3052    NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
11:31:46.0495 3052    NDIS - ok
11:31:46.0510 3052    NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
11:31:46.0541 3052    NdisCap - ok
11:31:46.0573 3052    NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
11:31:46.0620 3052    NdisTapi - ok
11:31:46.0651 3052    Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
11:31:46.0666 3052    Ndisuio - ok
11:31:46.0698 3052    NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
11:31:46.0729 3052    NdisWan - ok
11:31:46.0745 3052    NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
11:31:46.0791 3052    NDProxy - ok
11:31:46.0807 3052    NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
11:31:46.0838 3052    NetBIOS - ok
11:31:46.0870 3052    NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
11:31:46.0916 3052    NetBT - ok
11:31:46.0963 3052    nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
11:31:46.0963 3052    nfrd960 - ok
11:31:46.0979 3052    Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
11:31:47.0026 3052    Npfs - ok
11:31:47.0026 3052    nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
11:31:47.0057 3052    nsiproxy - ok
11:31:47.0120 3052    Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
11:31:47.0166 3052    Ntfs - ok
11:31:47.0182 3052    Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
11:31:47.0229 3052    Null - ok
11:31:47.0260 3052    NVENETFD        (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
11:31:47.0291 3052    NVENETFD - ok
11:31:47.0323 3052    NVNET           (0aa2a6aae14bdf0bea29056ee759b200) C:\Windows\system32\DRIVERS\nvmf6264.sys
11:31:47.0338 3052    NVNET - ok
11:31:47.0354 3052    nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
11:31:47.0370 3052    nvraid - ok
11:31:47.0385 3052    nvsmu           (e58d81fb8616d0cb55c1e36aa0b213c9) C:\Windows\system32\DRIVERS\nvsmu.sys
11:31:47.0385 3052    nvsmu - ok
11:31:47.0416 3052    nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
11:31:47.0416 3052    nvstor - ok
11:31:47.0448 3052    nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
11:31:47.0448 3052    nv_agp - ok
11:31:47.0479 3052    ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
11:31:47.0510 3052    ohci1394 - ok
11:31:47.0541 3052    Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
11:31:47.0573 3052    Parport - ok
11:31:47.0604 3052    partmgr         (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
11:31:47.0604 3052    partmgr - ok
11:31:47.0620 3052    pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
11:31:47.0635 3052    pci - ok
11:31:47.0651 3052    pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
11:31:47.0666 3052    pciide - ok
11:31:47.0682 3052    pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
11:31:47.0698 3052    pcmcia - ok
11:31:47.0713 3052    pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
11:31:47.0729 3052    pcw - ok
11:31:47.0745 3052    PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
11:31:47.0791 3052    PEAUTH - ok
11:31:47.0823 3052    PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
11:31:47.0854 3052    PptpMiniport - ok
11:31:47.0870 3052    Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
11:31:47.0901 3052    Processor - ok
11:31:47.0948 3052    Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
11:31:48.0010 3052    Psched - ok
11:31:48.0073 3052    ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
11:31:48.0120 3052    ql2300 - ok
11:31:48.0135 3052    ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
11:31:48.0135 3052    ql40xx - ok
11:31:48.0151 3052    QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
11:31:48.0182 3052    QWAVEdrv - ok
11:31:48.0198 3052    RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
11:31:48.0213 3052    RasAcd - ok
11:31:48.0245 3052    RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
11:31:48.0307 3052    RasAgileVpn - ok
11:31:48.0323 3052    Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
11:31:48.0354 3052    Rasl2tp - ok
11:31:48.0370 3052    RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
11:31:48.0401 3052    RasPppoe - ok
11:31:48.0416 3052    RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
11:31:48.0432 3052    RasSstp - ok
11:31:48.0479 3052    rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
11:31:48.0526 3052    rdbss - ok
11:31:48.0541 3052    rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
11:31:48.0573 3052    rdpbus - ok
11:31:48.0588 3052    RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
11:31:48.0635 3052    RDPCDD - ok
11:31:48.0651 3052    RDPDR           (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
11:31:48.0682 3052    RDPDR - ok
11:31:48.0698 3052    RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
11:31:48.0729 3052    RDPENCDD - ok
11:31:48.0745 3052    RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
11:31:48.0776 3052    RDPREFMP - ok
11:31:48.0807 3052    RdpVideoMiniport (70cba1a0c98600a2aa1863479b35cb90) C:\Windows\system32\drivers\rdpvideominiport.sys
11:31:48.0854 3052    RdpVideoMiniport - ok
11:31:48.0901 3052    RDPWD           (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
11:31:48.0979 3052    RDPWD - ok
11:31:49.0010 3052    rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
11:31:49.0026 3052    rdyboost - ok
11:31:49.0057 3052    RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
11:31:49.0073 3052    RFCOMM - ok
11:31:49.0104 3052    rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
11:31:49.0135 3052    rspndr - ok
11:31:49.0166 3052    s3cap           (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
11:31:49.0213 3052    s3cap - ok
11:31:49.0260 3052    sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
11:31:49.0276 3052    sbp2port - ok
11:31:49.0323 3052    scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
11:31:49.0401 3052    scfilter - ok
11:31:49.0416 3052    secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
11:31:49.0448 3052    secdrv - ok
11:31:49.0479 3052    Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
11:31:49.0495 3052    Serenum - ok
11:31:49.0495 3052    Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
11:31:49.0526 3052    Serial - ok
11:31:49.0541 3052    sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
11:31:49.0573 3052    sermouse - ok
11:31:49.0620 3052    sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
11:31:49.0635 3052    sffdisk - ok
11:31:49.0651 3052    sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
11:31:49.0682 3052    sffp_mmc - ok
11:31:49.0698 3052    sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
11:31:49.0713 3052    sffp_sd - ok
11:31:49.0745 3052    sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
11:31:49.0760 3052    sfloppy - ok
11:31:49.0791 3052    SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
11:31:49.0791 3052    SiSRaid2 - ok
11:31:49.0807 3052    SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
11:31:49.0823 3052    SiSRaid4 - ok
11:31:49.0854 3052    Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
11:31:49.0885 3052    Smb - ok
11:31:49.0901 3052    spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
11:31:49.0916 3052    spldr - ok
11:31:49.0963 3052    sptd            (a6cff1af7664627a296b6a0a96cf876e) C:\Windows\System32\Drivers\sptd.sys
11:31:49.0963 3052    Suspicious file (NoAccess): C:\Windows\System32\Drivers\sptd.sys. md5: a6cff1af7664627a296b6a0a96cf876e
11:31:49.0963 3052    sptd ( LockedFile.Multi.Generic ) - warning
11:31:49.0963 3052    sptd - detected LockedFile.Multi.Generic (1)
11:31:50.0010 3052    srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
11:31:50.0057 3052    srv - ok
11:31:50.0088 3052    srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
11:31:50.0120 3052    srv2 - ok
11:31:50.0135 3052    srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
11:31:50.0166 3052    srvnet - ok
11:31:50.0198 3052    ssudmdm         (ad42ca614e086bcadbd53fffc404ac24) C:\Windows\system32\DRIVERS\ssudmdm.sys
11:31:50.0198 3052    ssudmdm - ok
11:31:50.0213 3052    ssudobex        (a23bc4049f6a1820bc82eab492950890) C:\Windows\system32\DRIVERS\ssudobex.sys
11:31:50.0229 3052    ssudobex - ok
11:31:50.0245 3052    stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
11:31:50.0245 3052    stexstor - ok
11:31:50.0276 3052    storflt         (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
11:31:50.0276 3052    storflt - ok
11:31:50.0307 3052    storvsc         (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
11:31:50.0307 3052    storvsc - ok
11:31:50.0323 3052    swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
11:31:50.0338 3052    swenum - ok
11:31:50.0354 3052    Synth3dVsc - ok
11:31:50.0385 3052    tap0901t        (b08740047145b9bce15bf75ca0f9718a) C:\Windows\system32\DRIVERS\tap0901t.sys
11:31:50.0401 3052    tap0901t - ok
11:31:50.0479 3052    Tcpip           (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
11:31:50.0526 3052    Tcpip - ok
11:31:50.0557 3052    TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
11:31:50.0588 3052    TCPIP6 - ok
11:31:50.0620 3052    tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
11:31:50.0682 3052    tcpipreg - ok
11:31:50.0698 3052    TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
11:31:50.0729 3052    TDPIPE - ok
11:31:50.0745 3052    TDTCP           (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
11:31:50.0776 3052    TDTCP - ok
11:31:50.0791 3052    tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
11:31:50.0823 3052    tdx - ok
11:31:50.0838 3052    TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
11:31:50.0838 3052    TermDD - ok
11:31:50.0885 3052    tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
11:31:50.0963 3052    tssecsrv - ok
11:31:51.0010 3052    TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
11:31:51.0041 3052    TsUsbFlt - ok
11:31:51.0057 3052    tsusbhub - ok
11:31:51.0088 3052    tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
11:31:51.0151 3052    tunnel - ok
11:31:51.0166 3052    uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
11:31:51.0182 3052    uagp35 - ok
11:31:51.0213 3052    udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
11:31:51.0245 3052    udfs - ok
11:31:51.0260 3052    uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
11:31:51.0276 3052    uliagpkx - ok
11:31:51.0307 3052    umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
11:31:51.0338 3052    umbus - ok
11:31:51.0370 3052    UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
11:31:51.0401 3052    UmPass - ok
11:31:51.0432 3052    usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
11:31:51.0448 3052    usbccgp - ok
11:31:51.0479 3052    usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
11:31:51.0495 3052    usbcir - ok
11:31:51.0510 3052    usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
11:31:51.0541 3052    usbehci - ok
11:31:51.0557 3052    usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
11:31:51.0588 3052    usbhub - ok
11:31:51.0604 3052    usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
11:31:51.0620 3052    usbohci - ok
11:31:51.0635 3052    usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
11:31:51.0651 3052    usbprint - ok
11:31:51.0666 3052    USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:31:51.0698 3052    USBSTOR - ok
11:31:51.0713 3052    usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
11:31:51.0729 3052    usbuhci - ok
11:31:51.0760 3052    usb_rndisx      (70d05ee263568a742d14e1876df80532) C:\Windows\system32\DRIVERS\usb8023x.sys
11:31:51.0776 3052    usb_rndisx - ok
11:31:51.0791 3052    vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
11:31:51.0791 3052    vdrvroot - ok
11:31:51.0823 3052    vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
11:31:51.0838 3052    vga - ok
11:31:51.0854 3052    VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
11:31:51.0885 3052    VgaSave - ok
11:31:51.0901 3052    VGPU - ok
11:31:51.0916 3052    vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
11:31:51.0932 3052    vhdmp - ok
11:31:51.0948 3052    viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
11:31:51.0948 3052    viaide - ok
11:31:51.0963 3052    vmbus           (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
11:31:51.0979 3052    vmbus - ok
11:31:51.0979 3052    VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
11:31:52.0010 3052    VMBusHID - ok
11:31:52.0010 3052    volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
11:31:52.0026 3052    volmgr - ok
11:31:52.0057 3052    volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
11:31:52.0057 3052    volmgrx - ok
11:31:52.0073 3052    volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
11:31:52.0088 3052    volsnap - ok
11:31:52.0104 3052    vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
11:31:52.0104 3052    vsmraid - ok
11:31:52.0135 3052    vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
11:31:52.0151 3052    vwifibus - ok
11:31:52.0166 3052    WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
11:31:52.0213 3052    WacomPen - ok
11:31:52.0229 3052    WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:31:52.0291 3052    WANARP - ok
11:31:52.0291 3052    Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
11:31:52.0323 3052    Wanarpv6 - ok
11:31:52.0338 3052    Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
11:31:52.0354 3052    Wd - ok
11:31:52.0370 3052    Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
11:31:52.0385 3052    Wdf01000 - ok
11:31:52.0401 3052    WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
11:31:52.0432 3052    WfpLwf - ok
11:31:52.0463 3052    WimFltr         (52ded146e4797e6ccf94799e8e22bb2a) C:\Windows\system32\DRIVERS\wimfltr.sys
11:31:52.0463 3052    WimFltr - ok
11:31:52.0479 3052    WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
11:31:52.0495 3052    WIMMount - ok
11:31:52.0526 3052    WinUSB          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys
11:31:52.0541 3052    WinUSB - ok
11:31:52.0557 3052    WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
11:31:52.0573 3052    WmiAcpi - ok
11:31:52.0588 3052    ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
11:31:52.0620 3052    ws2ifsl - ok
11:31:52.0651 3052    WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
11:31:52.0713 3052    WudfPf - ok
11:31:52.0729 3052    WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
11:31:52.0760 3052    WUDFRd - ok
11:31:52.0776 3052    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
11:31:52.0870 3052    \Device\Harddisk0\DR0 ( TDSS File System ) - warning
11:31:52.0870 3052    \Device\Harddisk0\DR0 - detected TDSS File System (1)
11:31:52.0885 3052    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk1\DR1
11:31:53.0588 3052    \Device\Harddisk1\DR1 - ok
11:31:53.0604 3052    MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk2\DR2
11:31:53.0651 3052    \Device\Harddisk2\DR2 - ok
11:31:53.0651 3052    Boot (0x1200)   (62df4fb253dda7d53501613927f5ce3c) \Device\Harddisk0\DR0\Partition0
11:31:53.0651 3052    \Device\Harddisk0\DR0\Partition0 - ok
11:31:53.0682 3052    Boot (0x1200)   (47cd7ea8508ea82cb372883c67949ea3) \Device\Harddisk0\DR0\Partition1
11:31:53.0698 3052    \Device\Harddisk0\DR0\Partition1 - ok
11:31:53.0698 3052    Boot (0x1200)   (66d76974dc4655b7869f8b1177edb6bf) \Device\Harddisk1\DR1\Partition0
11:31:53.0698 3052    \Device\Harddisk1\DR1\Partition0 - ok
11:31:53.0713 3052    Boot (0x1200)   (8209ac3f32b685b5b995d3cf212403a1) \Device\Harddisk1\DR1\Partition1
11:31:53.0713 3052    \Device\Harddisk1\DR1\Partition1 - ok
11:31:53.0713 3052    Boot (0x1200)   (87bd728fda51ea26db9b576395d507a0) \Device\Harddisk2\DR2\Partition0
11:31:53.0713 3052    \Device\Harddisk2\DR2\Partition0 - ok
11:31:53.0729 3052    ============================================================
11:31:53.0729 3052    Scan finished
11:31:53.0729 3052    ============================================================
11:31:53.0729 4816    Detected object count: 2
11:31:53.0729 4816    Actual detected object count: 2
11:34:51.0574 4816    sptd ( LockedFile.Multi.Generic ) - skipped by user
11:34:51.0574 4816    sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
11:34:51.0574 4816    \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
11:34:51.0574 4816    \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 
11:34:59.0558 5780    Deinitialize success
2. EDIT:

Habe TDDSkiller jetzt dazu überreden können die beinden Einträge zu löschen. Der eine war ja wie es aussieht eh nur der Treiber von deamon tools(was ich aber Gestern schon deinstalliert hatte, ka warum der dann noch da war).
TDDSkiller meldet keinen Fund mehr.

Aber aswMBR findet immer noch die gleichen Sachen also den Alureon-k auf Datenträger 2 partition 3 (die 2MB Partition)
auch ist mir ein Rätzel warum die zuordnung der Datenträger immer wechselt? Die Start-Festplatte wechelt immer zwischen der zuordnung Datenträger 2 und Datenträger 0. Wenn ich mich recht entsinne ist diese zuordnung im MBR festgelegt. Frage mich grade ob da noch etwas anderes aktiv sein könnte das mir den MBR immer neu schreibt?

Nochmal der log von aswMBR nach der löschung durch TDDSkiller

Code

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 13:26:17
-----------------------------
13:26:17.059    OS Version: Windows x64 6.1.7601 Service Pack 1
13:26:17.059    Number of processors: 4 586 0x403
13:26:17.059    ComputerName: SIXER  UserName: six
13:26:17.356    Initialize success
13:26:21.543    AVAST engine defs: 12010901
13:26:24.215    Disk 0  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-5
13:26:24.231    Disk 0 Vendor: SAMSUNG_HD321KJ CP100-10 Size: 305245MB BusType: 3
13:26:24.231    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T1L0-6
13:26:24.231    Disk 1 Vendor: SAMSUNG_HD502HJ 1AJ100E4 Size: 476940MB BusType: 3
13:26:24.247    Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP2T0L0-3
13:26:24.247    Disk 2 Vendor: SAMSUNG_HD501LJ CR100-13 Size: 476940MB BusType: 3
13:26:24.293    Disk 2 MBR read successfully
13:26:24.293    Disk 2 MBR scan
13:26:24.293    Disk 2 Windows 7 default MBR code
13:26:24.293    Disk 2 Partition 1 80 (A) 07    HPFS/NTFS NTFS        99999 MB offset 2048
13:26:24.325    Disk 2 Partition 2 00     07    HPFS/NTFS NTFS       376937 MB offset 204800400
13:26:24.340    Disk 2 Partition 3 00     17 Hidd HPFS/NTFS NTFS            1 MB offset 976769136
13:26:24.340    Disk 2 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
13:26:24.372    Service scanning
13:26:30.622    Modules scanning
13:26:30.622    Disk 2 trace - called modules:
13:26:30.653    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 
13:26:30.668    1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0xfffffa8004a60060]
13:26:30.684    3 CLASSPNP.SYS[fffff88001b6243f] -> nt!IofCallDriver -> [0xfffffa8003af6580]
13:26:30.684    5 ACPI.sys[fffff8800100b7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-3[0xfffffa8003af1680]
13:26:31.059    AVAST engine scan C:\Windows
13:26:35.059    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
13:26:36.528    AVAST engine scan C:\Windows\system32
13:29:44.498    AVAST engine scan C:\Windows\system32\drivers
13:30:10.513    AVAST engine scan C:\Users\six
13:39:05.592    File: C:\Users\six\Downloads\EOlmarikTdl4Cleaner.exe  **INFECTED** MBR:Alureon-K [Rtk]
13:39:23.061    File: C:\Users\six\Downloads\sicher\gmer\EOlmarikTdl4Cleaner.exe  **INFECTED** MBR:Alureon-K [Rtk]
13:41:02.827    AVAST engine scan C:\ProgramData
13:41:57.014    Scan finished successfully
13:54:38.093    Disk 2 MBR has been saved successfully to "C:\Users\six\Downloads\sicher\MBR.dat"
13:54:38.093    The log file has been saved successfully to "C:\Users\six\Downloads\sicher\aswMBR nach löschung durch tddskiller.txt"


Anhang: partitionen.jpg
Dieser Beitrag wurde am 10.01.2012 um 13:56 Uhr von bluepill editiert.
Seitenanfang Seitenende
10.01.2012, 17:15
Swisstreasure
Moderator

Beiträge: 5694
#8 1.
Wieso im abgesicherten Modus aswMBR ausgeführt? Mach es im Normalmodus.

2.
Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
• Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Das Tool braucht nur eine Sekunde.
• Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes
Seitenanfang Seitenende
10.01.2012, 17:32
bluepill
Member

Themenstarter

Beiträge: 15
#9 Der abgesicherte nur deshalb weil ich keine veräderung gesehen hab.. normal mache ich alles im "normal" modus. Dachte im abgesicherten könnte ich aswMBR doch noch überreden mir zu helfen. irgendwass verhindert ja das ich bei dem tool auf den fix knopf klicken kann.

MBRCheck log:

Code

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:            
Windows Version:        Windows 7 Ultimate Edition
Windows Information:        Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer:    ASRock
BIOS Manufacturer:        American Megatrends Inc.
System Manufacturer:        To Be Filled By O.E.M.
System Product Name:        To Be Filled By O.E.M.
Logical Drives Mask:        0x000000fc

Kernel Drivers (total 199):
  0x02E53000 \SystemRoot\system32\ntoskrnl.exe
  0x02E0A000 \SystemRoot\system32\hal.dll
  0x00BBD000 \SystemRoot\system32\kdcom.dll
  0x00CC9000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
  0x00CD6000 \SystemRoot\system32\PSHED.dll
  0x00CEA000 \SystemRoot\system32\CLFS.SYS
  0x00C00000 \SystemRoot\system32\CI.dll
  0x00D48000 \SystemRoot\system32\drivers\47389361.sys
  0x00E28000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x00ECC000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x01091000 \SystemRoot\System32\Drivers\sptd.sys
  0x01000000 \SystemRoot\system32\drivers\ACPI.sys
  0x01057000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x01060000 \SystemRoot\system32\drivers\msisadrv.sys
  0x0106A000 \SystemRoot\system32\drivers\vdrvroot.sys
  0x00EDB000 \SystemRoot\system32\drivers\pci.sys
  0x01077000 \SystemRoot\System32\drivers\partmgr.sys
  0x011F7000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x00F0E000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x00F1A000 \SystemRoot\system32\drivers\volmgr.sys
  0x00F2F000 \SystemRoot\System32\drivers\volmgrx.sys
  0x00F8B000 \SystemRoot\system32\drivers\pciide.sys
  0x00F92000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x00FA2000 \SystemRoot\System32\drivers\mountmgr.sys
  0x00FBC000 \SystemRoot\system32\drivers\vmbus.sys
  0x00E00000 \SystemRoot\system32\drivers\winhv.sys
  0x00E14000 \SystemRoot\system32\drivers\atapi.sys
  0x00D6A000 \SystemRoot\system32\drivers\ataport.SYS
  0x00E1D000 \SystemRoot\system32\drivers\amdxata.sys
  0x00D94000 \SystemRoot\system32\drivers\fltmgr.sys
  0x00DE0000 \SystemRoot\system32\drivers\fileinfo.sys
  0x01254000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x01458000 \SystemRoot\System32\Drivers\msrpc.sys
  0x014B6000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x014D1000 \SystemRoot\System32\Drivers\cng.sys
  0x01543000 \SystemRoot\System32\drivers\pcw.sys
  0x01554000 \SystemRoot\System32\Drivers\Fs_Rec.sys
  0x016FF000 \SystemRoot\system32\drivers\ndis.sys
  0x01600000 \SystemRoot\system32\drivers\NETIO.SYS
  0x01660000 \SystemRoot\System32\Drivers\ksecpkg.sys
  0x0180A000 \SystemRoot\System32\drivers\tcpip.sys
  0x01A0E000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x01A58000 \SystemRoot\system32\drivers\vmstorfl.sys
  0x01A68000 \SystemRoot\system32\drivers\volsnap.sys
  0x01AB4000 \SystemRoot\System32\Drivers\spldr.sys
  0x01ABC000 \SystemRoot\System32\drivers\rdyboost.sys
  0x01AF6000 \SystemRoot\System32\Drivers\mup.sys
  0x01B08000 \SystemRoot\System32\drivers\hwpolicy.sys
  0x01B11000 \SystemRoot\System32\DRIVERS\fvevol.sys
  0x01B4B000 \SystemRoot\system32\DRIVERS\disk.sys
  0x01B61000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
  0x01BC7000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x01BF1000 \SystemRoot\System32\Drivers\Null.SYS
  0x01800000 \SystemRoot\System32\Drivers\Beep.SYS
  0x0168B000 \SystemRoot\system32\DRIVERS\ehdrv.sys
  0x016B2000 \SystemRoot\System32\drivers\vga.sys
  0x016C0000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x016E5000 \SystemRoot\System32\drivers\watchdog.sys
  0x016F5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x017F2000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x0155E000 \SystemRoot\system32\drivers\rdprefmp.sys
  0x01567000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x01572000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x01583000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x015A5000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x042DE000 \SystemRoot\system32\drivers\afd.sys
  0x04367000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x043AC000 \SystemRoot\system32\drivers\ws2ifsl.sys
  0x043B7000 \SystemRoot\system32\DRIVERS\wfplwf.sys
  0x043C0000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x043E6000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x04200000 \SystemRoot\system32\DRIVERS\serial.sys
  0x0421D000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x04238000 \SystemRoot\system32\drivers\termdd.sys
  0x0424C000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x0429D000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x042A9000 \SystemRoot\system32\drivers\mssmbios.sys
  0x042B4000 \SystemRoot\System32\drivers\discache.sys
  0x04476000 \SystemRoot\system32\drivers\csc.sys
  0x044F9000 \SystemRoot\System32\Drivers\dfsc.sys
  0x04517000 \SystemRoot\system32\DRIVERS\blbdrive.sys
  0x04528000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x0454E000 \SystemRoot\system32\DRIVERS\amdppm.sys
  0x04563000 \SystemRoot\system32\DRIVERS\serenum.sys
  0x0456F000 \SystemRoot\system32\DRIVERS\nvsmu.sys
  0x0457A000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x04585000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x045DB000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x04400000 \SystemRoot\system32\drivers\HDAudBus.sys
  0x04424000 \SystemRoot\system32\DRIVERS\nvmf6264.sys
  0x01400000 \SystemRoot\system32\DRIVERS\atikmpag.sys
  0x04AC1000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x04632000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x04726000 \SystemRoot\System32\drivers\dxgmms1.sys
  0x0476C000 \SystemRoot\system32\drivers\wmiacpi.sys
  0x02E9E000 \SystemRoot\system32\DRIVERS\btkrnl.sys
  0x02FD6000 \SystemRoot\system32\drivers\CompositeBus.sys
  0x02FE6000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
  0x02E00000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x02E24000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x02E30000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x02E5F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x02E7A000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x04775000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x0478F000 \SystemRoot\system32\DRIVERS\tap0901t.sys
  0x0479C000 \SystemRoot\system32\DRIVERS\rdpbus.sys
  0x047A7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x047B6000 \SystemRoot\system32\drivers\mouclass.sys
  0x02E9B000 \SystemRoot\system32\drivers\swenum.sys
  0x05517000 \SystemRoot\system32\drivers\ks.sys
  0x047C5000 \SystemRoot\system32\DRIVERS\amdiox64.sys
  0x047D9000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x0555A000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x047EB000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x05E0C000 \SystemRoot\system32\drivers\RTKVHD64.sys
  0x055B4000 \SystemRoot\system32\drivers\portcls.sys
  0x04600000 \SystemRoot\system32\drivers\drmk.sys
  0x05FEF000 \SystemRoot\system32\drivers\ksthunk.sys
  0x04A00000 \SystemRoot\system32\drivers\AtihdW76.sys
  0x00010000 \SystemRoot\System32\win32k.sys
  0x05E00000 \SystemRoot\System32\drivers\Dxapi.sys
  0x04622000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x04A3E000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x05FF5000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x04A4A000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
  0x04A5D000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x05FFE000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x04A7A000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x04A88000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x04AA1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x04AAA000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x055F1000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x005E0000 \SystemRoot\System32\TSDDD.dll
  0x045EC000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x00690000 \SystemRoot\System32\cdd.dll
  0x00910000 \SystemRoot\System32\ATMFD.DLL
  0x01B91000 \SystemRoot\system32\drivers\luafv.sys
  0x02CA5000 \SystemRoot\system32\DRIVERS\eamonm.sys
  0x02D87000 \SystemRoot\system32\drivers\WudfPf.sys
  0x02DA8000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x02DBD000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x06484000 \SystemRoot\system32\drivers\HTTP.sys
  0x0654D000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x0656B000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x06583000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x065B0000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x06400000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x06424000 \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
  0x02C00000 \SystemRoot\system32\DRIVERS\atksgt.sys
  0x06455000 \SystemRoot\system32\DRIVERS\epfwwfpr.sys
  0x02C4F000 \SystemRoot\system32\DRIVERS\lirsgt.sys
  0x07002000 \SystemRoot\system32\drivers\peauth.sys
  0x070A8000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x070B3000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x070E4000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x07167000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x0746D000 \SystemRoot\System32\DRIVERS\srv.sys
  0x07505000 \SystemRoot\system32\drivers\qwavedrv.sys
  0x07537000 \??\C:\Users\six\AppData\Local\Temp\aswMBR.sys
  0x77210000 \Windows\System32\ntdll.dll
  0x48400000 \Windows\System32\smss.exe
  0xFF530000 \Windows\System32\apisetschema.dll
  0xFF600000 \Windows\System32\autochk.exe
  0xFF440000 \Windows\System32\advapi32.dll
  0xFF330000 \Windows\System32\msctf.dll
  0xFF2C0000 \Windows\System32\gdi32.dll
  0xFF290000 \Windows\System32\imm32.dll
  0x770B0000 \Windows\System32\wininet.dll
  0xFE500000 \Windows\System32\shell32.dll
  0x76EA0000 \Windows\System32\iertutil.dll
  0xFE460000 \Windows\System32\clbcatq.dll
  0xFE390000 \Windows\System32\usp10.dll
  0xFE310000 \Windows\System32\shlwapi.dll
  0xFE100000 \Windows\System32\ole32.dll
  0xFE0B0000 \Windows\System32\ws2_32.dll
  0xFE090000 \Windows\System32\sechost.dll
  0xFE070000 \Windows\System32\imagehlp.dll
  0x76DA0000 \Windows\System32\user32.dll
  0xFE060000 \Windows\System32\nsi.dll
  0xFDFC0000 \Windows\System32\comdlg32.dll
  0x773E0000 \Windows\System32\psapi.dll
  0x773D0000 \Windows\System32\normaliz.dll
  0xFDF40000 \Windows\System32\difxapi.dll
  0xFDE60000 \Windows\System32\oleaut32.dll
  0xFDC80000 \Windows\System32\setupapi.dll
  0x76C80000 \Windows\System32\kernel32.dll
  0xFDC70000 \Windows\System32\lpk.dll
  0x76B30000 \Windows\System32\urlmon.dll
  0xFDB40000 \Windows\System32\rpcrt4.dll
  0xFDAE0000 \Windows\System32\Wldap32.dll
  0xFDA40000 \Windows\System32\msvcrt.dll
  0xFDA00000 \Windows\System32\cfgmgr32.dll
  0xFD990000 \Windows\System32\KernelBase.dll
  0xFD950000 \Windows\System32\wintrust.dll
  0xFD8B0000 \Windows\System32\comctl32.dll
  0xFD890000 \Windows\System32\devobj.dll
  0xFD720000 \Windows\System32\crypt32.dll
  0xFD710000 \Windows\System32\msasn1.dll
  0x773C0000 \Windows\SysWOW64\normaliz.dll

Processes (total 68):
       0 System Idle Process
       4 System
     292 C:\Windows\System32\smss.exe
     440 csrss.exe
     512 C:\Windows\System32\wininit.exe
     544 csrss.exe
     568 C:\Windows\System32\services.exe
     588 C:\Windows\System32\lsass.exe
     600 C:\Windows\System32\lsm.exe
     708 C:\Windows\System32\winlogon.exe
     744 C:\Windows\System32\svchost.exe
     820 C:\Windows\System32\svchost.exe
     880 C:\Windows\System32\atiesrxx.exe
     924 C:\Windows\System32\svchost.exe
     980 C:\Windows\System32\svchost.exe
     120 C:\Windows\System32\svchost.exe
     836 C:\Windows\System32\svchost.exe
    1108 C:\Windows\System32\svchost.exe
    1128 C:\Windows\System32\atieclxx.exe
    1296 C:\Windows\System32\spoolsv.exe
    1324 C:\Windows\System32\svchost.exe
    1404 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    1440 C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
    1508 C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    1612 C:\Windows\System32\taskhost.exe
    1788 C:\Windows\System32\svchost.exe
    1868 C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
    1916 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    2004 C:\Windows\System32\dwm.exe
    2012 C:\Windows\explorer.exe
    1532 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    2128 C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
    2344 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    2428 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    2632 C:\Windows\WindowsMobile\wmdc.exe
    2664 C:\Windows\System32\svchost.exe
    2728 C:\Program Files (x86)\Skype\Phone\Skype.exe
    2788 C:\Program Files\Windows Sidebar\sidebar.exe
    2872 C:\Program Files (x86)\XWidget\xwidget.exe
    2896 C:\Windows\System32\svchost.exe
    2972 C:\Program Files (x86)\Unified Remote\RemoteServer.exe
    2696 C:\Windows\System32\svchost.exe
    2940 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    2812 C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
     384 C:\Program Files (x86)\Mumble\murmur.exe
    2980 C:\Program Files (x86)\Everything\Everything.exe
    3208 C:\Windows\System32\svchost.exe
    3328 C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
    3364 C:\Program Files\Windows Media Player\wmpnetwk.exe
    3968 dllhost.exe
    3028 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    5020 C:\Windows\System32\svchost.exe
    4208 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    4212 C:\Windows\System32\notepad.exe
    1248 C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
    3384 C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
     988 C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe
    4616 C:\Windows\System32\audiodg.exe
    1712 F:\Steam\Steam.exe
    3036 C:\Windows\SysWOW64\PnkBstrA.exe
    4832 C:\Windows\SysWOW64\PnkBstrB.exe
    1540 C:\Windows\System32\taskhost.exe
    3520 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    3312 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    2508 C:\Windows\System32\perfmon.exe
    5200 C:\Windows\System32\dllhost.exe
    5304 C:\Users\six\Desktop\MBRCheck.exe
    5296 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive2 at offset 0x00000000`00100000  (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00100000  (NTFS)
\\.\E: --> \\.\PhysicalDrive2 at offset 0x00000018`6a032000  (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000007`73a00000  (NTFS)
\\.\H: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

PhysicalDrive2 Model Number: SAMSUNGHD501LJ, Rev: CR100-13
PhysicalDrive1 Model Number: SAMSUNGHD502HJ, Rev: 1AJ100E4
PhysicalDrive0 Model Number: SAMSUNGHD321KJ, Rev: CP100-10

      Size  Device Name          MBR Status
  --------------------------------------------
    465 GB  \\.\PhysicalDrive2   Windows 7 MBR code detected
            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
    465 GB  \\.\PhysicalDrive1   Windows 7 MBR code detected
            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
    298 GB  \\.\PhysicalDrive0   Windows 7 MBR code detected
            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!
Seitenanfang Seitenende
10.01.2012, 17:37
Swisstreasure
Moderator

Beiträge: 5694
#10 Der abgesicherte nur deshalb weil ich keine veräderung gesehen hab.. normal mache ich alles im "normal" modus. Dachte im abgesicherten könnte ich aswMBR doch noch überreden mir zu helfen. irgendwass verhindert ja das ich bei dem tool auf den fix knopf klicken kann.

Mach es genau so wie beschrieben. Nicht einfach was Du denkst.

Also aswMBR im Normalmodus und dann auf FixMBR
Seitenanfang Seitenende
10.01.2012, 18:06
bluepill
Member

Themenstarter

Beiträge: 15
#11 so aswMBR im normal modus fixmbr danach nochmaliger scan:

Code

aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 17:48:23
-----------------------------
17:48:23.224    OS Version: Windows x64 6.1.7601 Service Pack 1
17:48:23.224    Number of processors: 4 586 0x403
17:48:23.240    ComputerName: SIXER  UserName: six
17:48:38.736    Initialize success
17:48:46.362    AVAST engine defs: 12010901
17:48:57.916    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3
17:48:57.916    Disk 0 Vendor: SAMSUNG_HD501LJ CR100-13 Size: 476940MB BusType: 3
17:48:57.931    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-5
17:48:57.931    Disk 1 Vendor: SAMSUNG_HD321KJ CP100-10 Size: 305245MB BusType: 3
17:48:57.931    Disk 2  \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-7
17:48:57.931    Disk 2 Vendor: SAMSUNG_HD502HJ 1AJ100E4 Size: 476940MB BusType: 3
17:48:57.978    Disk 0 MBR read successfully
17:48:57.978    Disk 0 MBR scan
17:48:57.994    Disk 0 Windows 7 default MBR code
17:48:58.025    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        99999 MB offset 2048
17:48:58.056    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       376937 MB offset 204800400
17:48:58.134    Disk 0 Partition 3 00     17 Hidd HPFS/NTFS NTFS            1 MB offset 976769136
17:48:58.166    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
17:48:58.181    Service scanning
17:49:10.744    Modules scanning
17:49:10.744    Disk 0 trace - called modules:
17:49:10.775    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 
17:49:10.791    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a5c060]
17:49:10.791    3 CLASSPNP.SYS[fffff8800161743f] -> nt!IofCallDriver -> [0xfffffa8003ae8d10]
17:49:10.791    5 ACPI.sys[fffff88000f227a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-3[0xfffffa8003b2b060]
17:49:11.791    AVAST engine scan C:\Windows
17:49:16.962    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
17:49:20.572    AVAST engine scan C:\Windows\system32
17:52:31.066    AVAST engine scan C:\Windows\system32\drivers
17:52:44.675    AVAST engine scan C:\Users\six
18:02:06.988    File: C:\Users\six\Downloads\EOlmarikTdl4Cleaner.exe  **INFECTED** MBR:Alureon-K [Rtk]
18:02:25.566    File: C:\Users\six\Downloads\sicher\gmer\EOlmarikTdl4Cleaner.exe  **INFECTED** MBR:Alureon-K [Rtk]
18:04:02.176    AVAST engine scan C:\ProgramData
18:04:57.879    Scan finished successfully
18:05:11.254    Disk 0 MBR has been saved successfully to "C:\Users\six\Desktop\MBR.dat"
18:05:11.989    The log file has been saved successfully to "C:\Users\six\Desktop\aswMBR.txt"
Seitenanfang Seitenende
10.01.2012, 18:07
Swisstreasure
Moderator

Beiträge: 5694
#12 Was ist das hier eigentlich unter GMER:
C:\Users\six\Downloads\sicher\gmer\EOlmarikTdl4Cleaner.exe
Seitenanfang Seitenende
10.01.2012, 18:11
bluepill
Member

Themenstarter

Beiträge: 15
#13 Hab ich oben irgendwo schon geschrieben. Das ist der Olmarik standalone remover von der ESET homepage. Könnte ich eigentlich löschen hat eh nicht funktioniert. Den hatte ich gedownloadet bevor ich das Forum hier gefunden hatte.
Seitenanfang Seitenende
10.01.2012, 22:25
Swisstreasure
Moderator

Beiträge: 5694
#14 Lass die Datei einmal bei www.virustotal.com/de prüfen

Durchsuchen. Datei auswählen. Send File. Link oder Resultat posten.
Seitenanfang Seitenende
10.01.2012, 22:34
bluepill
Member

Themenstarter

Beiträge: 15
#15 die datei ist direkt von der ESET hompage und wurde auch von denen entwickelt.. den zweck versteh ich nicht ganz nen spezielles removal tool bei VT zu upen? da wird so ziemlich jedes antivirus drauf anspringen.
aber ich kanns ja mal machen^^

Edit:

ok jedes war wohl übertrieben...
http://www.virustotal.com/file-scan/report.html?id=f4d1a6bdd86a07e3a779c45e68a2869ffb128a393784d565ed739ad28498fc9f-1326230848

dennoch erschließt sich mir der Zweck grade nicht ganz.. ist doch kar das ein removal tool die Signatur des virus/rootkit/what ever drin hat um den erkennen zu können

das tool wurde auf anheißen eines eset Mitarbeiters hier gedownloadet: http://www.eset.com/de/download/utilities/detail/family/59/


Edit:

Soll ich denn jetzt mal die 2MB Partition löschen? ich denke damit hätte ich es abgeschlossen und die malware wäre weg. zumindest auf den ersten Blick.. natürlich könnte sich immernoch irgendwo was verstecken aber kein scaner findet zZ. noch was. oder gibt es noch andere vorschläge?
Dieser Beitrag wurde am 10.01.2012 um 23:09 Uhr von bluepill editiert.
Seitenanfang Seitenende
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!

Folgende Themen könnten Dich auch interessieren:
Seite(n): 12