Trojaner-Board - Joke/Rjump und Java Agent.M.1

So, hier habe ich schonmal gmer (hat total lange gedauert):

GMER Logfile:

Code:

GMER 1.0.15.15640 - hxxp://www.gmer.net

Rootkit scan 2011-07-13 01:28:15

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST3160812AS rev.3.AAE

Running: irs92xyd.exe; Driver: C:\DOKUME~1\Kekse\LOKALE~1\Temp\pxtdapog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            F7C6F33C                                  ZwClose

SSDT            F7C6F2F6                                  ZwCreateKey

SSDT            F7C6F346                                  ZwCreateSection

SSDT            F7C6F2EC                                  ZwCreateThread

SSDT            F7C6F2FB                                  ZwDeleteKey

SSDT            F7C6F305                                  ZwDeleteValueKey

SSDT            F7C6F337                                  ZwDuplicateObject

SSDT            F7C6F30A                                  ZwLoadKey

SSDT            F7C6F2D8                                  ZwOpenProcess

SSDT            F7C6F2DD                                  ZwOpenThread

SSDT            F7C6F314                                  ZwReplaceKey

SSDT            F7C6F30F                                  ZwRestoreKey

SSDT            F7C6F34B                                  ZwSetContextThread

SSDT            F7C6F300                                  ZwSetValueKey

SSDT            F7C6F2E7                                  ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys  section is writeable [0xF6392360, 0x3441C7, 0xE8000020]
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \FileSystem\Fastfat \Fat                  fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Sieht so klein aus-ob ich alles richtig gemacht habe??

Osam:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 01:36:35 on 13.07.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

"wuaucpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Anchorfree HSS Adapter" (taphss) - "AnchorFree Inc" - C:\WINDOWS\System32\DRIVERS\taphss.sys

"ASPI32" (ASPI32) - "Adaptec" - C:\WINDOWS\system32\drivers\ASPI32.sys

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"BrPar" (BrPar) - "Brother Industries Ltd." - C:\WINDOWS\System32\drivers\BrPar.sys

"catchme" (catchme) - ? - C:\DOKUME~1\Kekse\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"Hotspot Shield Helper Miniport" (HssDrv) - "AnchorFree Inc." - C:\WINDOWS\System32\DRIVERS\HssDrv.sys

"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys  (File not found)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"MHN-Treiber" (MHNDRV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mhndrv.sys

"Nsynas32" (Nsynas32) - ? - C:\WINDOWS\system32\drivers\Nsynas32.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"pxtdapog" (pxtdapog) - ? - C:\DOKUME~1\Kekse\LOKALE~1\Temp\pxtdapog.sys  (Hidden registry entry, rootkit activity | File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{12D51199-0DB5-46FE-A120-47A3D7D937CC} "DVD: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} "TV: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll

{5F327514-6C5E-4d60-8F16-D07FA08A78ED} "Auto Update Property Sheet Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -   (File not found | COM-object registry key not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

{E54B19BC-69B6-43B2-A1F2-15BBC1D72C93} "wodShellMenu" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10e.ocx / https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ7" - "ICQ, LLC." - C:\Programme\ICQ7.0\ICQ.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Kekse\Startmenü\Programme\Autostart\desktop.ini

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"nwiz" - "NVIDIA Corporation" - nwiz.exe /install

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"getPlus(R) Helper" (getPlusHelper) - "NOS Microsystems Ltd." - C:\Programme\NOS\bin\getPlus_Helper.dll

"Hotspot Shield Monitoring Service" (HssWd) - ? - C:\Programme\Hotspot Shield\bin\hsswd.exe  (File found, but it contains no detailed information)

"Hotspot Shield Routing Service" (HssSrv) - ? - C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe

"Hotspot Shield Service" (HotspotShieldService) - ? - C:\Programme\Hotspot Shield\bin\openvpnas.exe  (File found, but it contains no detailed information)

"Hotspot Shield Tray Service" (HssTrayService) - ? - C:\Programme\Hotspot Shield\bin\HssTrayService.EXE  (File found, but it contains no detailed information)

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Media Center Receiver Service" (ehRecvr) - "Microsoft Corporation" - C:\WINDOWS\eHome\ehRecvr.exe

"Media Center-Planerdienst" (ehSched) - "Microsoft Corporation" - C:\WINDOWS\eHome\ehSched.exe

"MHN" (MHN) - "Microsoft Corporation" - C:\WINDOWS\System32\mhn.dll

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]

und das letzte:

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 122):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D1000 \WINDOWS\system32\hal.dll
0xF7ADB000 \WINDOWS\system32\KDCOM.DLL
0xF79EB000 \WINDOWS\system32\BOOTVID.dll
0xF74AB000 ACPI.sys
0xF7ADD000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF749A000 pci.sys
0xF75DB000 isapnp.sys
0xF75EB000 ohci1394.sys
0xF75FB000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7BA3000 PCIIde.sys
0xF785B000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xF7ADF000 intelide.sys
0xF760B000 MountMgr.sys
0xF747B000 ftdisk.sys
0xF7AE1000 dmload.sys
0xF7455000 dmio.sys
0xF7863000 PartMgr.sys
0xF761B000 VolSnap.sys
0xF743D000 atapi.sys
0xF762B000 disk.sys
0xF763B000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF741D000 fltmgr.sys
0xF740B000 sr.sys
0xF73F4000 KSecDD.sys
0xF7367000 Ntfs.sys
0xF733A000 NDIS.sys
0xF7320000 Mup.sys
0xF768B000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6392000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF637E000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF6356000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF7903000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6332000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF790B000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF769B000 \SystemRoot\system32\DRIVERS\fetnd5b.sys
0xF7913000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF76AB000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7A9B000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF631E000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76BB000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF791B000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF76CB000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF76DB000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76EB000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF62FB000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7CA6000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7B07000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF7923000 \SystemRoot\System32\Drivers\Modem.SYS
0xF76FB000 \SystemRoot\system32\DRIVERS\HssDrv.sys
0xF770B000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7AA3000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF62E4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF771B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF772B000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF792B000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF62D3000 \SystemRoot\system32\DRIVERS\psched.sys
0xF773B000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7933000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF793B000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7943000 \SystemRoot\system32\DRIVERS\taphss.sys
0xF6292000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF774B000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF794B000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7B0D000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF620C000 \SystemRoot\system32\DRIVERS\update.sys
0xF7AC3000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF776B000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF3DD5000 \SystemRoot\system32\drivers\cmudax.sys
0xF3DB4000 \SystemRoot\system32\drivers\portcls.sys
0xF6B28000 \SystemRoot\system32\drivers\drmk.sys
0xF6B18000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B21000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7B23000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C3B000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B25000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7973000 \SystemRoot\System32\drivers\vga.sys
0xF7B27000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B29000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF797B000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7983000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7A77000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF3D81000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF3D28000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF3D00000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF3CDE000 \SystemRoot\System32\drivers\afd.sys
0xF6AF8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF798B000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xF3CB3000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF3C1B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF6AE8000 \SystemRoot\System32\Drivers\Fips.SYS
0xF3BF5000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF6AD8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF3B2E000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF79A3000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF7B2F000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xF628A000 \SystemRoot\System32\Drivers\ASPI32.SYS
0xF6286000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF6AB8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF79B3000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF627E000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF2D98000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF2D87000 \SystemRoot\System32\Drivers\Udfs.SYS
0xF2D6F000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B69000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF3C8F000 \SystemRoot\System32\drivers\Dxapi.sys
0xF78CB000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7BA6000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF593000 \SystemRoot\System32\ATMFD.DLL
0xBA771000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xBA7A8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xBA3D4000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA3BF000 \SystemRoot\system32\drivers\wdmaud.sys
0xBA509000 \SystemRoot\system32\drivers\sysaudio.sys
0xF79CB000 \SystemRoot\System32\drivers\BrPar.sys
0xF7B05000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB9E39000 \SystemRoot\system32\DRIVERS\srv.sys
0xB960F000 \??\C:\DOKUME~1\Kekse\LOKALE~1\Temp\pxtdapog.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 36):
0 System Idle Process
4 System
1152 C:\WINDOWS\system32\smss.exe
1200 csrss.exe
1224 C:\WINDOWS\system32\winlogon.exe
1268 C:\WINDOWS\system32\services.exe
1280 C:\WINDOWS\system32\lsass.exe
1452 C:\WINDOWS\system32\svchost.exe
1548 svchost.exe
1744 C:\WINDOWS\system32\svchost.exe
1828 svchost.exe
244 svchost.exe
408 C:\WINDOWS\system32\BRSVC01A.EXE
424 C:\WINDOWS\system32\BRSS01A.EXE
432 C:\WINDOWS\system32\spoolsv.exe
592 C:\WINDOWS\explorer.exe
788 C:\Programme\Avira\AntiVir Desktop\sched.exe
1620 svchost.exe
1772 C:\WINDOWS\ehome\ehtray.exe
1856 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
132 C:\Programme\Avira\AntiVir Desktop\avguard.exe
200 C:\WINDOWS\ehome\ehRecvr.exe
212 C:\WINDOWS\ehome\ehSched.exe
260 C:\Programme\Hotspot Shield\bin\openvpnas.exe
728 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
844 C:\Programme\Hotspot Shield\HssWPR\hsssrv.exe
876 C:\Programme\Hotspot Shield\bin\hsswd.exe
944 C:\Programme\Java\jre6\bin\jqs.exe
984 C:\WINDOWS\system32\nvsvc32.exe
620 C:\WINDOWS\system32\svchost.exe
2688 C:\WINDOWS\system32\dllhost.exe
2792 C:\WINDOWS\ehome\ehmsas.exe
3084 alg.exe
196 C:\WINDOWS\system32\wuauclt.exe
2916 C:\WINDOWS\system32\wscntfy.exe
1860 C:\Dokumente und Einstellungen\Kekse\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000011`e2187200 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000022`d1ff8a00 (FAT32)

PhysicalDrive0 Model Number: ST3160812AS, Rev: 3.AAE

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11

Done!

:) *gespanntguck* :)