Trojaner-Board - Botnet, wie überprüfe ich meinen PC?

GMER hat sich erst aufgehängt (Programm funktioniert nicht mehr) und mir dann nen bluescreen verpasst -.-

^^ also hier die Logs von OSAM und MBRCheck:

OSAM

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 12:02:02 on 13.04.2011
 

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.16
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"iproset.cpl" - "Intel(R) Corporation" - C:\Windows\system32\iproset.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"PROSet Tools" - "Intel(R) Corporation" - C:\Windows\System32\iPROSet.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"acedrv10" (acedrv10) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv10.sys

"acehlp10" (acehlp10) - "Protect Software GmbH" - C:\Windows\system32\drivers\acehlp10.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"Bytemobile Boot Time Load Driver" (BMLoad) - "Bytemobile, Inc." - C:\Windows\System32\drivers\BMLoad.sys

"Bytemobile Kernel Network Provider" (tcpipBM) - "Bytemobile, Inc." - C:\Windows\system32\drivers\tcpipBM.sys

"catchme" (catchme) - ? - C:\Users\UserXY\AppData\Local\Temp\catchme.sys  (File not found)

"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"MIDITECH01 MIDI driver service" (MIDITECH_01) - "Ploytec GmbH" - C:\Windows\System32\drivers\mt01drv.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{30351349-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\Display\nvui.dll

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{30351346-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{30351347-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{30351348-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{30351349-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{3035134A-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{3035134B-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{3035134C-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{3035134D-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{3035134E-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{3035134F-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{30351350-7B7D-4FCC-81B4-1E394CA267EB} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll

{C5994560-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994561-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994562-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994563-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994564-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994565-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994566-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994567-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{C5994568-53D9-4125-87C9-F193FC689CB2} "TortoiseSVN" - "hxxp://tortoisesvn.net" - C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10l.ocx / hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ7.2" - "ICQ, LLC." - C:\Program Files\ICQ7.2\ICQ.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\UserXY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"FreePDF Assistant" - "shbox.de" - C:\Program Files\FreePDF_XP\fpassist.exe

"tsnp2uvc" - ? - C:\Windows\tsnp2uvc.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe

"Intel® PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

"Intel® PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

"PnkBstrA" (PnkBstrA) - ? - C:\Windows\system32\PnkBstrA.exe  (File found, but it contains no detailed information)

"Vodafone Mobile Connect Service" (VMCService) - "Vodafone" - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBRCheck

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows Vista Home Premium Edition

Windows Information:                Service Pack 1 (build 6001), 32-bit

Base Board Manufacturer:        MEDION

BIOS Manufacturer:                Phoenix Technologies LTD

System Manufacturer:                MEDION

System Product Name:                P6612

Logical Drives Mask:                0x0000001c
 

Kernel Drivers (total 150):

  0x82050000 \SystemRoot\system32\ntkrnlpa.exe

  0x8201D000 \SystemRoot\system32\hal.dll

  0x8040C000 \SystemRoot\system32\kdcom.dll

  0x80414000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x80474000 \SystemRoot\system32\PSHED.dll

  0x80485000 \SystemRoot\system32\BOOTVID.dll

  0x8048D000 \SystemRoot\system32\CLFS.SYS

  0x804CE000 \SystemRoot\system32\CI.dll

  0x8060F000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x8068B000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x80698000 \SystemRoot\system32\drivers\acpi.sys

  0x806DE000 \SystemRoot\system32\drivers\WMILIB.SYS

  0x806E7000 \SystemRoot\system32\drivers\msisadrv.sys

  0x806EF000 \SystemRoot\system32\drivers\pci.sys

  0x80716000 \SystemRoot\System32\drivers\partmgr.sys

  0x80725000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x80728000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x80732000 \SystemRoot\system32\drivers\volmgr.sys

  0x80741000 \SystemRoot\System32\drivers\volmgrx.sys

  0x8078B000 \SystemRoot\System32\drivers\mountmgr.sys

  0x8079B000 \SystemRoot\system32\drivers\atapi.sys

  0x807A3000 \SystemRoot\system32\drivers\ataport.SYS

  0x807C1000 \SystemRoot\system32\drivers\msahci.sys

  0x807CB000 \SystemRoot\system32\drivers\PCIIDEX.SYS

  0x805AE000 \SystemRoot\system32\drivers\fltmgr.sys

  0x807D9000 \SystemRoot\system32\drivers\fileinfo.sys

  0x82604000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x82675000 \SystemRoot\system32\drivers\ndis.sys

  0x82780000 \SystemRoot\system32\drivers\msrpc.sys

  0x827AB000 \SystemRoot\system32\drivers\NETIO.SYS

  0x8A001000 \SystemRoot\System32\drivers\tcpip.sys

  0x8A0EA000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x8A20E000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x8A31D000 \SystemRoot\system32\drivers\volsnap.sys

  0x8A356000 \SystemRoot\System32\Drivers\spldr.sys

  0x8A35E000 \SystemRoot\System32\Drivers\mup.sys

  0x8A36D000 \SystemRoot\System32\drivers\ecache.sys

  0x8A394000 \SystemRoot\system32\drivers\disk.sys

  0x8A3A5000 \SystemRoot\system32\drivers\CLASSPNP.SYS

  0x8A3C6000 \SystemRoot\system32\drivers\crcdisk.sys

  0x8A3CF000 \SystemRoot\system32\drivers\BMLoad.sys

  0x8A200000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x8A3F7000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0x8A105000 \SystemRoot\system32\DRIVERS\wmiacpi.sys

  0x8E00E000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys

  0x8E9AB000 \SystemRoot\system32\DRIVERS\nvBridge.kmd

  0x8A10E000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x8E9AD000 \SystemRoot\System32\drivers\watchdog.sys

  0x8E9BA000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0x8A1AD000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x8E9C5000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x8E9D4000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x8EA04000 \SystemRoot\system32\DRIVERS\NETw5v32.sys

  0x8ED9A000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x8ED9E000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x8EDB1000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x8EDBC000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x8EE02000 \??\C:\Windows\system32\drivers\acehlp10.sys

  0x8EE3E000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8EE56000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x8EE65000 \SystemRoot\system32\DRIVERS\msiscsi.sys

  0x8EE93000 \SystemRoot\system32\DRIVERS\storport.sys

  0x8EED4000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8EEDF000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x8EEF6000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8EF01000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x8EF24000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x8EF33000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x8EF47000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x8EF5C000 \SystemRoot\system32\DRIVERS\hamachi.sys

  0x8EF61000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8EF71000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x8EF73000 \SystemRoot\system32\DRIVERS\ks.sys

  0x8EF9D000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8EFA7000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x8EFB4000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x8F007000 \SystemRoot\system32\drivers\RTKVHDA.sys

  0x8F290000 \SystemRoot\system32\drivers\portcls.sys

  0x8F2BD000 \SystemRoot\system32\drivers\drmk.sys

  0x8F2E2000 \SystemRoot\system32\drivers\nvhda32v.sys

  0x8F303000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x8F314000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0x8F31D000 \SystemRoot\System32\Drivers\Null.SYS

  0x8F324000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8F32B000 \SystemRoot\System32\drivers\vga.sys

  0x8F337000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x8F358000 \SystemRoot\System32\Drivers\BTHUSB.sys

  0x8F364000 \SystemRoot\System32\Drivers\bthport.sys

  0x8F39E000 \SystemRoot\System32\Drivers\USBD.SYS

  0x8F3A0000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0x8F3B2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x8F3BA000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x8F3C3000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x8F3D3000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x8F3DA000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8F3E2000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8F3ED000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8EFE8000 \SystemRoot\System32\DRIVERS\rasacd.sys

  0x8EDC7000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8F3FB000 \SystemRoot\System32\Drivers\tcpipBM.SYS

  0x8EDDD000 \SystemRoot\system32\DRIVERS\smb.sys

  0x8F60C000 \SystemRoot\system32\drivers\afd.sys

  0x8F654000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8F686000 \SystemRoot\system32\drivers\ws2ifsl.sys

  0x8F68F000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8F6A5000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8F6B3000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8F6C6000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0x8F6CC000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8F708000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x8F710000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8F71A000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8F731000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0x8F757000 \SystemRoot\system32\DRIVERS\rfcomm.sys

  0x8F768000 \SystemRoot\system32\DRIVERS\BthEnum.sys

  0x8F772000 \SystemRoot\system32\DRIVERS\bthpan.sys

  0x8F78C000 \SystemRoot\System32\Drivers\x10ufx2.sys

  0x8F796000 \SystemRoot\system32\DRIVERS\cdfs.sys

  0x8F7AC000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x8F7B9000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x8F7C4000 \SystemRoot\System32\Drivers\dump_msahci.sys

  0x96270000 \SystemRoot\System32\win32k.sys

  0x8F7CE000 \SystemRoot\System32\drivers\Dxapi.sys

  0x8F7D8000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x96490000 \SystemRoot\System32\TSDDD.dll

  0x964B0000 \SystemRoot\System32\cdd.dll

  0x8A3D5000 \SystemRoot\system32\drivers\luafv.sys

  0x8F7E7000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0x9C007000 \SystemRoot\system32\drivers\spsys.sys

  0x9C0B6000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x9C0C6000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x9C0F0000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x9C0FA000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x9C10D000 \SystemRoot\system32\drivers\HTTP.sys

  0x9C17A000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x9C197000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x9C1B0000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x9C1C5000 \SystemRoot\system32\drivers\mrxdav.sys

  0x805E0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x9E001000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x9E03A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x9E052000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x9E07A000 \SystemRoot\System32\DRIVERS\srv.sys

  0x9E0E0000 \??\C:\Windows\system32\drivers\acedrv10.sys

  0x9F20F000 \SystemRoot\system32\drivers\peauth.sys

  0x9F2ED000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x9F2F7000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x9F303000 \SystemRoot\system32\DRIVERS\WUDFRd.sys

  0x9F318000 \SystemRoot\system32\DRIVERS\WUDFPf.sys

  0x77790000 \Windows\System32\ntdll.dll
 

Processes (total 64):

       0 System Idle Process

       4 System

     432 C:\Windows\System32\smss.exe

     560 csrss.exe

     612 C:\Windows\System32\wininit.exe

     620 csrss.exe

     656 C:\Windows\System32\services.exe

     688 C:\Windows\System32\lsass.exe

     696 C:\Windows\System32\lsm.exe

     844 C:\Windows\System32\svchost.exe

     912 C:\Windows\System32\nvvsvc.exe

     940 C:\Windows\System32\svchost.exe

     980 C:\Windows\System32\svchost.exe

    1028 C:\Windows\System32\svchost.exe

    1064 C:\Windows\System32\svchost.exe

    1076 C:\Windows\System32\svchost.exe

    1136 C:\Windows\System32\winlogon.exe

    1224 C:\Windows\System32\audiodg.exe

    1252 C:\Windows\System32\SLsvc.exe

    1324 C:\Windows\System32\svchost.exe

    1424 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

    1436 C:\Windows\System32\nvvsvc.exe

    1692 C:\Windows\System32\svchost.exe

    1860 C:\Windows\System32\wlanext.exe

    2004 C:\Windows\System32\spoolsv.exe

    2044 C:\Program Files\Avira\AntiVir Desktop\sched.exe

     244 C:\Windows\System32\svchost.exe

      12 C:\Windows\System32\dwm.exe

    1244 C:\Windows\explorer.exe

    1724 C:\Windows\System32\taskeng.exe

    1480 C:\Windows\System32\taskeng.exe

    1600 C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    1172 C:\Windows\System32\svchost.exe

    1688 C:\Program Files\Intel\WiFi\bin\EvtEng.exe

    2136 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

    2264 C:\Windows\System32\PnkBstrA.exe

    2300 C:\Windows\System32\svchost.exe

    2332 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

    2372 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

    2396 C:\Windows\System32\svchost.exe

    2440 C:\Windows\System32\svchost.exe

    2468 C:\Windows\System32\SearchIndexer.exe

    2512 WUDFHost.exe

    2612 C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

    3068 WmiPrvSE.exe

    3992 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    4032 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

    4076 C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

     568 C:\Windows\tsnp2uvc.exe

    2324 C:\Program Files\FreePDF_XP\fpassist.exe

     288 C:\Program Files\Skype\Phone\Skype.exe

    2688 C:\Windows\System32\mobsync.exe

    2220 C:\Program Files\Mozilla Firefox\firefox.exe

    4008 C:\Program Files\Windows Media Player\wmplayer.exe

    3052 C:\Program Files\Skype\Plugin Manager\skypePM.exe

    4336 C:\Windows\System32\wuauclt.exe

    4444 C:\Program Files\Mozilla Firefox\plugin-container.exe

    4400 C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

     264 taskeng.exe

    5408 C:\Windows\System32\SearchProtocolHost.exe

     536 C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\SearchFilterHost.exe

    4648 C:\Windows\System32\notepad.exe

    3792 C:\Users\UserXY\Desktop\OSAM7\MBRCheck.exe

    1320 C:\Windows\System32\conime.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
 

PhysicalDrive0 Model Number: WDCWD3200BEVT-22ZCT0, Rev: 11.01A11
 

      Size  Device Name          MBR Status

  --------------------------------------------

    298 GB  \\.\PhysicalDrive0   Windows 2008 MBR code detected

            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
 
 

Done!

LG Change