Trojaner-Board - Browser Hijack

so, weiter gehts:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 19:14:48 on 10.03.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\Windows\system32\ISUSPM.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ASPI32" (ASPI32) - "Adaptec" - C:\Windows\system32\drivers\ASPI32.sys

"AVerMedia M779 Audio/Video Capture Driver" (AVMNgCapM779) - "AVerMedia TECHNOLOGIES, Inc." - C:\Windows\System32\DRIVERS\AVerCap.sys

"AVerMedia M779 Base Driver" (AVMNgBasM779) - "AVerMedia TECHNOLOGIES, Inc." - C:\Windows\System32\DRIVERS\AVerBas.sys

"AVerMedia M779 TVTuner Driver" (AVMNgTunM779) - "AVerMedia TECHNOLOGIES, Inc." - C:\Windows\System32\DRIVERS\AVerTun.sys

"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\confi\catchme.sys  (File not found)

"DSproct" (DSproct) - "Gteko Ltd." - C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys

"dsunidrv" (dsunidrv) - "Gteko Ltd." - C:\Program Files\DellSupport\Drivers\dsunidrv.sys

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys  (File not found)

"PDNMp50 NDIS Protocol Driver" (PDNMp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\system32\drivers\PDNMp50.sys

"PDNSp50 NDIS Protocol Driver" (PDNSp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\system32\drivers\PDNSp50.sys

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys

"Sony Ericsson Device 046 Driver driver (WDM)" (SE2Ebus) - "MCCI" - C:\Windows\System32\DRIVERS\SE2Ebus.sys

"Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (NDIS)" (se2End5) - "MCCI" - C:\Windows\System32\DRIVERS\se2End5.sys

"Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (WDM)" (se2Eunic) - "MCCI" - C:\Windows\System32\DRIVERS\se2Eunic.sys

"Sony Ericsson Device 046 USB WMC Device Management Drivers (WDM)" (SE2Emgmt) - "MCCI" - C:\Windows\System32\DRIVERS\SE2Emgmt.sys

"Sony Ericsson Device 046 USB WMC Modem Driver" (SE2Emdm) - "MCCI" - C:\Windows\System32\DRIVERS\SE2Emdm.sys

"Sony Ericsson Device 046 USB WMC Modem Filter" (SE2Emdfl) - "MCCI" - C:\Windows\System32\DRIVERS\SE2Emdfl.sys

"Sony Ericsson Device 046 USB WMC OBEX Interface" (SE2Eobex) - "MCCI" - C:\Windows\System32\DRIVERS\SE2Eobex.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{73B24247-042E-4EF5-ADC2-42F62E6FD654} "MCLiteShellExt Class" - ? - C:\Program Files\ICQLite\ICQLiteShell.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{738D66C6-0149-4D40-84E4-A7BB2D0CE949} "Sony Ericsson Datei-Manager" - ? -   (File not found | COM-object registry key not found)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{855F3B16-6D32-4FE6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} "EPUImageControl Class" - "eBay, Inc." - C:\Windows\Downloaded Program Files\EPUWALcontrol.dll / hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab

{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.6.0" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{48DD0448-9209-4F81-9F6D-D83562940134} "MySpace Uploader Control" - "MySpace, Inc." - C:\Windows\Downloaded Program Files\MySpaceUploader.ocx / hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ Lite" - "ICQ Ltd." - C:\Program Files\ICQLite\ICQLite.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{CA6319C0-31B7-401E-A518-A07C3DB8F777} "CBrowserHelperObject Object" - "Dell Inc." - C:\Program Files\BAE\BAE.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Thomas Nolden\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"ATICCC" - ? - "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"  (File found, but it contains no detailed information)

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

"HTC Sync Loader" - ? - "C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup

"ISUSPM Startup" - "Macrovision Corporation" - C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

"ISUSScheduler" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"RoxWatchTray" - "Sonic Solutions" - "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

"SigmatelSysTrayApp" - "SigmaTel, Inc." - sttray.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple, Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"DSBrokerService" (DSBrokerService) - ? - C:\Program Files\DellSupport\brkrsvc.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleDesktopManager" (GoogleDesktopManager) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

"Internet Pass-Through Service" (PassThru Service) - ? - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Roxio Hard Drive Watcher 9" (RoxWatch9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

"RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

"stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Logical Drives Mask: 0x000007fc

Kernel Drivers (total 136):
0x8224E000 \SystemRoot\system32\ntkrnlpa.exe
0x8221B000 \SystemRoot\system32\hal.dll
0x8040C000 \SystemRoot\system32\kdcom.dll
0x80413000 \SystemRoot\system32\PSHED.dll
0x80424000 \SystemRoot\system32\BOOTVID.dll
0x8042C000 \SystemRoot\system32\CLFS.SYS
0x8046D000 \SystemRoot\system32\CI.dll
0x8054D000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C9000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80604000 \SystemRoot\system32\drivers\acpi.sys
0x8064A000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80653000 \SystemRoot\system32\drivers\msisadrv.sys
0x8065B000 \SystemRoot\system32\drivers\pci.sys
0x80682000 \SystemRoot\System32\drivers\partmgr.sys
0x80691000 \SystemRoot\system32\drivers\volmgr.sys
0x806A0000 \SystemRoot\System32\drivers\volmgrx.sys
0x806EA000 \SystemRoot\System32\drivers\mountmgr.sys
0x806FA000 \SystemRoot\system32\drivers\nvstor.sys
0x80707000 \SystemRoot\system32\drivers\storport.sys
0x80748000 \SystemRoot\system32\drivers\fltmgr.sys
0x8077A000 \SystemRoot\system32\drivers\fileinfo.sys
0x8078A000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x82C0E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82C7F000 \SystemRoot\system32\drivers\ndis.sys
0x82D8A000 \SystemRoot\system32\drivers\msrpc.sys
0x82DB5000 \SystemRoot\system32\drivers\NETIO.SYS
0x82E0E000 \SystemRoot\System32\drivers\tcpip.sys
0x82EF8000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8800E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8811E000 \SystemRoot\system32\drivers\volsnap.sys
0x88157000 \SystemRoot\System32\Drivers\spldr.sys
0x8815F000 \SystemRoot\System32\Drivers\mup.sys
0x8816E000 \SystemRoot\System32\drivers\ecache.sys
0x88195000 \SystemRoot\system32\drivers\disk.sys
0x881A6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x881C7000 \SystemRoot\system32\drivers\crcdisk.sys
0x881F4000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x88000000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x82F13000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x82F23000 \SystemRoot\system32\DRIVERS\AVerBas.sys
0x8BE08000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8C28A000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C32A000 \SystemRoot\System32\drivers\watchdog.sys
0x8C336000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8C340000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8C37E000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C38D000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x82F2F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8C3A5000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C3D4000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C3DF000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x82FBC000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x82FC7000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x82FEA000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x80793000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x807A7000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x82DF0000 \SystemRoot\system32\DRIVERS\termdd.sys
0x82E00000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x82C00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8C3F6000 \SystemRoot\system32\DRIVERS\swenum.sys
0x807BC000 \SystemRoot\system32\DRIVERS\ks.sys
0x807E6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x807F0000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8C809000 \SystemRoot\system32\DRIVERS\AVerCap.sys
0x8C83F000 \SystemRoot\system32\DRIVERS\AVerTun.sys
0x8C863000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
0x8C866000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8C89B000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8C8AC000 \SystemRoot\system32\drivers\stwrt.sys
0x8C94F000 \SystemRoot\system32\drivers\portcls.sys
0x8C97C000 \SystemRoot\system32\drivers\drmk.sys
0x8C9A1000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8C9AA000 \SystemRoot\System32\Drivers\Null.SYS
0x8C9B1000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C9C1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8C9C8000 \SystemRoot\System32\drivers\vga.sys
0x8C9D4000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C9F5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C800000 \SystemRoot\system32\drivers\rdpencdd.sys
0x805D6000 \SystemRoot\System32\Drivers\Msfs.SYS
0x805E1000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C9B8000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8CC05000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8CC1B000 \SystemRoot\system32\DRIVERS\smb.sys
0x8CC2F000 \SystemRoot\system32\drivers\afd.sys
0x8CC77000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8CCA9000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8CCBF000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8CCCD000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8CCE0000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8CD1C000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8CD26000 \SystemRoot\System32\Drivers\dfsc.sys
0x8CD3D000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8CD63000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8CD65000 \SystemRoot\System32\Drivers\ASPI32.SYS
0x8CD69000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x8CD7E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CD80000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8CD97000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8CDA0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8CDB0000 \SystemRoot\system32\drivers\usbaudio.sys
0x8CDC2000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8CDCB000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8CDD8000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x8CDE2000 \SystemRoot\System32\Drivers\dump_nvstor.sys
0x8CDEF000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x95860000 \SystemRoot\System32\win32k.sys
0x881D0000 \SystemRoot\System32\drivers\Dxapi.sys
0x881DA000 \SystemRoot\system32\DRIVERS\monitor.sys
0x95A80000 \SystemRoot\System32\TSDDD.dll
0x95AA0000 \SystemRoot\System32\cdd.dll
0x9760A000 \SystemRoot\system32\drivers\luafv.sys
0x97625000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x97642000 \SystemRoot\system32\drivers\spsys.sys
0x976F2000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x97702000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x97715000 \SystemRoot\system32\drivers\HTTP.sys
0x97782000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9779F000 \SystemRoot\system32\DRIVERS\bowser.sys
0x977B8000 \SystemRoot\System32\drivers\mpsdrv.sys
0x977CD000 \SystemRoot\system32\drivers\mrxdav.sys
0x99E08000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x99E27000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x99E60000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x99E78000 \SystemRoot\System32\DRIVERS\srv2.sys
0x99EA0000 \SystemRoot\System32\DRIVERS\srv.sys
0x99EEE000 \??\C:\Program Files\DellSupport\Drivers\dsunidrv.sys
0x99EF0000 \SystemRoot\system32\drivers\peauth.sys
0x99FCE000 \SystemRoot\System32\Drivers\secdrv.SYS
0x99FD8000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9B80C000 \SystemRoot\System32\Drivers\fastfat.SYS
0x9B834000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x9B849000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x9B85B000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x9B871000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys
0x77540000 \Windows\System32\ntdll.dll

Processes (total 74):
0 System Idle Process
4 System
388 C:\Windows\System32\smss.exe
512 csrss.exe
576 C:\Windows\System32\wininit.exe
588 csrss.exe
620 C:\Windows\System32\services.exe
632 C:\Windows\System32\lsass.exe
640 C:\Windows\System32\lsm.exe
704 C:\Windows\System32\winlogon.exe
840 C:\Windows\System32\svchost.exe
920 C:\Windows\System32\svchost.exe
960 C:\Windows\System32\svchost.exe
1020 C:\Windows\System32\Ati2evxx.exe
1068 C:\Windows\System32\svchost.exe
1112 C:\Windows\System32\svchost.exe
1128 C:\Windows\System32\svchost.exe
1236 C:\Windows\System32\audiodg.exe
1292 C:\Windows\System32\svchost.exe
1308 C:\Windows\System32\SLsvc.exe
1344 C:\Windows\System32\svchost.exe
1476 C:\Windows\System32\svchost.exe
1620 C:\Windows\System32\spoolsv.exe
1644 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1668 C:\Windows\System32\svchost.exe
1856 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1896 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
1968 C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
2028 C:\Windows\System32\svchost.exe
124 C:\Windows\System32\Ati2evxx.exe
268 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
476 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
1328 C:\Windows\System32\svchost.exe
1652 C:\Windows\System32\svchost.exe
1484 C:\Windows\System32\SearchIndexer.exe
2312 WUDFHost.exe
2676 C:\Windows\System32\dwm.exe
2700 C:\Windows\System32\taskeng.exe
2740 C:\Windows\explorer.exe
2784 C:\Windows\System32\taskeng.exe
3096 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
3344 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
3372 C:\Windows\System32\mobsync.exe
3448 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
3728 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
3796 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3812 C:\Windows\sttray.exe
3852 C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
3860 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3868 C:\Program Files\Windows Sidebar\sidebar.exe
3940 C:\Windows\ehome\ehtray.exe
3948 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
3964 C:\Program Files\Windows Media Player\wmpnscfg.exe
4064 C:\Program Files\Windows Media Player\wmpnetwk.exe
2768 C:\Windows\System32\wbem\unsecapp.exe
792 C:\Windows\ehome\ehmsas.exe
2712 WmiPrvSE.exe
3296 C:\Program Files\Windows Sidebar\sidebar.exe
1320 C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
3516 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
3316 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
172 C:\Windows\System32\svchost.exe
3280 C:\Windows\System32\svchost.exe
5720 C:\Program Files\Internet Explorer\iexplore.exe
5752 C:\Program Files\Internet Explorer\iexplore.exe
5980 C:\Windows\System32\Macromed\Flash\FlashUtil10n_ActiveX.exe
4112 taskeng.exe
4252 C:\Program Files\Internet Explorer\iexplore.exe
4604 C:\Windows\System32\SearchProtocolHost.exe
4424 C:\Windows\System32\SearchFilterHost.exe
3160 <unknown>
4888 <unknown>
3164 C:\Users\***\Desktop\MBRCheck.exe
2020 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`83700000 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00100000 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000000`03700000 (NTFS)

PhysicalDrive0 Model Number: ST3250820AS, Rev: 3.AD
PhysicalDrive1 Model Number: ST3250820AS, Rev: 3.AD

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows Vista MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979
232 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: 9326CF48D3EC3302BE3B0BEC020C2260F2A970CA

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!