Trojaner-Board - Trojaner TR/Kazy.23836.20 und .10, Desktop schwarz, Festplatte Fehlermeldung etc.

Danke! Jetzt geht es wieder.

Hier ist der ComboFix logfile.

Der Desktophintergrund ist weiterhin schwarz und es kommt beim starten wieder die Meldung, dass ein Autostartprogramm geblockt wurde. Systemskonfigurationsprogramm von Windows {D1F60CCB-8329-406E-976F-660B1BDF0D97}.

Die Meldungen zum Catalyst Host Centre und SMS Desktop bleiben jetzt weg.

Gruesse,

Frederic.

Code:

ComboFix 11-06-28.04 - Frédéric 28/06/2011  23:55:18.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.43.1031.18.2045.909 [GMT 2:00]

ausgeführt von:: c:\users\FrÚdÚric\Desktop\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\xp

c:\programdata\xp\EBLib.dll

c:\programdata\xp\TPwSav.sys

c:\users\Frédéric\AppData\Roaming\Microsoft\Windows\Recent\mxfilerelatedcache.mxc2

c:\users\Frédéric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery

c:\users\Frédéric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery\Uninstall Windows Vista Recovery.lnk

c:\users\Frédéric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery\Windows Vista Recovery.lnk

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-05-28 bis 2011-06-28  ))))))))))))))))))))))))))))))

.

.

2011-06-28 22:10 . 2011-06-28 22:10        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-06-26 18:52 . 2011-06-26 18:52        --------        d-----w-        C:\_OTL

2011-06-25 16:47 . 2011-06-25 16:47        --------        d-----w-        c:\users\Frédéric\AppData\Roaming\Malwarebytes

2011-06-25 16:47 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-25 16:47 . 2011-06-25 16:47        --------        d-----w-        c:\programdata\Malwarebytes

2011-06-25 16:46 . 2011-05-29 07:11        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-06-25 16:46 . 2011-06-25 16:47        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-06-03 21:03 . 2011-06-03 21:03        0        ----a-w-        c:\users\Frédéric\AppData\Local\BITBEBD.tmp

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-03 21:03 . 2011-06-03 21:03        0        ----a-w-        c:\users\Frédéric\AppData\Local\BITBEBD.tmp

2011-06-03 21:03 . 2011-06-03 21:03        0        ----a-w-        c:\users\Frédéric\AppData\Local\BITBEBD.tmp

2011-05-26 22:37 . 2011-05-26 22:37        72704        ----a-w-        c:\windows\system32\admparse.dll

2011-05-26 22:37 . 2011-05-26 22:37        832512        ----a-w-        c:\windows\system32\wininet.dll

2011-05-26 22:37 . 2011-05-26 22:37        52736        ----a-w-        c:\windows\apppatch\iebrshim.dll

2011-05-26 22:37 . 2011-05-26 22:37        389120        ----a-w-        c:\windows\system32\html.iec

2011-05-26 22:37 . 2011-05-26 22:37        78336        ----a-w-        c:\windows\system32\ieencode.dll

2011-05-26 22:37 . 2011-05-26 22:37        48128        ----a-w-        c:\windows\system32\mshtmler.dll

2011-05-26 22:37 . 2011-05-26 22:37        1383424        ----a-w-        c:\windows\system32\mshtml.tlb

2011-05-26 22:37 . 2011-05-26 22:37        1830912        ----a-w-        c:\windows\system32\inetcpl.cpl

2011-05-26 22:37 . 2011-05-26 22:37        26624        ----a-w-        c:\windows\system32\ieUnatt.exe

2011-05-26 22:37 . 2011-05-26 22:37        56320        ----a-w-        c:\windows\system32\iesetup.dll

2011-05-26 22:33 . 2011-05-26 22:33        84992        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-05-26 22:33 . 2011-05-26 22:33        306688        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-05-26 22:32 . 2011-05-26 22:32        211968        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys

2011-05-26 22:32 . 2011-05-26 22:32        58368        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2011-05-26 22:32 . 2011-05-26 22:32        102400        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-05-26 22:31 . 2011-05-26 22:31        3502480        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2011-05-26 22:31 . 2011-05-26 22:31        3468168        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-05-26 22:31 . 2011-05-26 22:31        434176        ----a-w-        c:\windows\system32\vbscript.dll

2011-05-26 22:28 . 2011-05-26 22:28        2048        ----a-w-        c:\windows\system32\tzres.dll

2011-05-26 22:26 . 2011-05-26 22:26        171520        ----a-w-        c:\windows\system32\wintrust.dll

2011-05-26 22:20 . 2011-05-26 22:20        62464        ----a-w-        c:\windows\system32\l3codeca.acm

2011-05-26 22:20 . 2011-05-26 22:20        220672        ----a-w-        c:\windows\system32\l3codecp.acm

2011-05-26 22:20 . 2011-05-26 22:20        25088        ----a-w-        c:\windows\system32\drivers\tunnel.sys

2011-05-26 22:20 . 2011-05-26 22:20        179712        ----a-w-        c:\windows\system32\iphlpsvc.dll

2011-05-26 22:20 . 2011-05-26 22:20        22016        ----a-w-        c:\windows\system32\netiougc.exe

2011-05-26 22:20 . 2011-05-26 22:20        167424        ----a-w-        c:\windows\system32\tcpipcfg.dll

2011-05-26 22:20 . 2011-05-26 22:20        15360        ----a-w-        c:\windows\system32\drivers\TUNMP.SYS

2011-05-26 22:20 . 2011-05-26 22:20        815104        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2011-05-26 22:19 . 2011-05-26 22:19        293376        ----a-w-        c:\windows\system32\browserchoice.exe

2011-05-26 22:06 . 2011-05-26 22:06        97792        ----a-w-        c:\windows\system32\cabview.dll

2011-05-26 22:04 . 2011-05-26 22:04        435712        ----a-w-        c:\windows\system32\RMActivate_ssp.exe

2011-05-26 22:04 . 2011-05-26 22:04        312320        ----a-w-        c:\windows\system32\msdrm.dll

2011-05-26 22:04 . 2011-05-26 22:04        431104        ----a-w-        c:\windows\system32\RMActivate_ssp_isv.exe

2011-05-26 22:04 . 2011-05-26 22:04        154624        ----a-w-        c:\windows\system32\secproc_ssp_isv.dll

2011-05-26 22:04 . 2011-05-26 22:04        154112        ----a-w-        c:\windows\system32\secproc_ssp.dll

2011-05-26 22:04 . 2011-05-26 22:04        523776        ----a-w-        c:\windows\system32\RMActivate_isv.exe

2011-05-26 22:04 . 2011-05-26 22:04        515584        ----a-w-        c:\windows\system32\RMActivate.exe

2011-05-26 22:04 . 2011-05-26 22:04        473088        ----a-w-        c:\windows\system32\secproc_isv.dll

2011-05-26 22:04 . 2011-05-26 22:04        472576        ----a-w-        c:\windows\system32\secproc.dll

2011-05-26 22:02 . 2011-05-26 22:02        31232        ----a-w-        c:\windows\system32\httpapi.dll

2011-05-26 22:02 . 2011-05-26 22:02        396800        ----a-w-        c:\windows\system32\drivers\http.sys

2011-05-26 22:02 . 2011-05-26 22:02        24064        ----a-w-        c:\windows\system32\nshhttp.dll

2011-05-24 06:59 . 2011-05-24 06:59        22528        ----a-w-        c:\windows\system32\msyuv.dll

2011-05-24 06:59 . 2011-05-24 06:59        50176        ----a-w-        c:\windows\system32\iyuv_32.dll

2011-05-24 06:59 . 2011-05-24 06:59        1327616        ----a-w-        c:\windows\system32\quartz.dll

2011-05-24 06:59 . 2011-05-24 06:59        11776        ----a-w-        c:\windows\system32\tsbyuv.dll

2011-05-24 06:59 . 2011-05-24 06:59        88576        ----a-w-        c:\windows\system32\avifil32.dll

2011-05-24 06:59 . 2011-05-24 06:59        82944        ----a-w-        c:\windows\system32\mciavi32.dll

2011-05-24 06:59 . 2011-05-24 06:59        65024        ----a-w-        c:\windows\system32\avicap32.dll

2011-05-24 06:59 . 2011-05-24 06:59        31232        ----a-w-        c:\windows\system32\msvidc32.dll

2011-05-24 06:59 . 2011-05-24 06:59        13312        ----a-w-        c:\windows\system32\msrle32.dll

2011-05-24 06:59 . 2011-05-24 06:59        123904        ----a-w-        c:\windows\system32\msvfw32.dll

2011-04-12 07:00 . 2009-12-01 19:31        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-02-10 1232896]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-07-06 2634048]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HWSetup"="\HWSetup.exe hwSetUP" [X]

"RtHDVCpl"="RtHDVCpl.exe" [2007-04-25 4444160]

"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2007-03-29 411192]

"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2006-12-07 55416]

"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2007-05-23 509496]

"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2007-05-22 538744]

"KeNotify"="c:\program files\TOSHIBA\Utilities\KeNotify.exe" [2006-11-06 34352]

"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-03-22 438272]

"NDSTray.exe"="NDSTray.exe" [BU]

"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-04-02 577536]

"Desktop SMS"="c:\program files\IDM\Desktop SMS\DesktopSMS.exe" [2007-01-19 1507328]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-19 861744]

"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2007-05-04 571024]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2011-04-28 789392]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [x]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 135664]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 135664]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]

R3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys [x]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-09-23 64288]

S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-04-28 1181328]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - 49183229

*Deregistered* - 49183229

.

Inhalt des "geplante Tasks" Ordners

.

2011-06-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 16:09]

.

2011-06-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 16:09]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.ixquick.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

TCP: DhcpNameServer = 89.2.0.1 89.2.0.2

FF - ProfilePath - c:\users\Frédéric\AppData\Roaming\Mozilla\Firefox\Profiles\7d8aoqi3.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.ixquick.com/

FF - prefs.js: network.proxy.type - 0

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-TOSCDSPD - TOSCDSPD.EXE

AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-06-29 00:10

Windows 6.0.6000  NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

.

c:\users\FRDRIC~1\AppData\Local\Temp\catchme.dll

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 1

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

Zeit der Fertigstellung: 2011-06-29  00:15:35

ComboFix-quarantined-files.txt  2011-06-28 22:15

.

Vor Suchlauf: 25 Verzeichnis(se), 26*974*208*000 Bytes frei

Nach Suchlauf: 28 Verzeichnis(se), 27*411*079*168 Bytes frei

.

- - End Of File - - 6EF8B3348E31145E910464FD4D393D98

Hallo,

GMER ist abgestuerzt, zuerst ganz am Anfang, dann mittendrin.

Hier sind die logfiles von OSAM und MBRCheck. Ich kann leider das OSAM logfile nicht in der .log Version anhaengen und die praktische Formattierung geht verloren.

Gruesse,

Frederic.

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 22:05:05 on 29.06.2011
 

OS: Windows Vista Home Premium Edition (Build 6000), 32-bit

Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.16386
 

Scanner Settings

Rootkits detection (hidden registry)

Rootkits detection (hidden files)

Retrieve files information

Check Microsoft signatures
 

Filters

Trusted entries

Empty entries

Hidden registry entries (rootkit activity)

Exclusively opened files

Not found files

Files without detailed information

Existing files

Non-startable services

Non-startable drivers

Active entries

Disabled entries
 

  Risk Name Publisher Full Path Status 

Boot Execute 

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager 

        "BootExecute"  C:\Windows\system32\lsdelete.exe File found, but it contains no detailed information 

Common 

%SystemRoot%\Tasks 

   "GoogleUpdateTaskMachineCore.job" "Google Inc." C:\Program Files\Google\Update\GoogleUpdate.exe File exists 

   "GoogleUpdateTaskMachineUA.job" "Google Inc." C:\Program Files\Google\Update\GoogleUpdate.exe File exists 

Control Panel Objects 

%SystemRoot%\system32 

   "DivXControlPanelApplet.cpl" "DivX, Inc." C:\Windows\system32\DivXControlPanelApplet.cpl File exists 

   "javacpl.cpl" "Sun Microsystems, Inc." C:\Windows\system32\javacpl.cpl File exists 

   "TOSCDSPD.cpl"  C:\Windows\system32\TOSCDSPD.cpl File found, but it contains no detailed information 

HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls 

   "mlcfg32.cpl" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL File exists 

   "QuickTime" "Apple Inc." C:\Program Files\QuickTime\QTSystem\QuickTime.cpl File exists 

Drivers 

HKLM\SYSTEM\CurrentControlSet\Services 

   "avgio" (avgio) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\avgio.sys File exists 

   "avgntflt" (avgntflt) "Avira GmbH" C:\Windows\System32\DRIVERS\avgntflt.sys File exists 

   "avipbb" (avipbb) "Avira GmbH" C:\Windows\System32\DRIVERS\avipbb.sys File exists 

   "catchme" (catchme)  C:\Users\FRDRIC~1\AppData\Local\Temp\catchme.sys File not found 

   "IP in IP Tunnel Driver" (IpInIp)  C:\Windows\System32\DRIVERS\ipinip.sys File not found 

   "IPX Traffic Filter Driver" (NwlnkFlt)  C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found 

   "IPX Traffic Forwarder Driver" (NwlnkFwd)  C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found 

   "MBAMSwissArmy" (MBAMSwissArmy) "Malwarebytes Corporation" C:\Windows\system32\drivers\mbamswissarmy.sys File exists 

   "ssmdrv" (ssmdrv) "Avira GmbH" C:\Windows\System32\DRIVERS\ssmdrv.sys File exists 

   "Tosrfcom" (Tosrfcom)  C:\Windows\system32\drivers\Tosrfcom.sys File not found 

   "Touch Pad Detection Filter driver" (TpChoice)  C:\Windows\System32\DRIVERS\TpChoice.sys File not found 

Explorer 

HKLM\Software\Classes\Folder\shellex\ColumnHandlers 

   {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll File exists 

HKLM\Software\Classes\Protocols\Filter 

   {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL File exists 

HKLM\Software\Classes\Protocols\Handler 

   {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll File exists 

   {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" "Skype Technologies" C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL File exists 

   {88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll File exists 

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks 

   {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved 

   {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files"   File not found | COM-object registry key not found 

   {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" "Igor Pavlov" C:\Users\Frédéric\Desktop\7-Zip\7-zip.dll File exists 

   {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder"   File not found | COM-object registry key not found 

   {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder"   File not found | COM-object registry key not found 

   {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder"   File not found | COM-object registry key not found 

   {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band"   File not found | COM-object registry key not found 

   {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\msohevi.dll File exists 

   {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists 

   {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL File exists 

   {00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL File exists 

   {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists 

   {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL File exists 

   {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder"   File not found | COM-object registry key not found 

   {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder"   File not found | COM-object registry key not found 

   {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\shlext.dll File exists 

   {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class"  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll File exists 

   {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service"   File not found | COM-object registry key not found 

   {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" "Alexander Roshal" C:\Program Files\WinRAR\rarext.dll File exists 

Internet Explorer 

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser 

   "Google Toolbar" "Google Inc." C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File exists 

   "ITBar7Layout"   File not found | COM-object registry key not found 

HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units 

   {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0"

hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll File exists 

   {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.6.0"

hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll File exists 

   {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0"

hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll File exists 

   {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}"

hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab   File not found | COM-object registry key not found 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions 

   "Amazon.de"  hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home HTTP value 

   {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} "ClsidExtension" "Sun Microsystems, Inc." C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll File exists 

   "eBay - Der weltweite Online Marktplatz"  hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 HTTP value 

   {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL File exists 

   {48E73304-E1D6-4330-914C-F5F514E3486C} "Send to OneNote" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll File exists 

   {77BF5300-1474-4EC7-9980-D32B190E9B07} "Skype" "Skype Technologies S.A." C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll File exists 

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar 

   "Google Toolbar" "Google Inc." C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File exists 

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 

   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" "Adobe Systems Incorporated" C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll File exists 

   {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" "Google Inc." C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File exists 

   {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" "Google Inc." C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll File exists 

   {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists 

   {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} "metaspinner media GmbH"  C:\PROGRA~1\YETISP~1\IEBUTT~1.DLL File found, but it contains no detailed information 

   {22BF413B-C6D2-4d91-82A9-A0F997BA588C} "Skype add-on (mastermind)" "Skype Technologies S.A." C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll File exists 

   {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" "Sun Microsystems, Inc." C:\Program Files\Java\jre1.6.0\bin\ssv.dll File exists 

Logon 

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup 

   "desktop.ini"  C:\Users\Frédéric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists 

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup 

   "Adobe Reader Synchronizer.lnk" "Adobe Systems Incorporated" C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe Shortcut exists | File exists 

   "desktop.ini"  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 

   "VeohPlugin" "Veoh Networks" "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" File exists 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce 

   "AutoLaunch"  C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe monthly File found, but it contains no detailed information 

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd 

   "StartupPrograms"  rdpclip File not found 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run 

   "00TCrdMain" "TOSHIBA Corporation" %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe File exists 

   "Ad-Watch" "Lavasoft" C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe File exists 

   "avgnt" "Avira GmbH" "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min File exists 

   "Desktop SMS" "Interactive Digital Media" C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto File exists 

   "DivXUpdate"  "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW File exists 

   "GrooveMonitor" "Microsoft Corporation" "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" File exists 

   "HSON" "TOSHIBA Corporation" %ProgramFiles%\TOSHIBA\TBS\HSON.exe File exists 

   "HWSetup"  \HWSetup.exe hwSetUP File not found 

   "KeNotify"  C:\Program Files\TOSHIBA\Utilities\KeNotify.exe File exists 

   "Malwarebytes' Anti-Malware (reboot)" "Malwarebytes Corporation" "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript File exists 

   "NDSTray.exe"  NDSTray.exe File not found 

   "QuickTime Task" "Apple Inc." "C:\Program Files\QuickTime\QTTask.exe" -atboottime File exists 

   "SmoothView" "TOSHIBA Corporation" %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe File exists 

   "StartCCC"  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe File found, but it contains no detailed information 

   "SVPWUTIL" "TOSHIBA" C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL File exists 

   "topi" "TOSHIBA" C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup File exists 

   "Toshiba Registration" "Toshiba" C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe File exists 

   "TPwrMain" "TOSHIBA Corporation" %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE File exists 

Print Monitors 

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors 

   "Send To Microsoft OneNote Monitor" "Microsoft Corporation" C:\Windows\system32\msonpmon.dll File exists 

   "Toshiba Bluetooth Monitor" "TOSHIBA CORPORATION." C:\Windows\system32\tbtmon.dll File exists 

Services 

HKLM\SYSTEM\CurrentControlSet\Services 

   "Automatisches LiveUpdate - Scheduler" (Automatisches LiveUpdate - Scheduler)  "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" File not found 

   "Avira AntiVir Guard" (AntiVirService) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\avguard.exe File exists 

   "Avira AntiVir Planificateur" (AntiVirSchedulerService) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\sched.exe File exists 

   "ConfigFree Service" (CFSvcs) "TOSHIBA CORPORATION" C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe File exists 

   "Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) "MAGIX®" C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe File exists 

   "Google Software Updater" (gusvc) "Google" C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe File exists 

   "Google Update Service (gupdate)" (gupdate) "Google Inc." C:\Program Files\Google\Update\GoogleUpdate.exe File exists 

   "Google Update-Dienst (gupdatem)" (gupdatem) "Google Inc." C:\Program Files\Google\Update\GoogleUpdate.exe File exists 

   "InstallDriver Table Manager" (IDriverT) "Macrovision Corporation" C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe File exists 

   "Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) "Lavasoft" C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe File exists 

   "Microsoft Office Diagnostics Service" (odserv) "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE File exists 

   "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe File exists 

   "Office Source Engine" (ose) "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File exists 

   "TOSHIBA Bluetooth Service" (TOSHIBA Bluetooth Service)  c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe File not found 

   "TOSHIBA Navi Support Service" (TNaviSrv) "TOSHIBA Corporation" C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe File exists 

   "TOSHIBA Optical Disc Drive Service" (TODDSrv) "TOSHIBA Corporation" C:\Windows\system32\TODDSrv.exe File exists 

   "TOSHIBA Power Saver" (TosCoSrv) "TOSHIBA Corporation" C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe File exists 

   "Ulead Burning Helper" (UleadBurningHelper) "Ulead Systems, Inc." C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe File exists 
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows Vista Home Premium Edition

Windows Information:                 (build 6000), 32-bit

Base Board Manufacturer:        TOSHIBA

BIOS Manufacturer:                TOSHIBA

System Manufacturer:                TOSHIBA

System Product Name:                Satellite A210

Logical Drives Mask:                0x00000034
 

Kernel Drivers (total 142):

  0x81C00000 \SystemRoot\system32\ntkrnlpa.exe

  0x81FA1000 \SystemRoot\system32\hal.dll

  0x802C6000 \SystemRoot\system32\kdcom.dll

  0x802BD000 \SystemRoot\system32\PSHED.dll

  0x802B5000 \SystemRoot\system32\BOOTVID.dll

  0x8027A000 \SystemRoot\system32\CLFS.SYS

  0x8051F000 \SystemRoot\system32\CI.dll

  0x804A4000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x8026D000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x8022A000 \SystemRoot\system32\drivers\acpi.sys

  0x80221000 \SystemRoot\system32\drivers\WMILIB.SYS

  0x80219000 \SystemRoot\system32\drivers\msisadrv.sys

  0x8047F000 \SystemRoot\system32\drivers\pci.sys

  0x8020A000 \SystemRoot\system32\drivers\volmgr.sys

  0x80200000 \SystemRoot\system32\DRIVERS\LPCFilter.sys

  0x8047C000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x80472000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x80462000 \SystemRoot\System32\drivers\mountmgr.sys

  0x8045B000 \SystemRoot\system32\drivers\pciide.sys

  0x8044D000 \SystemRoot\system32\drivers\PCIIDEX.SYS

  0x80423000 \SystemRoot\system32\DRIVERS\pcmcia.sys

  0x807B6000 \SystemRoot\System32\drivers\volmgrx.sys

  0x8041B000 \SystemRoot\system32\drivers\atapi.sys

  0x80798000 \SystemRoot\system32\drivers\ataport.SYS

  0x80767000 \SystemRoot\system32\drivers\fltmgr.sys

  0x8040B000 \SystemRoot\system32\drivers\fileinfo.sys

  0x80758000 \SystemRoot\system32\DRIVERS\Lbd.sys

  0x80654000 \SystemRoot\system32\drivers\ndis.sys

  0x80629000 \SystemRoot\system32\drivers\msrpc.sys

  0x825C7000 \SystemRoot\system32\drivers\NETIO.SYS

  0x824BF000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x82455000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x8241F000 \SystemRoot\system32\drivers\volsnap.sys

  0x80406000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS

  0x827B5000 \SystemRoot\system32\DRIVERS\tos_sps32.sys

  0x80621000 \SystemRoot\System32\Drivers\spldr.sys

  0x80612000 \SystemRoot\System32\drivers\partmgr.sys

  0x80603000 \SystemRoot\System32\Drivers\mup.sys

  0x82790000 \SystemRoot\System32\drivers\ecache.sys

  0x8240E000 \SystemRoot\system32\drivers\disk.sys

  0x8276F000 \SystemRoot\system32\drivers\CLASSPNP.SYS

  0x82405000 \SystemRoot\system32\drivers\crcdisk.sys

  0x8AAC7000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x8344D000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0x831C5000 \SystemRoot\system32\DRIVERS\amdk8.sys

  0x8B128000 \SystemRoot\system32\DRIVERS\atikmdag.sys

  0x8B089000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x8AA6A000 \SystemRoot\System32\drivers\watchdog.sys

  0x8AA58000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x8AA44000 \SystemRoot\system32\DRIVERS\Rtlh86.sys

  0x8B952000 \SystemRoot\system32\DRIVERS\athr.sys

  0x8AA3A000 \SystemRoot\system32\DRIVERS\usbohci.sys

  0x8B04C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x8AA2C000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x8AB66000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys

  0x8AA14000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8AA01000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x8AB27000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x8B020000 \SystemRoot\system32\DRIVERS\SynTP.sys

  0x82600000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x8AB1C000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x8AB36000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x83081000 \SystemRoot\system32\DRIVERS\ohci1394.sys

  0x8B012000 \SystemRoot\system32\DRIVERS\1394BUS.SYS

  0x8B906000 \SystemRoot\system32\drivers\tifm21.sys

  0x8B8EE000 \SystemRoot\system32\DRIVERS\sdbus.sys

  0x8B8C3000 \SystemRoot\system32\DRIVERS\msiscsi.sys

  0x8B883000 \SystemRoot\system32\DRIVERS\storport.sys

  0x8B878000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8B861000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x8B856000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8B833000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x8B824000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x8B811000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x8BDE4000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x83565000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x8BDBA000 \SystemRoot\system32\DRIVERS\ks.sys

  0x8BDB0000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8BDF3000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x8BD7C000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x830A1000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x8BD2D000 \SystemRoot\system32\drivers\HdAudio.sys

  0x8BD00000 \SystemRoot\system32\drivers\portcls.sys

  0x8BCDB000 \SystemRoot\system32\drivers\drmk.sys

  0x8BEE4000 \SystemRoot\system32\DRIVERS\AGRSM.sys

  0x8BCCE000 \SystemRoot\system32\drivers\modem.sys

  0x8C051000 \SystemRoot\system32\drivers\RTKVHDA.sys

  0x83405000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0x8ABC2000 \SystemRoot\System32\Drivers\Null.SYS

  0x8ABC9000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8B006000 \SystemRoot\System32\drivers\vga.sys

  0x8BC6D000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x83529000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x834A9000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8B806000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8BC3F000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8340E000 \SystemRoot\System32\DRIVERS\rasacd.sys

  0x8BE0F000 \SystemRoot\System32\drivers\tcpip.sys

  0x8BC26000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x8BC11000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8C03D000 \SystemRoot\system32\DRIVERS\smb.sys

  0x8C3B9000 \SystemRoot\system32\drivers\afd.sys

  0x8C00B000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8C3A3000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8BC03000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8C390000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8AAE4000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0x8C355000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8BE05000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8C33E000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8C2D8000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0x83557000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys

  0x8DD30000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x8AB78000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x83501000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0x93E00000 \SystemRoot\System32\win32k.sys

  0x9416A000 \SystemRoot\System32\drivers\Dxapi.sys

  0x94295000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x95600000 \SystemRoot\System32\TSDDD.dll

  0x95610000 \SystemRoot\System32\cdd.dll

  0x94C12000 \SystemRoot\system32\drivers\luafv.sys

  0x9596B000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0x97C13000 \SystemRoot\system32\drivers\spsys.sys

  0x94020000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x98195000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x8C001000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x98182000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0x99328000 \SystemRoot\system32\drivers\HTTP.sys

  0x99252000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0x99239000 \SystemRoot\system32\DRIVERS\bowser.sys

  0x99225000 \SystemRoot\System32\drivers\mpsdrv.sys

  0x99205000 \SystemRoot\system32\drivers\mrxdav.sys

  0x9B1E2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0x96587000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0x96575000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x96551000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x96500000 \SystemRoot\System32\DRIVERS\srv.sys

  0x9B094000 \SystemRoot\system32\drivers\peauth.sys

  0x941EC000 \SystemRoot\System32\Drivers\secdrv.SYS

  0x8DC84000 \SystemRoot\System32\drivers\tcpipreg.sys

  0x9D40A000 \SystemRoot\system32\DRIVERS\cdfs.sys

  0x77610000 \Windows\System32\ntdll.dll
 

Processes (total 71):

       0 System Idle Process

       4 System

     408 C:\Windows\System32\smss.exe

     548 csrss.exe

     600 C:\Windows\System32\wininit.exe

     608 csrss.exe

     648 C:\Windows\System32\services.exe

     660 C:\Windows\System32\lsass.exe

     668 C:\Windows\System32\lsm.exe

     712 C:\Windows\System32\winlogon.exe

     860 C:\Windows\System32\svchost.exe

     920 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

     964 C:\Windows\System32\svchost.exe

    1100 C:\Windows\System32\Ati2evxx.exe

    1120 C:\Windows\System32\svchost.exe

    1148 C:\Windows\System32\svchost.exe

    1180 C:\Windows\System32\svchost.exe

    1284 C:\Windows\System32\audiodg.exe

    1320 C:\Windows\System32\SLsvc.exe

    1372 C:\Windows\System32\svchost.exe

    1480 C:\Windows\System32\Ati2evxx.exe

    1540 C:\Windows\System32\svchost.exe

    1848 C:\Windows\System32\dwm.exe

    1872 C:\Windows\explorer.exe

    1956 C:\Windows\System32\spoolsv.exe

    2024 C:\Program Files\Avira\AntiVir Desktop\sched.exe

     232 C:\Windows\System32\svchost.exe

     260 C:\Windows\RtHDVCpl.exe

     336 C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

     352 C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

     420 C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

     456 C:\Windows\System32\taskeng.exe

     272 C:\Windows\System32\taskeng.exe

     400 C:\Program Files\Google\Update\GoogleUpdate.exe

    2172 C:\Windows\System32\agrsmsvc.exe

    2184 C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    2200 C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

    2216 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

    2288 C:\Windows\System32\svchost.exe

    2308 C:\Windows\System32\svchost.exe

    2344 C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

    2516 C:\Windows\System32\TODDSrv.exe

    2572 C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

    2616 C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    2676 C:\Windows\System32\svchost.exe

    2700 C:\Windows\System32\SearchIndexer.exe

    3544 C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

    3564 C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

    3572 C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe

    3592 C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe

    3656 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    3684 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    3732 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    3740 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

    3748 C:\Program Files\DivX\DivX Update\DivXUpdate.exe

    3796 C:\Program Files\Synaptics\SynTP\SynToshiba.exe

    3804 C:\Program Files\Windows Sidebar\sidebar.exe

    3812 C:\Windows\ehome\ehtray.exe

    3828 C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

    3836 C:\Program Files\Windows Media Player\wmpnscfg.exe

    3956 C:\Windows\ehome\ehmsas.exe

    4072 C:\Program Files\Windows Media Player\wmpnetwk.exe

    1548 C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

    2320 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

    3448 C:\Program Files\Windows Mail\WinMail.exe

    2428 C:\Windows\System32\wuauclt.exe

    2512 C:\Windows\System32\SearchProtocolHost.exe

    3668 C:\Windows\servicing\TrustedInstaller.exe

    1788 C:\Windows\System32\SearchFilterHost.exe

    2968 C:\Users\Frédéric\Desktop\MBRCheck.exe

     452 C:\Windows\System32\conime.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000  (NTFS)

\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000017`a7c00000  (NTFS)
 

PhysicalDrive0 Model Number: HitachiHTS542520K9SA00, Rev: BBDOC33P
 

      Size  Device Name          MBR Status

  --------------------------------------------

    186 GB  \\.\PhysicalDrive0   Windows 2008 MBR code detected

            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
 
 

Done!