Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:38:34 on 19.07.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 5.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Marion\AppData\Local\Temp\catchme.sys  (File not found)
"int15" (int15) - "Acer, Inc." - C:\Acer\Empowering Technology\eRecovery\int15.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"mbr" (mbr) - ? - C:\ComboFix\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"PPdus ASPI Shell" (Afc) - "Arcsoft, Inc." - C:\Windows\System32\drivers\Afc.sys
"PSDFilter" (PSDFilter) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\psdfilter.sys
"PSDNServ" (PSDNServ) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDNServ.sys
"PSDVdisk" (psdvdisk) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDVdisk.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"tvicport" (tvicport) - "EnTech Taiwan" - C:\Windows\system32\drivers\tvicport.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys
"zntport" (zntport) - "Zeal SoftStudio" - C:\Windows\system32\drivers\zntport.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{5513F07E-936B-4E52-9B00-067394E91CC5} "dssrequest" - ? -   (File not found | COM-object registry key not found)
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll
{5513F07E-936B-4E52-9B00-067394E91CC5} "sacore" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{653DCCC2-13DB-45B2-A389-427885776CFE} "Activities Property Page" - "Microsoft Corporation" - C:\Program Files\Microsoft IntelliPoint\ipcplact.dll
{124597D8-850A-41AE-849C-017A4FA99CA2} "Buttons Property Page" - "Microsoft Corporation" - C:\Program Files\Microsoft IntelliPoint\ipcplbtn.dll
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Incorporated" - C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{3BEABCC1-BF31-42df-88D9-A2955D6B8528} "IntelliPoint Sensitivity Property Page" - "Microsoft Corporation" - C:\Program Files\Microsoft IntelliPoint\ipcplsens.dll
{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\kbcplext.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\mcplext.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE} "Wheel Property Page" - "Microsoft Corporation" - C:\Program Files\Microsoft IntelliPoint\ipcplwhl.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{20082881-FC36-4E47-9A7A-644C95FF749F} "Wireless Property Page" - "Microsoft Corporation" - C:\Program Files\Microsoft IntelliPoint\ipcplwir.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
"ICQ7.2" - "ICQ, LLC." - C:\Program Files\ICQ7.2\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Acer eDataSecurity Management" - "Egis Incorporated." - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{593DDEC6-7468-4cdd-90E1-42DADAA222E9} "DivX HiQ" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} "ShowBarObj Class" - "Egis" - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\Marion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"ASETRES.EXE" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ASETRES.EXE
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Empowering Technology Launcher.lnk" - "Acer Inc." - C:\Acer\Empowering Technology\eAPLauncher.exe  (Shortcut exists | File exists)
"Logitech SetPoint.lnk" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\SetPoint.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acer Empowering Technology Monitor" - ? - C:\Acer\Empowering Technology\SysMonitor.exe
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"AdobeAAMUpdater-1.0" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"AdobeCS5.5ServiceManager" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"eDataSecurity Loader" - "Egis Incorporated" - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
"IntelliPoint" - "Microsoft Corporation" - "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"NVRaidService" - "NVIDIA Corporation" - C:\Windows\system32\nvraidservice.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SwitchBoard" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"WarReg_PopUp" - "Acer Inc." - C:\Acer\WR_PopUp\WarReg_PopUp.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Acer HomeMedia Connect Service" (Acer HomeMedia Connect Service) - "CyberLink" - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"eDataSecurity Service" (eDataSecurity Service) - "Egis Incorporated" - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
"ePerformance Service" (AcerMemUsageCheckService) - ? - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
"eRecovery Service" (eRecoveryService) - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
"eSettings Service" (eSettingsService) - ? - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - ? - "C:\Program Files\Common Files\LightScribe\LSSrvc.exe"  (File not found)
"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"McAfee SiteAdvisor Service" (McAfee SiteAdvisor Service) - ? - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe  (File not found)
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"SwitchBoard" (SwitchBoard) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\system32\ARCSOF~1.SCR  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
         

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-07-20 18:54:32
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000059 WDC_WD64 rev.01.0
Running: fgwmkqst.exe; Driver: C:\Users\Marion\AppData\Local\Temp\fgriypod.sys


---- Kernel code sections - GMER 1.0.15 ----

.text  C:\Windows\system32\DRIVERS\atikmdag.sys                                   section is writeable [0x8EE04000, 0x38E905, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text  C:\Windows\Explorer.EXE[500] SHELL32.dll!SHGetFolderPathAndSubDirW + 81C5  75CCB37C 4 Bytes  [50, 26, 00, 10] {PUSH EAX; ADD ES:[EAX], DL}

---- EOF - GMER 1.0.15 ----
         

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:	ACER
BIOS Manufacturer:		American Megatrends Inc.
System Manufacturer:		ACER
System Product Name:		Aspire M5641
Logical Drives Mask:		0x000001fc

Kernel Drivers (total 163):
  0x82000000 \SystemRoot\system32\ntkrnlpa.exe
  0x823BA000 \SystemRoot\system32\hal.dll
  0x80604000 \SystemRoot\system32\kdcom.dll
  0x8060B000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x8067B000 \SystemRoot\system32\PSHED.dll
  0x8068C000 \SystemRoot\system32\BOOTVID.dll
  0x80694000 \SystemRoot\system32\CLFS.SYS
  0x806D5000 \SystemRoot\system32\CI.dll
  0x82604000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x82675000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x82683000 \SystemRoot\system32\drivers\acpi.sys
  0x826C9000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x826D2000 \SystemRoot\system32\drivers\msisadrv.sys
  0x826DA000 \SystemRoot\system32\drivers\pci.sys
  0x82701000 \SystemRoot\System32\drivers\partmgr.sys
  0x82710000 \SystemRoot\system32\drivers\volmgr.sys
  0x8271F000 \SystemRoot\System32\drivers\volmgrx.sys
  0x82769000 \SystemRoot\system32\drivers\nvrd32.sys
  0x8278C000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x827AD000 \SystemRoot\system32\drivers\pciide.sys
  0x827B4000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x827C2000 \SystemRoot\System32\drivers\mountmgr.sys
  0x827D2000 \SystemRoot\system32\drivers\nvraid.sys
  0x827ED000 \SystemRoot\system32\drivers\atapi.sys
  0x807B5000 \SystemRoot\system32\drivers\ataport.SYS
  0x807D3000 \SystemRoot\system32\drivers\nvstor32.sys
  0x8A20E000 \SystemRoot\system32\drivers\storport.sys
  0x8A24F000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8A281000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8A291000 \SystemRoot\system32\DRIVERS\psdfilter.sys
  0x8A29A000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8A40A000 \SystemRoot\system32\drivers\ndis.sys
  0x8A515000 \SystemRoot\system32\drivers\msrpc.sys
  0x8A540000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A30B000 \SystemRoot\System32\drivers\tcpip.sys
  0x8A57B000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8A600000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8A710000 \SystemRoot\system32\drivers\wd.sys
  0x8A718000 \SystemRoot\system32\drivers\volsnap.sys
  0x8A751000 \SystemRoot\System32\Drivers\spldr.sys
  0x8A759000 \SystemRoot\System32\Drivers\mup.sys
  0x8A768000 \SystemRoot\System32\drivers\ecache.sys
  0x8A78F000 \SystemRoot\system32\drivers\disk.sys
  0x8A7A0000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8A7E4000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8A7EF000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8A596000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8A5A5000 \SystemRoot\system32\DRIVERS\serial.sys
  0x8A5BF000 \SystemRoot\system32\DRIVERS\serenum.sys
  0x8A5DC000 \SystemRoot\system32\DRIVERS\L8042mou.Sys
  0x8A5EA000 \SystemRoot\system32\DRIVERS\LMouKE.Sys
  0x8A3F5000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8A7F8000 \SystemRoot\system32\DRIVERS\nvsmu.sys
  0x8A400000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x8E400000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8E43E000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8E44D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8E4DA000 \SystemRoot\system32\DRIVERS\ohci1394.sys
  0x8E4EA000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
  0x8E4F8000 \SystemRoot\system32\DRIVERS\atikmpag.sys
  0x8E806000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x8E538000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8EFC4000 \SystemRoot\System32\drivers\watchdog.sys
  0x8EFD0000 \SystemRoot\system32\drivers\Afc.sys
  0x8EFD8000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8EFF0000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0x8F20B000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
  0x8F307000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x8F310000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8F33F000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8F34A000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8F361000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8F36C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8F38F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8F39E000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8F3B2000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8F3C7000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8F3D7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8F3E2000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8F406000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8F430000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8F43A000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8F447000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8F47C000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8F60D000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8F93D000 \SystemRoot\system32\drivers\portcls.sys
  0x8F96A000 \SystemRoot\system32\drivers\drmk.sys
  0x8F98F000 \SystemRoot\system32\drivers\nvhda32v.sys
  0x8F99D000 \SystemRoot\system32\drivers\AtihdLH3.sys
  0x8F9B7000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8F9C0000 \SystemRoot\System32\Drivers\Null.SYS
  0x8F9C7000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8F9CE000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8F9EA000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8F9F1000 \SystemRoot\System32\drivers\vga.sys
  0x8F48D000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8F600000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8F9E1000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8F4AE000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8F4B9000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8F4C7000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8F4D0000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8F4E6000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8F4FA000 \SystemRoot\system32\drivers\afd.sys
  0x8F542000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8F574000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8F58A000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8F598000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8F5AB000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8F5B1000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8F5ED000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8F3E4000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8E5D8000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8A7A9000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0x8F9FD000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8EFF2000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8F200000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0x8A7BE000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
  0x8F5F7000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
  0x8A5C9000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x97007000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x97017000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x9702E000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0x97036000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x9703E000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0x97046000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x97A10000 \SystemRoot\System32\win32k.sys
  0x9704F000 \SystemRoot\System32\drivers\Dxapi.sys
  0x97059000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x97C30000 \SystemRoot\System32\TSDDD.dll
  0x97C50000 \SystemRoot\System32\ATMFD.DLL
  0x97068000 \SystemRoot\system32\drivers\luafv.sys
  0x97083000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x97CA0000 \SystemRoot\System32\cdd.dll
  0x9709A000 \SystemRoot\system32\drivers\spsys.sys
  0x9714A000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9715A000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9716D000 \SystemRoot\system32\drivers\HTTP.sys
  0x971DA000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9D800000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9D819000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9D82E000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9D84F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9D86E000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9D8A7000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9D8BF000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9D8E7000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9D936000 \??\C:\Acer\Empowering Technology\eRecovery\int15.sys
  0xA7205000 \SystemRoot\system32\drivers\peauth.sys
  0xA72E3000 \SystemRoot\system32\DRIVERS\PSDNServ.sys
  0xA72EC000 \SystemRoot\system32\DRIVERS\PSDVdisk.sys
  0xA72FE000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xA7308000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xA7314000 \??\C:\Windows\system32\drivers\tvicport.sys
  0xA7317000 \??\C:\Windows\system32\drivers\zntport.sys
  0xA7318000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0xA732D000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0xA733F000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0xA7355000 \??\C:\Windows\system32\drivers\mbam.sys
  0xA7383000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS
  0xA7385000 \??\C:\Users\Marion\AppData\Local\Temp\catchme.sys
  0xA7394000 \??\C:\Users\Marion\AppData\Local\Temp\fgriypod.sys
  0x77C90000 \Windows\System32\ntdll.dll

Processes (total 75):
       0 System Idle Process
       4 System
     456 C:\Windows\System32\smss.exe
     524 csrss.exe
     596 C:\Windows\System32\wininit.exe
     608 csrss.exe
     640 C:\Windows\System32\services.exe
     652 C:\Windows\System32\lsass.exe
     664 C:\Windows\System32\lsm.exe
     808 C:\Windows\System32\svchost.exe
     876 C:\Windows\System32\svchost.exe
     920 C:\Windows\System32\svchost.exe
     960 C:\Windows\System32\atiesrxx.exe
    1012 C:\Windows\System32\winlogon.exe
    1044 C:\Windows\System32\svchost.exe
    1072 C:\Windows\System32\svchost.exe
    1084 C:\Windows\System32\svchost.exe
    1156 C:\Windows\System32\audiodg.exe
    1184 C:\Windows\System32\SLsvc.exe
    1224 C:\Windows\System32\svchost.exe
    1332 C:\Windows\System32\svchost.exe
    1552 C:\Windows\System32\spoolsv.exe
    1588 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1624 C:\Windows\System32\svchost.exe
    1676 C:\Windows\System32\atieclxx.exe
     472 C:\Windows\System32\dwm.exe
     492 C:\Windows\System32\taskeng.exe
     860 C:\Windows\System32\taskeng.exe
    2284 C:\Program Files\Windows Defender\MSASCui.exe
    2292 C:\Acer\Empowering Technology\SysMonitor.exe
    2300 C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
    2324 C:\Windows\System32\nvraidservice.exe
    2332 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    2356 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    2556 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    2624 C:\Program Files\Windows Media Player\wmpnscfg.exe
    2668 C:\Program Files\Logitech\SetPoint\SetPoint.exe
    2788 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    2860 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    3108 C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
    3116 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    3484 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    3500 C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
    3516 C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    3604 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    3636 C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
    3760 C:\Windows\System32\svchost.exe
    3828 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    3884 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    3904 C:\Windows\System32\svchost.exe
    4004 C:\Windows\System32\svchost.exe
    4044 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    4092 C:\Windows\System32\SearchIndexer.exe
    1432 C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    1600 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    1340 C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
    2972 WUDFHost.exe
    3092 WmiPrvSE.exe
    4204 WmiPrvSE.exe
    4444 C:\Program Files\Windows Media Player\wmpnetwk.exe
    4580 C:\Windows\System32\mobsync.exe
    4616 C:\Windows\System32\wbem\unsecapp.exe
    5420 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    4544 C:\Windows\System32\svchost.exe
    2112 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    3920 C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
    1456 C:\Windows\System32\rundll32.exe
    3216 C:\Windows\System32\conime.exe
    5848 C:\Windows\explorer.exe
    5360 C:\Windows\System32\wbem\unsecapp.exe
    2492 D:\Programme\Mozilla Firefox\firefox.exe
     768 D:\Programme\Mozilla Firefox\plugin-container.exe
    4132 C:\Windows\System32\SearchProtocolHost.exe
    5844 C:\Windows\System32\SearchFilterHost.exe
    4604 C:\Users\Marion\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`f3a00000  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000004b`89000000  (NTFS)

PhysicalDrive0 Model Number: WDC WD6400AAKS-22A7B, Rev: 01.0

      Size  Device Name          MBR Status
  --------------------------------------------
    596 GB  \\.\PhysicalDrive0   MBR Code Faked!
            SHA1: E43E29FA989EDD40E2C31C97D282243B52D36B81


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
         

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

• Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

aswMBR version 0.9.7.777 Copyright(c) 2011 AVAST Software
Run date: 2011-07-20 21:40:15
-----------------------------
21:40:15.134    OS Version: Windows 6.0.6002 Service Pack 2
21:40:15.134    Number of processors: 4 586 0x1707
21:40:15.134    ComputerName: MARION-PC  UserName: Marion
21:40:16.163    Initialize success
21:48:29.131    AVAST engine defs: 11072001
21:52:58.512    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000059
21:52:58.512    Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 6
21:52:58.699    Disk 0 MBR read error 0
21:52:58.699    Disk 0 MBR scan
21:52:58.715    Disk 0 unknown MBR code
21:52:58.715    MBR BIOS signature not found 0
21:52:58.824    Disk 0 scanning sectors +1250260992
21:52:59.011    Disk 0 scanning C:\Windows\system32\drivers
21:53:55.655    Service scanning
21:53:56.638    Disk 0 trace - called modules:
21:53:56.685    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys 
21:53:56.685    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x863de1c0]
21:53:56.685    3 CLASSPNP.SYS[827938b3] -> nt!IofCallDriver -> [0x856614f0]
21:53:56.685    5 acpi.sys[8268d6bc] -> nt!IofCallDriver -> \Device\00000059[0x847eea30]
21:53:57.433    AVAST engine scan C:\Windows
21:55:06.885    AVAST engine scan C:\Windows\system32
21:58:01.433    AVAST engine scan C:\Windows\system32\drivers
21:58:15.426    AVAST engine scan C:\Users\Marion
21:59:46.764    AVAST engine scan C:\ProgramData
22:06:14.721    Disk 0 MBR has been saved successfully to "C:\Users\Marion\Desktop\MBR.dat"
22:06:14.736    The log file has been saved successfully to "C:\Users\Marion\Desktop\aswMBR.txt"
         

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

bis ich hirn das richtige von der seite runtergeladen hab, hab ich 5 rohlinge verbraten..driver riviver..

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:	ACER
BIOS Manufacturer:		American Megatrends Inc.
System Manufacturer:		ACER
System Product Name:		Aspire M5641
Logical Drives Mask:		0x000001fc

Kernel Drivers (total 160):
  0x82047000 \SystemRoot\system32\ntkrnlpa.exe
  0x82014000 \SystemRoot\system32\hal.dll
  0x80606000 \SystemRoot\system32\kdcom.dll
  0x8060D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x8067D000 \SystemRoot\system32\PSHED.dll
  0x8068E000 \SystemRoot\system32\BOOTVID.dll
  0x80696000 \SystemRoot\system32\CLFS.SYS
  0x806D7000 \SystemRoot\system32\CI.dll
  0x8260F000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x82680000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8268E000 \SystemRoot\system32\drivers\acpi.sys
  0x826D4000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x826DD000 \SystemRoot\system32\drivers\msisadrv.sys
  0x826E5000 \SystemRoot\system32\drivers\pci.sys
  0x8270C000 \SystemRoot\System32\drivers\partmgr.sys
  0x8271B000 \SystemRoot\system32\drivers\volmgr.sys
  0x8272A000 \SystemRoot\System32\drivers\volmgrx.sys
  0x82774000 \SystemRoot\system32\drivers\nvrd32.sys
  0x82797000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x827B8000 \SystemRoot\system32\drivers\pciide.sys
  0x827BF000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x827CD000 \SystemRoot\System32\drivers\mountmgr.sys
  0x827DD000 \SystemRoot\system32\drivers\nvraid.sys
  0x827F8000 \SystemRoot\system32\drivers\atapi.sys
  0x807B7000 \SystemRoot\system32\drivers\ataport.SYS
  0x807D5000 \SystemRoot\system32\drivers\nvstor32.sys
  0x8A20A000 \SystemRoot\system32\drivers\storport.sys
  0x8A24B000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8A27D000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8A28D000 \SystemRoot\system32\DRIVERS\psdfilter.sys
  0x8A296000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8A404000 \SystemRoot\system32\drivers\ndis.sys
  0x8A50F000 \SystemRoot\system32\drivers\msrpc.sys
  0x8A53A000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A307000 \SystemRoot\System32\drivers\tcpip.sys
  0x8A575000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8A601000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8A711000 \SystemRoot\system32\drivers\wd.sys
  0x8A719000 \SystemRoot\system32\drivers\volsnap.sys
  0x8A752000 \SystemRoot\System32\Drivers\spldr.sys
  0x8A75A000 \SystemRoot\System32\Drivers\mup.sys
  0x8A769000 \SystemRoot\System32\drivers\ecache.sys
  0x8A790000 \SystemRoot\system32\drivers\disk.sys
  0x8A7A1000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8A7E5000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8A7F0000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8A590000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8A59F000 \SystemRoot\system32\DRIVERS\serial.sys
  0x8A5B9000 \SystemRoot\system32\DRIVERS\serenum.sys
  0x8A5D6000 \SystemRoot\system32\DRIVERS\L8042mou.Sys
  0x8A5E4000 \SystemRoot\system32\DRIVERS\LMouKE.Sys
  0x8A3F1000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8A7F9000 \SystemRoot\system32\DRIVERS\nvsmu.sys
  0x8A5F6000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x8E009000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8E047000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8E056000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8E0E3000 \SystemRoot\system32\DRIVERS\ohci1394.sys
  0x8E0F3000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
  0x8E101000 \SystemRoot\system32\DRIVERS\atikmpag.sys
  0x8E402000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x8E141000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8EBC0000 \SystemRoot\System32\drivers\watchdog.sys
  0x8EBCC000 \SystemRoot\system32\drivers\Afc.sys
  0x8EBD4000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8EBEC000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0x8EC02000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
  0x8ECFE000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x8ED07000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8ED36000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8ED41000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8ED58000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8ED63000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8ED86000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8ED95000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8EDA9000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8EDBE000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8EDCE000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8EDD9000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8EE00000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8EE2A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8EE34000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8EE41000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8EE76000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8F005000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8F335000 \SystemRoot\system32\drivers\portcls.sys
  0x8F362000 \SystemRoot\system32\drivers\drmk.sys
  0x8F387000 \SystemRoot\system32\drivers\nvhda32v.sys
  0x8F395000 \SystemRoot\system32\drivers\AtihdLH3.sys
  0x8F3AF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8F3B8000 \SystemRoot\System32\Drivers\Null.SYS
  0x8F3BF000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8F3C6000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8F3E2000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8F3E9000 \SystemRoot\System32\drivers\vga.sys
  0x8EE87000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8F3F5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8F3D9000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8EEA8000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8EEB3000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8EEC1000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8EECA000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8EEE0000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8EEF4000 \SystemRoot\system32\drivers\afd.sys
  0x8EF3C000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8EF6E000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8EF84000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8EF92000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8EFA5000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8EFAB000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8EFE7000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8EDDB000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8F609000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8F630000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8F63D000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0x8F647000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
  0x8F66B000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0x8F680000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x97C80000 \SystemRoot\System32\win32k.sys
  0x8F682000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8F68C000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
  0x8F692000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8F69B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8F6AB000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x8F6C2000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
  0x8F6CA000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8F6D2000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
  0x8F6DA000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x8F6E3000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x97EA0000 \SystemRoot\System32\TSDDD.dll
  0x97EC0000 \SystemRoot\System32\ATMFD.DLL
  0x8F6F2000 \SystemRoot\system32\drivers\luafv.sys
  0x8F70D000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x97F10000 \SystemRoot\System32\cdd.dll
  0x8F724000 \SystemRoot\system32\drivers\spsys.sys
  0x8F7D4000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x8F7E4000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9CA0A000 \SystemRoot\system32\drivers\HTTP.sys
  0x9CA77000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9CA94000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9CAAD000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9CAC2000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9CAE3000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9CB02000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9CB3B000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9CB53000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9CB7B000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9CBCA000 \??\C:\Acer\Empowering Technology\eRecovery\int15.sys
  0xA3403000 \SystemRoot\system32\drivers\peauth.sys
  0xA34E1000 \SystemRoot\system32\DRIVERS\PSDNServ.sys
  0xA34EA000 \SystemRoot\system32\DRIVERS\PSDVdisk.sys
  0xA34FC000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xA3506000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xA3512000 \??\C:\Windows\system32\drivers\tvicport.sys
  0xA3515000 \??\C:\Windows\system32\drivers\zntport.sys
  0xA3516000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0xA352B000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0xA353D000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0xA3553000 \??\C:\Windows\system32\drivers\mbam.sys
  0x77970000 \Windows\System32\ntdll.dll

Processes (total 76):
       0 System Idle Process
       4 System
     456 C:\Windows\System32\smss.exe
     524 csrss.exe
     596 C:\Windows\System32\wininit.exe
     608 csrss.exe
     640 C:\Windows\System32\services.exe
     652 C:\Windows\System32\lsass.exe
     664 C:\Windows\System32\lsm.exe
     816 C:\Windows\System32\svchost.exe
     884 C:\Windows\System32\svchost.exe
     944 C:\Windows\System32\svchost.exe
     972 C:\Windows\System32\atiesrxx.exe
    1024 C:\Windows\System32\winlogon.exe
    1052 C:\Windows\System32\svchost.exe
    1084 C:\Windows\System32\svchost.exe
    1096 C:\Windows\System32\svchost.exe
    1208 C:\Windows\System32\audiodg.exe
    1236 C:\Windows\System32\SLsvc.exe
    1292 C:\Windows\System32\svchost.exe
    1392 C:\Windows\System32\svchost.exe
    1604 C:\Windows\System32\spoolsv.exe
    1628 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1640 C:\Windows\System32\svchost.exe
    1788 C:\Windows\System32\atieclxx.exe
     480 C:\Windows\System32\dwm.exe
      12 C:\Windows\explorer.exe
     516 C:\Windows\System32\taskeng.exe
    1184 C:\Windows\System32\taskeng.exe
    2076 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    2100 C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
    2160 C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    2280 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    2336 C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
    2540 C:\Windows\System32\svchost.exe
    2560 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    2640 C:\Windows\System32\svchost.exe
    2648 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    2732 C:\Windows\System32\svchost.exe
    2792 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    2924 C:\Windows\System32\SearchIndexer.exe
    2964 C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    3036 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    3056 C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
    3156 WUDFHost.exe
    3364 C:\Acer\Empowering Technology\SysMonitor.exe
    3380 C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
    3412 C:\Windows\System32\nvraidservice.exe
    3428 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    3444 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    3528 WmiPrvSE.exe
    3688 WmiPrvSE.exe
    3772 C:\Windows\System32\taskeng.exe
    3808 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    3868 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    3896 C:\Program Files\Windows Media Player\wmpnscfg.exe
    3984 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    4040 C:\Windows\System32\wbem\unsecapp.exe
    4052 C:\Program Files\Logitech\SetPoint\SetPoint.exe
    1728 C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    2848 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    3952 C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
    3108 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    4380 C:\Program Files\Windows Media Player\wmpnetwk.exe
    4488 C:\Windows\System32\mobsync.exe
    5964 C:\Windows\System32\svchost.exe
    4988 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    5332 C:\Windows\System32\conime.exe
    5928 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    6116 C:\Windows\servicing\TrustedInstaller.exe
    5340 D:\Programme\Mozilla Firefox\firefox.exe
    2344 C:\Windows\System32\SearchProtocolHost.exe
    5516 C:\Windows\System32\SearchFilterHost.exe
    2816 dllhost.exe
    5464 dllhost.exe
    5852 C:\Users\Marion\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`f3a00000  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000004b`89000000  (NTFS)

PhysicalDrive0 Model Number: WDC WD6400AAKS-22A7B, Rev: 01.0

      Size  Device Name          MBR Status
  --------------------------------------------
    596 GB  \\.\PhysicalDrive0   MBR Code Faked!
            SHA1: E43E29FA989EDD40E2C31C97D282243B52D36B81


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
         

Gmer folgt sogleich.....

Oh, ich meinte eigentlich mit aswmbr, aber der MBR scheint immer noch nicht richtig zu sein...
Kam nach bootrec.exe /fixmnr ein success oder erfolg o.ä.?

Bei der ersten Eingabe habe ich glaube ich nicht darauf geachtet. Bei der zweiten (bootrec.exe/fixmbr) stand soweit ich mich erinner succesfully. Ich kann es aber gerne nochmal machen!

aswmbr? Ok, ich schau mal was ich da finde

Hier noch der Gmer:

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-07-21 21:20:48
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000059 WDC_WD64 rev.01.0
Running: v5lf43dx.exe; Driver: C:\Users\Marion\AppData\Local\Temp\fgriypod.sys


---- Kernel code sections - GMER 1.0.15 ----

.text  C:\Windows\system32\DRIVERS\atikmdag.sys                                  section is writeable [0x8E403000, 0x38E905, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text  C:\Windows\Explorer.EXE[12] SHELL32.dll!SHGetFolderPathAndSubDirW + 81C5  7670B37C 4 Bytes  [50, 26, 00, 10] {PUSH EAX; ADD ES:[EAX], DL}

---- EOF - GMER 1.0.15 ----
         

So, erneut gebootet. Diesmal war es auch so wie in Deiner Beschreibung. Vorher haben komischerweise paar Sachen gefehlt und waren anders...

Aber: Success nur bei boot.exe (?), bootrec.exe/fixbbot. Bei fixmbr sagte er, das Gerät ist nicht bereit

aswMBR version 0.9.7.777 Copyright(c) 2011 AVAST Software
Run date: 2011-07-21 21:49:17
-----------------------------
21:49:17.060    OS Version: Windows 6.0.6002 Service Pack 2
21:49:17.060    Number of processors: 4 586 0x1707
21:49:17.060    ComputerName: MARION-PC  UserName: Marion
21:49:28.650    Initialize success
21:49:34.360    AVAST engine defs: 11072001
21:49:44.266    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000059
21:49:44.266    Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 6
21:49:44.282    Disk 0 MBR read successfully
21:49:44.282    Disk 0 MBR scan
21:49:44.297    Disk 0 unknown MBR code
21:49:44.297    Disk 0 scanning sectors +1250260992
21:49:44.375    Disk 0 scanning C:\Windows\system32\drivers
21:49:51.692    Service scanning
21:49:53.376    Disk 0 trace - called modules:
21:49:53.392    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys 
21:49:53.392    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8637b1a0]
21:49:53.392    3 CLASSPNP.SYS[8279a8b3] -> nt!IofCallDriver -> [0x85a4c700]
21:49:53.392    5 acpi.sys[826946bc] -> nt!IofCallDriver -> \Device\00000059[0x855e5c90]
21:49:54.562    AVAST engine scan C:\Windows
21:49:59.507    AVAST engine scan C:\Windows\system32
21:51:37.023    AVAST engine scan C:\Windows\system32\drivers
21:52:01.078    AVAST engine scan C:\Users\Marion
21:54:05.082    AVAST engine scan C:\ProgramData
21:56:11.910    Scan finished successfully
22:02:08.636    Disk 0 MBR has been saved successfully to "C:\Users\Marion\Desktop\MBR.dat"
22:02:08.651    The log file has been saved successfully to "C:\Users\Marion\Desktop\aswMBR_21_07_11.txt"
         

bootrec.exe/fixbbot. Bei fixmbr sagte er, das Gerät ist nicht bereit

Es heißt richtig: bootrec.exe /fixboot und bootrec.exe /fixmbr

Achte auf die genaue Schreibweisen und Leerzeichen!!

Die Eingabeaufforderung sagt bei beiden "Gerät nicht bereit", Schreibweise + Leerzeichen richtig.

Mein Vorgehen:

- F12 Boot Menü
- CD / DVD... Laufwerk ausgesucht
- ...beliebige Taste drücken... um CD booten
- ...is downloading files...
- 3 x Deutsch auswählen
- Möglichkeiten: Windows Vista installieren,Systemwiederherstellung oder Computerreparationsoption <- ausgewählt
- Fenster mit "Wählen sie ein zu reparierendes Betriebssystem aus und klicken sie auf weiter... also: "Treiber laden" geklickt und Ordnerstruktur System usw wo ich nicht wirklich was auswählen konnte...
- nichts ausgewählt, auf weiter
- Verschiedene Optionen (wie Beschreibung) u.a. Eingabeaufforderung.
- eingegeben, Enter - nix, eingegeben, Enter - nix

Hm...
Dann Probier mit aswMBR den MBR zu fixen. Sicherer vorsichthalber ALLE wichtigen Daten für den Fall der Fälle!

Huhu Arne!
okich danke dir wirklich erstmal für deine hilfe lieber Arne!
aber wie soll ich das machen, sorry, kp
lg mari

aswmbr hat einen FIX Button...

Achso okay


aswMBR version 0.9.7.777 Copyright(c) 2011 AVAST Software
Run date: 2011-07-23 13:13:35
-----------------------------
13:13:35.779 OS Version: Windows 6.0.6002 Service Pack 2
13:13:35.779 Number of processors: 4 586 0x1707
13:13:35.779 ComputerName: MARION-PC UserName: Marion
13:13:36.653 Initialize success
13:14:12.011 AVAST engine defs: 11072301
13:14:29.469 Verifying
13:14:39.484 Disk 0 Windows 600 MBR fixed successfully
13:15:25.036 Disk 0 MBR has been saved successfully to "C:\Users\Marion\Desktop\MBR.dat"
13:15:25.036 The log file has been saved successfully to "C:\Users\Marion\Desktop\aswMBR_23_07_11.txt"

Ok. Mach bitte ein neue Log mit asmbr und poste es