ControlSet002 ?

oraculum · 22.11.2010, 14:27

Code:

ATTFilter

GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2010-11-22 14:21:50
Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.FG01
Running: l4jis364.exe; Driver: C:\Users\***\AppData\Local\Temp\kfldypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                    8307A599 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                             8309EF52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                             section is writeable [0x8EBB5300, 0x3B6D8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                             section is writeable [0x8EBF8300, 0x1BEE, 0xE8000020]

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                    [748D2494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]               [748B5624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]              [748B56E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                     [748D250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]           [748C8573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]             [748C4D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]            [748C50CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]           [748C51A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]  [748C66D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]            [748C82CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]       [748C8819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]     [748C907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]           [748CE21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[1876] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]               [748C4C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                            Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                            Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000050                                                                  halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                             fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                             fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                             fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Code:

ATTFilter

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows 7 Home Premium Edition
Windows Information:		 (build 7600), 32-bit
Base Board Manufacturer:	TOSHIBA
BIOS Manufacturer:		INSYDE
System Manufacturer:		TOSHIBA
System Product Name:		Satellite L300
Logical Drives Mask:		0x0001001c

Kernel Drivers (total 195):
  0x83037000 \SystemRoot\system32\ntkrnlpa.exe
  0x83000000 \SystemRoot\system32\halmacpi.dll
  0x80BC8000 \SystemRoot\system32\kdcom.dll
  0x8360A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x83682000 \SystemRoot\system32\PSHED.dll
  0x83693000 \SystemRoot\system32\BOOTVID.dll
  0x8369B000 \SystemRoot\system32\CLFS.SYS
  0x836DD000 \SystemRoot\system32\CI.dll
  0x83788000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x8AE19000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8AE27000 \SystemRoot\system32\DRIVERS\ACPI.sys
  0x8AE6F000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
  0x8AE78000 \SystemRoot\system32\DRIVERS\msisadrv.sys
  0x8AE80000 \SystemRoot\system32\DRIVERS\pci.sys
  0x8AEAA000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
  0x8AEB5000 \SystemRoot\System32\drivers\partmgr.sys
  0x8AEC6000 \SystemRoot\system32\DRIVERS\volmgr.sys
  0x8AED6000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8AF21000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8AF29000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x8AF34000 \SystemRoot\System32\drivers\mountmgr.sys
  0x8B028000 \SystemRoot\system32\DRIVERS\iaStor.sys
  0x8B0F6000 \SystemRoot\system32\DRIVERS\amdxata.sys
  0x8B0FF000 \SystemRoot\system32\drivers\fltmgr.sys
  0x8B133000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8B224000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8B353000 \SystemRoot\System32\Drivers\msrpc.sys
  0x8B37E000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8B391000 \SystemRoot\System32\Drivers\cng.sys
  0x8B3EE000 \SystemRoot\System32\drivers\pcw.sys
  0x8B200000 \SystemRoot\System32\Drivers\Fs_Rec.sys
  0x8B144000 \SystemRoot\system32\drivers\ndis.sys
  0x8AF4A000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8B000000 \SystemRoot\System32\Drivers\ksecpkg.sys
  0x8B427000 \SystemRoot\System32\drivers\tcpip.sys
  0x8B570000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8B5A1000 \SystemRoot\system32\DRIVERS\volsnap.sys
  0x8B5E0000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
  0x8B5E5000 \SystemRoot\System32\Drivers\spldr.sys
  0x8AF88000 \SystemRoot\System32\drivers\rdyboost.sys
  0x8B5ED000 \SystemRoot\System32\Drivers\mup.sys
  0x8B400000 \SystemRoot\System32\drivers\hwpolicy.sys
  0x8AFB5000 \SystemRoot\System32\DRIVERS\fvevol.sys
  0x8B408000 \SystemRoot\system32\DRIVERS\disk.sys
  0x8B60A000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
  0x8B71B000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8B73A000 \SystemRoot\System32\Drivers\Null.SYS
  0x8B741000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8B748000 \SystemRoot\System32\drivers\vga.sys
  0x8B754000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8B775000 \SystemRoot\System32\drivers\watchdog.sys
  0x8B782000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8B78A000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8B792000 \SystemRoot\system32\drivers\rdprefmp.sys
  0x8B79A000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8B7A5000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8B7B3000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8B7CA000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x90C2C000 \SystemRoot\system32\drivers\afd.sys
  0x90C86000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x90CB8000 \SystemRoot\system32\DRIVERS\wfplwf.sys
  0x90CBF000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x90CDE000 \SystemRoot\system32\DRIVERS\vwififlt.sys
  0x90CF4000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x90D02000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x90D15000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x90D25000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x90D2B000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x90D6C000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x90D76000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x90D80000 \SystemRoot\System32\drivers\discache.sys
  0x90D8C000 \SystemRoot\System32\Drivers\dfsc.sys
  0x90DA4000 \SystemRoot\system32\DRIVERS\blbdrive.sys
  0x90DB2000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x90DD5000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x90DD7000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x90DF8000 \SystemRoot\system32\DRIVERS\FwLnk.sys
  0x90C00000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x90C12000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x92426000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
  0x92D43000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x9340E000 \SystemRoot\System32\drivers\dxgmms1.sys
  0x93447000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x93452000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x9349D000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x934AC000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x934CB000 \SystemRoot\system32\DRIVERS\Rt86win7.sys
  0x94227000 \SystemRoot\system32\DRIVERS\athr.sys
  0x94354000 \SystemRoot\system32\DRIVERS\vwifibus.sys
  0x9435E000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x94376000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x94383000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x943B3000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x943B5000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x943C2000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x943C8000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
  0x943D5000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
  0x943E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x94200000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x93510000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x9420B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x93532000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x93549000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x94223000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x93560000 \SystemRoot\system32\DRIVERS\ks.sys
  0x93594000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x935A2000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x935E6000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x96601000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x97220000 \SystemRoot\system32\drivers\portcls.sys
  0x9724F000 \SystemRoot\system32\drivers\drmk.sys
  0x97268000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0x9736E000 \SystemRoot\system32\drivers\modem.sys
  0x9737B000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x99440000 \SystemRoot\System32\win32k.sys
  0x97391000 \SystemRoot\System32\drivers\Dxapi.sys
  0x9739B000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8B62F000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0x973A8000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
  0x973B9000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x996A0000 \SystemRoot\System32\TSDDD.dll
  0x996D0000 \SystemRoot\System32\cdd.dll
  0x973C4000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x973DB000 \SystemRoot\System32\Drivers\UVCFTR_S.SYS
  0x92400000 \SystemRoot\System32\Drivers\usbvideo.sys
  0x973E3000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x97200000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x97213000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x973EE000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8B6FD000 \SystemRoot\system32\drivers\luafv.sys
  0x90C16000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x973F9000 \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftvollh.sys
  0x8B7D5000 \SystemRoot\system32\drivers\WudfPf.sys
  0x8B7EF000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x8EA02000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x8EA48000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x8EA58000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x8EA6B000 \SystemRoot\system32\drivers\HTTP.sys
  0x8EAF9000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x8EB12000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x8EB24000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x8EB47000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x8EB82000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x8EBB5000 \SystemRoot\system32\DRIVERS\atksgt.sys
  0x8EBF8000 \SystemRoot\system32\DRIVERS\lirsgt.sys
  0xB3231000 \SystemRoot\system32\drivers\peauth.sys
  0xB32C8000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xB32D2000 \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftfslh.sys
  0xB335D000 \??\C:\Program Files\Microsoft Application Virtualization Client\drivers\sftplaylh.sys
  0xB3392000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0xB33B3000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xB502A000 \SystemRoot\System32\DRIVERS\srv2.sys
  0xB5079000 \SystemRoot\System32\DRIVERS\srv.sys
  0xB50CA000 \SystemRoot\system32\DRIVERS\Sftredirlh.sys
  0xB513D000 \SystemRoot\system32\DRIVERS\asyncmac.sys
  0xB5146000 \??\C:\Users\***\AppData\Local\Temp\kfldypow.sys
  0x77BE0000 \Windows\System32\ntdll.dll
  0x47B10000 \Windows\System32\smss.exe
  0x77E20000 \Windows\System32\apisetschema.dll
  0x00EE0000 \Windows\System32\autochk.exe
  0x77DB0000 \Windows\System32\difxapi.dll
  0x77DA0000 \Windows\System32\lpk.dll
  0x77B10000 \Windows\System32\user32.dll
  0x77910000 \Windows\System32\iertutil.dll
  0x77870000 \Windows\System32\usp10.dll
  0x777E0000 \Windows\System32\clbcatq.dll
  0x77D50000 \Windows\System32\Wldap32.dll
  0x77D30000 \Windows\System32\sechost.dll
  0x77730000 \Windows\System32\msvcrt.dll
  0x77650000 \Windows\System32\kernel32.dll
  0x775D0000 \Windows\System32\comdlg32.dll
  0x774D0000 \Windows\System32\wininet.dll
  0x77D20000 \Windows\System32\psapi.dll
  0x77430000 \Windows\System32\advapi32.dll
  0x77290000 \Windows\System32\setupapi.dll
  0x77150000 \Windows\System32\urlmon.dll
  0x77100000 \Windows\System32\gdi32.dll
  0x770C0000 \Windows\System32\ws2_32.dll
  0x770A0000 \Windows\System32\imm32.dll
  0x76450000 \Windows\System32\shell32.dll
  0x76380000 \Windows\System32\msctf.dll
  0x762D0000 \Windows\System32\rpcrt4.dll
  0x76240000 \Windows\System32\oleaut32.dll
  0x760E0000 \Windows\System32\ole32.dll
  0x760D0000 \Windows\System32\nsi.dll
  0x760C0000 \Windows\System32\normaliz.dll
  0x76060000 \Windows\System32\shlwapi.dll
  0x76030000 \Windows\System32\imagehlp.dll
  0x76000000 \Windows\System32\cfgmgr32.dll
  0x75FD0000 \Windows\System32\wintrust.dll
  0x75F80000 \Windows\System32\KernelBase.dll
  0x75F60000 \Windows\System32\devobj.dll
  0x75E40000 \Windows\System32\crypt32.dll
  0x75DB0000 \Windows\System32\comctl32.dll
  0x75DA0000 \Windows\System32\msasn1.dll

Processes (total 72):
       0 System Idle Process
       4 System
     300 C:\Windows\System32\smss.exe
     436 csrss.exe
     488 C:\Windows\System32\wininit.exe
     500 csrss.exe
     544 C:\Windows\System32\services.exe
     568 C:\Windows\System32\lsass.exe
     576 C:\Windows\System32\lsm.exe
     684 C:\Windows\System32\svchost.exe
     708 C:\Windows\System32\winlogon.exe
     828 C:\Windows\System32\svchost.exe
     892 C:\Windows\System32\svchost.exe
     956 C:\Windows\System32\svchost.exe
     988 C:\Windows\System32\svchost.exe
    1128 C:\Windows\System32\svchost.exe
    1296 C:\Windows\System32\svchost.exe
    1420 C:\Windows\System32\spoolsv.exe
    1484 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1504 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    1532 C:\Windows\System32\svchost.exe
    1640 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    1648 C:\Windows\System32\conhost.exe
    1724 C:\Windows\System32\taskhost.exe
    1796 C:\Windows\System32\dwm.exe
    1876 C:\Windows\explorer.exe
    2044 C:\Windows\System32\taskeng.exe
     564 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
     356 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
     572 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    1048 C:\Windows\System32\hkcmd.exe
    1188 C:\Windows\System32\igfxpers.exe
    1984 C:\Windows\RtHDVCpl.exe
    1680 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
     624 C:\Program Files\iTunes\iTunesHelper.exe
    2052 C:\Program Files\Windows Sidebar\sidebar.exe
    2116 C:\Program Files\Bonjour\mDNSResponder.exe
    2200 C:\Program Files\OpenOffice.org 3\program\soffice.exe
    2228 C:\Program Files\OpenOffice.org 3\program\soffice.bin
    2336 C:\Windows\System32\svchost.exe
    2360 C:\Windows\System32\svchost.exe
    2428 C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
    2516 C:\Windows\System32\svchost.exe
    2548 C:\Windows\System32\svchost.exe
    2768 C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
    2848 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2876 C:\Windows\System32\svchost.exe
    3016 C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
    3084 C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
    3436 C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
    3496 C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    3972 C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
    4000 C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
    4068 C:\Windows\System32\svchost.exe
    1992 C:\Windows\System32\SearchIndexer.exe
    2248 C:\Program Files\iPod\bin\iPodService.exe
    1896 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
     352 C:\Program Files\Windows Media Player\wmpnetwk.exe
    4516 C:\Windows\System32\svchost.exe
    5996 C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
    6052 C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    6112 C:\Windows\System32\svchost.exe
    3384 C:\Windows\System32\svchost.exe
    6124 C:\Windows\System32\audiodg.exe
    4052 C:\Program Files\Mozilla Firefox\firefox.exe
    1492 C:\Windows\System32\SearchProtocolHost.exe
    5916 C:\Windows\System32\SearchFilterHost.exe
    3872 C:\Windows\explorer.exe
    5064 dllhost.exe
    4264 dllhost.exe
    4364 C:\Users\***\Desktop\MBRCheck.exe
    3928 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000  (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000002e`e7700000  (NTFS)
\\.\Q: -->  error 5

PhysicalDrive0 Model Number: TOSHIBAMK4055GSX, Rev: FG011M  

      Size  Device Name          MBR Status
  --------------------------------------------
    372 GB  \\.\PhysicalDrive0   Windows 7 MBR code detected
            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

Hmm.. komisch : Wenn ich jetzt unter C: gehe, dann werden Ordner wie $INPLACE.~TR eingeblendet (auch wenn ich versteckte Ordner ausblenden lasse), obwohl diese eigentlich versteckt sein sollten.

ControlSet002 ?

Plagegeister aller Art und deren Bekämpfung: ControlSet002 ?

ControlSet002 ?