Trojaner-Board - TR/Crypt.XPack.Gen3 ist nicht von meinem Rechner zu kriegen!!!

hallo arne,

so, hab jetzt alles gemacht.
folgende meldung nach durchführung ccleaner:

Veralteter Software-Schlüssel:
Der Software-Schlüssel: Software\SightSpeed Inc ist leer und kann entfernt werden. Diese Verweise bleiben oft nach Deinstallationen übrig.

Lösung: Registrierungs-Schlüssel löschen.

nach ausführung von combofix ging erst einmal mein internet nicht mehr, konnte auch keine emails mehr empfangen. hab dann den rechner runtergefahren und wieder gestartet, danach war wieder alles ok...ist das normal?
hier die logfile:

Combofix Logfile:

Code:

ComboFix 10-11-30.01 - industriemädchen 30.11.2010  21:19:52.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3581.2320 [GMT 1:00]

ausgeführt von:: c:\users\industriemädchen\Desktop\cofi.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\windows\jestertb.dll

c:\windows\system32\spool\prtprocs\w32x86\CNMPP61.DLL
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-10-28 bis 2010-11-30  ))))))))))))))))))))))))))))))

.
 

2010-11-30 20:27 . 2010-11-30 20:27        --------        d-----w-        c:\users\Default\AppData\Local\temp

2010-11-30 19:19 . 2010-11-30 19:19        --------        d-----w-        c:\program files\CCleaner

2010-11-27 10:39 . 2010-11-27 10:39        --------        d--h--w-        c:\windows\PIF

2010-11-26 16:36 . 2010-11-26 16:36        --------        d-----w-        c:\users\industriemädchen\My Documents

2010-11-23 09:39 . 2010-11-10 04:33        6273872        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E7461C64-3E94-4098-92D5-1ED8DA5A8A62}\mpengine.dll

2010-11-23 09:38 . 2010-08-26 16:34        1696256        ----a-w-        c:\windows\system32\gameux.dll

2010-11-23 09:38 . 2010-08-26 16:33        28672        ----a-w-        c:\windows\system32\Apphlpdm.dll

2010-11-23 09:38 . 2010-08-26 14:23        4240384        ----a-w-        c:\windows\system32\GameUXLegacyGDFs.dll

2010-11-23 09:38 . 2010-10-07 11:37        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2010-11-19 18:06 . 2005-04-15 19:58        1071088        ----a-w-        c:\windows\system32\MSCOMCTL.OCX

2010-11-19 18:06 . 2001-10-28 16:42        116224        ----a-w-        c:\windows\system32\pdfcmnnt.dll

2010-11-19 18:06 . 1998-06-24 00:00        137000        ----a-w-        c:\windows\system32\MSMAPI32.OCX

2010-11-19 18:06 . 1998-07-06 17:55        158208        ----a-w-        c:\windows\system32\MSCMCDE.DLL

2010-11-19 18:06 . 2010-11-19 18:09        --------        d-----w-        c:\program files\PDFCreator

2010-11-19 18:06 . 1998-07-06 17:55        64512        ----a-w-        c:\windows\system32\MSCC2DE.DLL

2010-11-19 18:06 . 1998-07-06 00:00        23552        ----a-w-        c:\windows\system32\MSMPIDE.DLL

2010-11-08 11:41 . 2010-11-08 11:41        --------        d-----w-        c:\users\industriemädchen\AppData\Roaming\Avira

2010-11-08 11:36 . 2010-11-22 10:49        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2010-11-08 11:36 . 2010-11-08 11:33        126856        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-11-08 11:36 . 2010-11-08 11:36        --------        d-----w-        c:\programdata\Avira

2010-11-08 11:36 . 2010-11-08 11:36        --------        d-----w-        c:\program files\Avira

2010-11-07 12:52 . 2010-11-26 17:48        --------        d-----w-        c:\programdata\BMWiSoftware
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-19 09:41 . 2009-10-04 10:46        222080        ------w-        c:\windows\system32\MpSigStub.exe

2010-09-15 02:50 . 2010-06-05 17:40        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2010-09-13 13:56 . 2010-10-26 17:17        8147456        ----a-w-        c:\windows\system32\wmploc.DLL

2010-09-08 09:17 . 2010-09-08 09:17        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx

2010-09-08 09:17 . 2010-09-08 09:17        69632        ----a-w-        c:\windows\system32\QuickTime.qts

2010-09-08 06:01 . 2010-10-24 18:50        916480        ----a-w-        c:\windows\system32\wininet.dll

2010-09-08 05:57 . 2010-10-24 18:50        43520        ----a-w-        c:\windows\system32\licmgr10.dll

2010-09-08 05:57 . 2010-10-24 18:50        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl

2010-09-08 05:56 . 2010-10-24 18:50        71680        ----a-w-        c:\windows\system32\iesetup.dll

2010-09-08 05:56 . 2010-10-24 18:50        109056        ----a-w-        c:\windows\system32\iesysprep.dll

2010-09-08 05:04 . 2010-10-24 18:50        385024        ----a-w-        c:\windows\system32\html.iec

2010-09-08 04:26 . 2010-10-24 18:50        133632        ----a-w-        c:\windows\system32\ieUnatt.exe

2010-09-08 04:25 . 2010-10-24 18:50        1638912        ----a-w-        c:\windows\system32\mshtml.tlb

2010-09-06 16:20 . 2010-10-26 17:14        125952        ----a-w-        c:\windows\system32\srvsvc.dll

2010-09-06 16:19 . 2010-10-26 17:14        17920        ----a-w-        c:\windows\system32\netevent.dll

2010-09-06 13:45 . 2010-10-26 17:14        304128        ----a-w-        c:\windows\system32\drivers\srv.sys

2010-09-06 13:45 . 2010-10-26 17:14        145408        ----a-w-        c:\windows\system32\drivers\srv2.sys

2010-09-06 13:45 . 2010-10-26 17:14        102400        ----a-w-        c:\windows\system32\drivers\srvnet.sys

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-06-30 196608]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-11-17 3810304]

"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-10 67488]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]

"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-02-19 438403]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2008-01-14 132392]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-08 281768]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]
 

c:\users\industriem„dchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-6-5 752168]

QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-3-17 1207376]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]

2008-09-08 13:10        10536        ----a-w-        c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001
 

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-02 136176]

R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2006-04-05 264704]

R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [2009-04-09 7680]

R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2008-01-21 987648]

R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2008-01-21 251904]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2009-04-09 110592]

R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2009-04-09 105344]

S2 {2E444BE9-B8EC-4CE6-8C2B-6536FB7F4FB7};{2E444BE9-B8EC-4CE6-8C2B-6536FB7F4FB7};c:\program files\Dell\MediaDirect\000.fcl [2008-01-24 61424]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [2009-03-16 81920]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2008-01-21 21504]

S2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [2010-11-08 339624]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-08 135336]

S2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2010-11-08 403624]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]

S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-04-20 9216]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-01-29 29736]

S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-12-18 54784]

S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2008-03-11 203264]

S3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\DRIVERS\OA001Ufd.sys [2009-03-06 133632]

S3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\DRIVERS\OA001Vid.sys [2009-03-08 280096]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

Akamai        REG_MULTI_SZ           Akamai

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners
 

2010-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-02 07:48]
 

2010-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-02 07:48]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=2080908

IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll

TCP: {6F68BABF-760A-495E-B2A1-B8E99A6A7747} = 213.191.92.86 62.109.123.7

Handler: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\program files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax

Handler: fluxhttp\0x00000007 - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\program files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax

DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} - hxxps://account.maxdome.de/presentation/script/HWTest.CAB

FF - ProfilePath - c:\users\industriemädchen\AppData\Roaming\Mozilla\Firefox\Profiles\lxklr7u1.default\

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAPIX.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPFluxBrowserHelper.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMPDRM.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPWMDRMWrapper.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Extension: Skype extension for Firefox: {B13721C7-F507-4982-B2E5-502A71474FED} - c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\users\industriemädchen\AppData\Roaming\Mozilla\Firefox\Profiles\lxklr7u1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

.

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

HKLM-Run-NWEReboot - (no file)

HKLM-Run-MobileConnect - %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe

HKLM-Run-SysTrayApp - %ProgramFiles%\IDT\WDM\sttray.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-11-30 21:27

Windows 6.0.6002 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

c:\program files\Avira\AntiVir Desktop\checkt.exe [5328] 0x87278D90
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{2E444BE9-B8EC-4CE6-8C2B-6536FB7F4FB7}]

"ImagePath"="\??\c:\program files\Dell\MediaDirect\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2010-11-30  21:30:34

ComboFix-quarantined-files.txt  2010-11-30 20:30
 

Vor Suchlauf: 10 Verzeichnis(se), 108.960.886.784 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 108.139.892.736 Bytes frei
 

- - End Of File - - 4DC9DB47E0299DF655EBE34B96F43330

--- --- ---

lg,
ines

also, GMER ist zweifach abgestürzt...
hier das log von OSAM:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 23:32:56 on 30.11.2010
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.12
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"BCMWLCPL.CPL" - "Dell Inc." - C:\Windows\system32\BCMWLCPL.CPL

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

"plotman.cpl" - "Autodesk, Inc." - C:\Windows\system32\plotman.cpl

"styleman.cpl" - "Autodesk, Inc." - C:\Windows\system32\styleman.cpl

"vp6dec_settings.cpl" - ? - C:\Windows\system32\vp6dec_settings.cpl  (File found, but it contains no detailed information)

"vp7dec_settings.cpl" - ? - C:\Windows\system32\vp7dec_settings.cpl  (File found, but it contains no detailed information)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"bcmwlcpl.cpl" - "Dell Inc." - C:\Windows\System32\bcmwlcpl.cpl

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"BCM42RLY" (BCM42RLY) - "Broadcom Corporation" - C:\Windows\System32\drivers\BCM42RLY.sys

"catchme" (catchme) - ? - C:\Users\INDUST~1\AppData\Local\Temp\catchme.sys  (File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"{2E444BE9-B8EC-4CE6-8C2B-6536FB7F4FB7}" ({2E444BE9-B8EC-4CE6-8C2B-6536FB7F4FB7}) - "Cyberlink Corp." - C:\Program Files\Dell\MediaDirect\000.fcl
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{8E2D00A0-82C6-4821-90BC-07F290841BB6} "XEB Navigation Filter" - ? - C:\Program Files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{C9CF278C-460E-4917-BC43-3F75E6E47D3D} "fluxDVD Shell Information Extractor" - "ACE GmbH" - C:\PROGRA~1\COMMON~1\fluxDVD\Lib\XEB\XEBShell.dll

{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{5574006C-28F5-4a65-A28C-74DE6BFBE0BB} "Haali Matroska Shell Property Page" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{327669A0-59A7-4be9-B99E-1C9F3A57611A} "Haali Matroska Thumbnail Extractor" - ? - C:\Windows\system32\mmfinfo.dll  (File found, but it contains no detailed information)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{5A7B2149-7840-4531-B7B4-58F0F1CB0A6E} "IMAPIShlXt Class" - "Dell Inc" - C:\Windows\IMAPIShellExt.dll

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{162247AF-26A7-44FC-A93A-69506EA244F3} "HWTest.HWTestControl" - ? - C:\Windows\Downloaded Program Files\HWTEST.OCX / https://account.maxdome.de/presentation/script/HWTest.CAB

{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{CA6319C0-31B7-401E-A518-A07C3DB8F777} "CBrowserHelperObject Object" - "Dell Inc." - C:\Program Files\Dell\BAE\BAE.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Dell Dock.lnk" - "Stardock Corporation" - C:\Program Files\Dell\DellDock\DellDock.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Users\industriemädchen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"QuickSet.lnk" - "Dell Inc." - C:\Program Files\Dell\QuickSet\quickset.exe  (Shortcut exists | File exists)

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Photo Downloader" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"Broadcom Wireless Manager UI" - "Dell Inc." - C:\Windows\system32\WLTRAY.exe

"Dell Webcam Central" - "Creative Technology Ltd." - "C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" /mode2

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"dscactivate" - " " - "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

"ECenter" - " " - C:\Dell\E-Center\EULALauncher.exe

"IAAnotif" - "Intel Corporation" - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"LanguageShortcut" - ? - "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

"PCMService" - "CyberLink Corp." - "C:\Program Files\Dell\MediaDirect\PCMService.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"Dell Wireless WLAN Card Logon Provider" - "Dell Inc." - C:\Windows\System32\BCMLogon.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Canon BJ Language Monitor PIXMA iP3000" - "CANON INC." - C:\Windows\system32\CNMLM61.DLL

"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)

"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_4176eef.dll  (File found, but it contains no detailed information)

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir MailGuard" (AntiVirMailService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"Dell Wireless WLAN Tray Service" (wltrysvc) - ? - C:\Windows\System32\WLTRYSVC.EXE  (File found, but it contains no detailed information)

"Dock Login Service" (DockLoginService) - "Stardock Corporation" - C:\Program Files\Dell\DellDock\DockLogin.exe

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoToAssist" (GoToAssist) - "Citrix Online, a division of Citrix Systems, Inc." - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe

"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Vodafone Mobile Connect Service" (VMCService) - "Vodafone" - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
 

[Winlogon]

-----( HKCU\Control Panel\Desktop )-----

"SCRNSAVE.EXE" - "MacSourcery" - C:\Windows\SCREEN~1.SCR

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"GoToAssist" - "Citrix Online, a division of Citrix Systems, Inc." - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

und hier von MBRCheck:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Studio 1535
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 152):
0x82C14000 \SystemRoot\system32\ntkrnlpa.exe
0x82FCD000 \SystemRoot\system32\hal.dll
0x80403000 \SystemRoot\system32\kdcom.dll
0x8040A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8047A000 \SystemRoot\system32\PSHED.dll
0x8048B000 \SystemRoot\system32\BOOTVID.dll
0x80493000 \SystemRoot\system32\CLFS.SYS
0x804D4000 \SystemRoot\system32\CI.dll
0x80609000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80685000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80692000 \SystemRoot\system32\drivers\acpi.sys
0x806D8000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806E1000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E9000 \SystemRoot\system32\drivers\pci.sys
0x80710000 \SystemRoot\System32\drivers\partmgr.sys
0x8071F000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80722000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8072C000 \SystemRoot\system32\drivers\volmgr.sys
0x8073B000 \SystemRoot\System32\drivers\volmgrx.sys
0x80785000 \SystemRoot\System32\drivers\mountmgr.sys
0x83202000 \SystemRoot\system32\drivers\iastor.sys
0x832C9000 \SystemRoot\system32\drivers\fltmgr.sys
0x832FB000 \SystemRoot\system32\drivers\fileinfo.sys
0x8330B000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x83315000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8C209000 \SystemRoot\system32\drivers\ndis.sys
0x8C314000 \SystemRoot\system32\drivers\msrpc.sys
0x8C33F000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C406000 \SystemRoot\System32\drivers\tcpip.sys
0x8C4F0000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C609000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8C719000 \SystemRoot\system32\drivers\volsnap.sys
0x8C752000 \SystemRoot\System32\Drivers\spldr.sys
0x8C75A000 \SystemRoot\System32\Drivers\mup.sys
0x8C769000 \SystemRoot\System32\drivers\ecache.sys
0x8C790000 \SystemRoot\system32\drivers\disk.sys
0x8C7A1000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x8C7C2000 \SystemRoot\system32\drivers\crcdisk.sys
0x8C7D8000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8C7E3000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x90C0B000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x910DA000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x9117B000 \SystemRoot\System32\drivers\watchdog.sys
0x9080B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x90898000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x908A3000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x908E1000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x91208000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x91350000 \SystemRoot\system32\DRIVERS\k57nd60x.sys
0x91385000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x91395000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x913A3000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x913BD000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x913CE000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x908F0000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x913E2000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x90942000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x913F5000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x9096F000 \SystemRoot\system32\DRIVERS\itecir.sys
0x909C7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x909D2000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x91200000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x909EA000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x909EE000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x91187000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x91196000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C37A000 \SystemRoot\system32\DRIVERS\storport.sys
0x90800000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x911C5000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x911DC000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8C5D2000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x911E7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8C7EC000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8C3BB000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8C3D0000 \SystemRoot\system32\DRIVERS\termdd.sys
0x91206000 \SystemRoot\system32\DRIVERS\swenum.sys
0x83386000 \SystemRoot\system32\DRIVERS\ks.sys
0x8C3E0000 \SystemRoot\system32\DRIVERS\circlass.sys
0x911F6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C3EE000 \SystemRoot\system32\DRIVERS\umbus.sys
0x833B0000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x833E5000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x80795000 \SystemRoot\system32\drivers\HdAudio.sys
0x805B4000 \SystemRoot\system32\drivers\portcls.sys
0x807D4000 \SystemRoot\system32\drivers\drmk.sys
0x91A01000 \SystemRoot\system32\DRIVERS\stwrt.sys
0x91A66000 \SystemRoot\system32\DRIVERS\hidir.sys
0x91A71000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x91A81000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x91A88000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x91A91000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x91A99000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x91AA2000 \SystemRoot\System32\Drivers\Null.SYS
0x91AA9000 \SystemRoot\System32\Drivers\Beep.SYS
0x91AB0000 \SystemRoot\System32\drivers\vga.sys
0x91ABC000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x91ADD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x91AE5000 \SystemRoot\system32\drivers\rdpencdd.sys
0x91AED000 \SystemRoot\System32\Drivers\Msfs.SYS
0x91AF8000 \SystemRoot\System32\Drivers\Npfs.SYS
0x91B06000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x91B0F000 \SystemRoot\system32\DRIVERS\tdx.sys
0x91B25000 \SystemRoot\system32\DRIVERS\smb.sys
0x91B39000 \SystemRoot\system32\drivers\afd.sys
0x91B81000 \SystemRoot\System32\DRIVERS\netbt.sys
0x91BB3000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x91BBC000 \SystemRoot\system32\DRIVERS\pacer.sys
0x91BD2000 \SystemRoot\system32\DRIVERS\netbios.sys
0x91BE0000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x91BF3000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x91C0C000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x91C48000 \SystemRoot\system32\drivers\nsiproxy.sys
0x91C52000 \SystemRoot\System32\Drivers\dfsc.sys
0x91C69000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x91C8C000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x91C96000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x91C98000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x91CAF000 \SystemRoot\system32\DRIVERS\OA001Vid.sys
0x91CF4000 \SystemRoot\system32\DRIVERS\OA001Ufd.sys
0x91D15000 \SystemRoot\System32\Drivers\crashdmp.sys
0x91D22000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x984E0000 \SystemRoot\System32\win32k.sys
0x91DE9000 \SystemRoot\System32\drivers\Dxapi.sys
0x8C50B000 \SystemRoot\system32\DRIVERS\monitor.sys
0x98700000 \SystemRoot\System32\TSDDD.dll
0x98720000 \SystemRoot\System32\cdd.dll
0x98730000 \SystemRoot\System32\ATMFD.DLL
0x8C51A000 \SystemRoot\system32\drivers\luafv.sys
0x8C535000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9CA06000 \SystemRoot\system32\drivers\spsys.sys
0x9CAB6000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9CAC6000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9CAF0000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x9CAFA000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9CB0D000 \SystemRoot\system32\drivers\HTTP.sys
0x9CB7A000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9CB97000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9CBB0000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9CBC5000 \SystemRoot\system32\drivers\mrxdav.sys
0x8C54A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x8C569000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9CBE6000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x8C5A2000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9FE00000 \SystemRoot\System32\DRIVERS\srv.sys
0x9FE66000 \SystemRoot\system32\drivers\peauth.sys
0x9FF44000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9FF4E000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9FF5A000 \??\C:\Program Files\Dell\MediaDirect\000.fcl
0x9FF7B000 \SystemRoot\System32\Drivers\fastfat.SYS
0x9FFA3000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x9FFB9000 \SystemRoot\system32\drivers\BCM42RLY.sys
0x770C0000 \Windows\System32\ntdll.dll

Processes (total 76):
0 System Idle Process
4 System
512 C:\Windows\System32\smss.exe
580 csrss.exe
640 C:\Windows\System32\wininit.exe
652 csrss.exe
684 C:\Windows\System32\services.exe
744 C:\Windows\System32\winlogon.exe
764 C:\Windows\System32\lsass.exe
772 C:\Windows\System32\lsm.exe
912 C:\Windows\System32\svchost.exe
992 C:\Windows\System32\svchost.exe
1048 C:\Windows\System32\svchost.exe
1128 C:\Windows\System32\Ati2evxx.exe
1144 C:\Windows\System32\svchost.exe
1168 C:\Windows\System32\svchost.exe
1180 C:\Windows\System32\svchost.exe
1200 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\stacsv.exe
1356 C:\Windows\System32\audiodg.exe
1392 C:\Windows\System32\svchost.exe
1408 C:\Windows\System32\SLsvc.exe
1432 C:\Windows\System32\svchost.exe
1508 C:\Program Files\Dell\DellDock\DockLogin.exe
1572 C:\Windows\System32\svchost.exe
1756 C:\Windows\System32\Ati2evxx.exe
1804 C:\Windows\System32\WLTRYSVC.EXE
1816 C:\Windows\System32\BCMWLTRY.EXE
1920 C:\Windows\System32\spoolsv.exe
1968 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1980 C:\Windows\System32\svchost.exe
2076 C:\Windows\System32\dwm.exe
2096 C:\Windows\System32\taskeng.exe
2120 C:\Windows\explorer.exe
2204 C:\Program Files\Dell\DellDock\DellDock.exe
2328 C:\Windows\System32\taskeng.exe
2460 C:\Windows\System32\conime.exe
2832 C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
2872 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\AEstSrv.exe
2884 C:\Windows\System32\svchost.exe
2916 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
2932 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2944 C:\Windows\System32\svchost.exe
2968 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
2984 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
3056 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
3180 C:\Windows\System32\svchost.exe
3232 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
3280 C:\Windows\System32\svchost.exe
3352 C:\Windows\System32\svchost.exe
3476 C:\Windows\System32\SearchIndexer.exe
3536 C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
3772 WmiPrvSE.exe
3896 C:\Program Files\DellTPad\Apoint.exe
3916 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
3924 C:\Windows\System32\WLTRAY.EXE
3936 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
720 C:\Program Files\Dell\MediaDirect\PCMService.exe
2336 C:\Program Files\DellTPad\ApMsgFwd.exe
2584 C:\Program Files\DellTPad\ApntEx.exe
1472 C:\Program Files\DellTPad\hidfind.exe
3704 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3272 C:\Program Files\iTunes\iTunesHelper.exe
3752 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3744 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
3852 C:\Windows\ehome\ehtray.exe
4088 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
3612 C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
3392 C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
2476 C:\Windows\ehome\ehmsas.exe
5768 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
6060 C:\Program Files\iPod\bin\iPodService.exe
4932 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
5076 C:\Windows\System32\wuauclt.exe
4556 C:\Windows\System32\SearchProtocolHost.exe
1084 C:\Windows\System32\SearchFilterHost.exe
2112 C:\Users\industriemädchen\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`88e00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`08e00000 (NTFS)

PhysicalDrive0 Model Number: WDCWD3200BEVT-75ZCT1, Rev: 11.01A11

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows Vista MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!