Trojaner-Board - Schädlicher Eintrag?

hallo

hier die 3 logs:

GMER
GMER Logfile:

Code:

GMER 1.0.15.15570 - hxxp://www.gmer.net

Rootkit scan 2011-04-19 10:22:46

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Hitachi_HTS543216L9A300 rev.FB2OC4CC

Running: grk1f7ty.exe; Driver: C:\DOKUME~1\Floh\LOKALE~1\Temp\pxtdypow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            F7AE916E                                 ZwCreateKey

SSDT            F7AE9164                                 ZwCreateThread

SSDT            F7AE9173                                 ZwDeleteKey

SSDT            F7AE917D                                 ZwDeleteValueKey

SSDT            F7AE9182                                 ZwLoadKey

SSDT            F7AE9150                                 ZwOpenProcess

SSDT            F7AE9155                                 ZwOpenThread

SSDT            F7AE918C                                 ZwReplaceKey

SSDT            F7AE9187                                 ZwRestoreKey

SSDT            F7AE9178                                 ZwSetValueKey
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0  SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1  SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

osam
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 10:29:26 on 19.04.2011
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 4.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"MagicKBD.cpl" - "SAMSUNG Electronics Co., Ltd." - C:\WINDOWS\system32\MagicKBD.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL

"Pando" - ? - C:\Programme\Pando Networks\Media Booster\PMB.cpl  (File not found)

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\cofi\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"DNSeFilter" (DNSeFilter) - "Samsung Electronics,.LTD" - C:\WINDOWS\System32\drivers\SamsungEDS.sys

"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"MEMIO" (DOSMEMIO) - ? - C:\WINDOWS\system32\MEMIO.SYS  (File found, but it contains no detailed information)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"pxtdypow" (pxtdypow) - ? - C:\DOKUME~1\Floh\LOKALE~1\Temp\pxtdypow.sys  (Hidden registry entry, rootkit activity | File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"SUE NDIS Protocol Driver" (SUEPD) - "Samsung" - C:\WINDOWS\System32\DRIVERS\SUE_PD.sys

"VClone" (VClone) - "Elaborate Bytes AG" - C:\WINDOWS\System32\DRIVERS\VClone.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

{3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} "vnd.ms.radio" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CC450D71-CC90-424C-8638-1F2DBAC87A54} "ArmHelper Control" - ? - ./Images/armhelper.ocx  (File not found) / file://C:\Programme\Monopoly\Images\armhelper.ocx

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10o.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

{149E45D8-163E-4189-86FC-45022AB2B6C9} "SpinTop DRM Control" - "SpinTop Media Inc." - C:\WINDOWS\DOWNLO~1\stg_drm.ocx / file://C:\Programme\Monopoly\Images\stg_drm.ocx

{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

"ICQ Lite" - ? - C:\Programme\ICQLite\ICQLite.exe  (File not found)

"ICQ7.4" - "ICQ, LLC." - C:\Programme\ICQ7.4\ICQ.exe

"Messenger" - ? - C:\Programme\Messenger\msmsgs.exe  (File not found)

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "{8E718888-423F-11D2-876E-00A0C9082467}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Floh\Startmenü\Programme\Autostart\desktop.ini

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"BatteryManager" - ? - C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe

"EDS" - "Samsung Electronics,.LTD" - C:\Programme\Samsung\Samsung EDS\EDSAgent.exe

"GrooveMonitor" - "Microsoft Corporation" - "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe"

"MagicKeyboard" - ? - C:\Programme\SAMSUNG\MagicKBD\PreMKBD.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE

"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - ? - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe  (File not found)
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/PHP]

und
mbrcheck

PHP-Code:

   MBRCheck, version 1.2.3

(c) 2010, AD

 
Command-line:            

Windows Version:        Windows XP Home Edition

Windows Information:        Service Pack 3 (build 2600)

Logical Drives Mask:        0x0000000c

 
Kernel Drivers (total 123):

  0x804D7000 \WINDOWS\system32\ntoskrnl.exe

  0x80700000 \WINDOWS\system32\hal.dll

  0xF79CB000 \WINDOWS\system32\KDCOM.DLL

  0xF78DB000 \WINDOWS\system32\BOOTVID.dll

  0xF747B000 ACPI.sys

  0xF79CD000 \WINDOWS\system32\DRIVERS\WMILIB.SYS

  0xF746A000 pci.sys

  0xF74CB000 isapnp.sys

  0xF78DF000 compbatt.sys

  0xF78E3000 \WINDOWS\system32\DRIVERS\BATTC.SYS

  0xF7A93000 pciide.sys

  0xF774B000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF74DB000 MountMgr.sys

  0xF744B000 ftdisk.sys

  0xF78E7000 ACPIEC.sys

  0xF7A94000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS

  0xF7753000 PartMgr.sys

  0xF74EB000 VolSnap.sys

  0xF7433000 atapi.sys

  0xF74FB000 disk.sys

  0xF750B000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF7413000 fltMgr.sys

  0xF7401000 sr.sys

  0xF751B000 PxHelp20.sys

  0xF73EA000 KSecDD.sys

  0xF735D000 Ntfs.sys

  0xF7330000 NDIS.sys

  0xF7316000 Mup.sys

  0xF796B000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0xF75BB000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0xF6D27000 \SystemRoot\system32\DRIVERS\igxpmp32.sys

  0xF6D13000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF6CEB000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0xF6CA4000 \SystemRoot\system32\DRIVERS\yk51x86.sys

  0xF77BB000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0xF6C80000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF77C3000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF796F000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0xF75CB000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF77CB000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF6C49000 \SystemRoot\system32\DRIVERS\SynTP.sys

  0xF79D7000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF77D3000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF7B4F000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF75DB000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF7973000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF6C32000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF75EB000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF75FB000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF77DB000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF6C21000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF760B000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF77E3000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF77EB000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF761B000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF79D9000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF6BFE000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF6BA0000 \SystemRoot\system32\DRIVERS\update.sys

  0xF797F000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF762B000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF765B000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xAA30E000 \SystemRoot\system32\drivers\RtkHDAud.sys

  0xAA2EA000 \SystemRoot\system32\drivers\portcls.sys

  0xF766B000 \SystemRoot\system32\drivers\drmk.sys

  0xAA2D8000 \SystemRoot\system32\drivers\SamsungEDS.sys

  0xF79ED000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF7AB0000 \SystemRoot\System32\Drivers\Null.SYS

  0xF79EF000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF781B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0xF7823000 \SystemRoot\System32\drivers\vga.sys

  0xF79F1000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF79F3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF782B000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF7833000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF72D6000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xAA255000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xAA1FC000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xAA1D6000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xAA1AE000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xF769B000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xAA176000 \SystemRoot\system32\DRIVERS\tcpip6.sys

  0xAA154000 \SystemRoot\System32\drivers\afd.sys

  0xF76CB000 \SystemRoot\system32\DRIVERS\Ip6Fw.sys

  0xF76DB000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF785B000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xAA089000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xAA019000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF770B000 \SystemRoot\System32\Drivers\Fips.SYS

  0xAA004000 \SystemRoot\system32\DRIVERS\hspabus.sys

  0xF7A09000 \SystemRoot\system32\DRIVERS\hspawh.sys

  0xA9FC9000 \SystemRoot\System32\Drivers\VMC326.sys

  0xF7873000 \SystemRoot\System32\Drivers\ElbyCDIO.sys

  0xA9F7B000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF7A0F000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xA9F5F000 \SystemRoot\system32\DRIVERS\hspamdm.sys

  0xF7A11000 \SystemRoot\system32\DRIVERS\hspacm.sys

  0xF787B000 \SystemRoot\System32\Drivers\Modem.SYS

  0xAA2CC000 \SystemRoot\system32\DRIVERS\hspamdfl.sys

  0xA9F48000 \SystemRoot\system32\DRIVERS\hspaserd.sys

  0xAA2A0000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0xF773B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0xAA29C000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0xA9F30000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF7A23000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xF6B88000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF788B000 \SystemRoot\System32\watchdog.sys

  0xBF000000 \SystemRoot\System32\drivers\dxg.sys

  0xF7B6F000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF024000 \SystemRoot\System32\igxpgd32.dll

  0xBF012000 \SystemRoot\System32\igxprd32.dll

  0xBF04F000 \SystemRoot\System32\igxpdv32.DLL

  0xBF1E7000 \SystemRoot\System32\igxpdx32.DLL

  0xA9DDB000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xF7B89000 \??\C:\WINDOWS\system32\MEMIO.SYS

  0xA9DD7000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xA9B7E000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xA99EC000 \SystemRoot\system32\DRIVERS\srv.sys

  0xA959F000 \SystemRoot\system32\drivers\wdmaud.sys

  0xA96CC000 \SystemRoot\system32\drivers\sysaudio.sys

  0xA932E000 \SystemRoot\System32\Drivers\HTTP.sys

  0xA909B000 \??\C:\DOKUME~1\Floh\LOKALE~1\Temp\pxtdypow.sys

  0x7C910000 \WINDOWS\system32\ntdll.dll

 
Processes (total 39):

       0 System Idle Process

       4 System

     724 C:\WINDOWS\system32\smss.exe

     796 csrss.exe

     820 C:\WINDOWS\system32\winlogon.exe

     864 C:\WINDOWS\system32\services.exe

     876 C:\WINDOWS\system32\lsass.exe

    1068 C:\WINDOWS\system32\svchost.exe

    1132 svchost.exe

    1192 C:\WINDOWS\system32\svchost.exe

    1292 svchost.exe

    1364 svchost.exe

    1452 C:\WINDOWS\system32\spoolsv.exe

    1500 C:\Programme\Avira\AntiVir Desktop\sched.exe

    1584 C:\Programme\Avira\AntiVir Desktop\avguard.exe

    1600 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    1616 C:\Programme\Bonjour\mDNSResponder.exe

    1672 C:\Programme\Java\jre6\bin\jqs.exe

    1744 C:\WINDOWS\system32\svchost.exe

    1900 C:\Programme\Avira\AntiVir Desktop\avshadow.exe

     260 C:\WINDOWS\system32\wbem\wmiapsrv.exe

     292 alg.exe

    2120 C:\WINDOWS\system32\wscntfy.exe

    2140 C:\WINDOWS\explorer.exe

    2296 C:\WINDOWS\RTHDCPL.EXE

    2316 C:\Programme\Samsung\Samsung EDS\EDSAgent.exe

    2332 C:\WINDOWS\system32\hkcmd.exe

    2340 C:\WINDOWS\system32\igfxpers.exe

    2376 C:\WINDOWS\system32\igfxsrvc.exe

    2384 C:\Programme\Synaptics\SynTP\SynTPEnh.exe

    2460 C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe

    2488 C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe

    2516 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    2524 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

    2536 C:\WINDOWS\system32\ctfmon.exe

    2568 C:\Programme\Samsung\MagicKBD\MagicKBD.exe

    2580 C:\Programme\Samsung\MagicKBD\PerformanceManager.exe

    2708 C:\Programme\Mozilla Firefox\firefox.exe

    3120 C:\Dokumente und Einstellungen\Floh\Desktop\MBRCheck.exe

 
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`805e2000  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000013`43300000  (NTFS)

 
PhysicalDrive0 Model Number: HitachiHTS543216L9A300, Rev: FB2OC4CC

 
      Size  Device Name          MBR Status

  --------------------------------------------

    149 GB  \\.\PhysicalDrive0   Unknown MBR code

            SHA1: 42E42764FEB1DDBC1575EA329FD1E177D9059E1C

 
 
Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit: 

 
Done!