| |
| |||||||
Log-Analyse und Auswertung: Trojaner in system volume information_Recent - Kontrolle mit GMERWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
08.06.2011, 22:50
| #1 |
| |  Trojaner in system volume information_Recent - Kontrolle mit GMER Hallo! Durch Malwarebyts, hatte ich festgestellt, dass sich zwei Trojaner (Trojan.IRCBot) und Rootkits in "system volume information\_Recent" eingenistet hatten. Ein Freund von mir empfahl nach der Reinigung die FP mit "GMER" zu untersuchen. Dazu hab ich ein Log erstellt und würde dies hier gern einmal zur Auswertung einstellen und bitte um Eure Meinung. Danke! ### Mein Sxstem: XP Prof, SP3, Firefox Panda Antivirus Malwarebytes ########### GMER Logfile: Code:
ATTFilter GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-08 23:34:55
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3160021A rev.3.04
Running: 4cwyk50q.exe; Driver: C:\DOKUME~1\Oesianer\LOKALE~1\Temp\fgdoipog.sys
---- System - GMER 1.0.15 ----
SSDT \??\C:\WINXP\system32\DRIVERS\PavProc.sys (Panda Protection driver/Panda Security, S.L.) ZwTerminateProcess [0xB647B73A]
---- Kernel code sections - GMER 1.0.15 ----
? C:\WINXP\system32\PavTPK.sys Das System kann die angegebene Datei nicht finden. !
? C:\WINXP\system32\PavSRK.sys Das System kann die angegebene Datei nicht finden. !
? system32\drivers\av5flt.sys Das System kann den angegebenen Pfad nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtClose 7C91CFEE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtClose + 4 7C91CFF2 2 Bytes [44, 5F] {INC ESP; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [65, 5F]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtCreateKey 7C91D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtCreateKey + 4 7C91D0F2 2 Bytes [47, 5F] {INC EDI; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDeleteFile 7C91D23E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDeleteFile + 4 7C91D242 2 Bytes [68, 5F]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDeleteKey 7C91D24E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDeleteKey + 4 7C91D252 2 Bytes [4A, 5F] {DEC EDX; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [4D, 5F] {DEC EBP; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDuplicateObject 7C91D29E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtDuplicateObject + 4 7C91D2A2 2 Bytes [50, 5F] {PUSH EAX; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtEnumerateKey 7C91D2CE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtEnumerateKey + 4 7C91D2D2 2 Bytes [53, 5F] {PUSH EBX; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtEnumerateValueKey 7C91D2EE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtEnumerateValueKey + 4 7C91D2F2 2 Bytes [56, 5F] {PUSH ESI; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtLoadDriver 7C91D46E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtLoadDriver + 4 7C91D472 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [6B, 5F]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtQueryMultipleValueKey 7C91D86E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtQueryMultipleValueKey + 4 7C91D872 2 Bytes [59, 5F] {POP ECX; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtQueryValueKey 7C91D96E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtQueryValueKey + 4 7C91D972 2 Bytes [5C, 5F] {POP ESP; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtReadFile 7C91D9CE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtReadFile + 4 7C91D9D2 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtSetContextThread 7C91DBAE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtSetContextThread + 4 7C91DBB2 2 Bytes [7A, 5F] {JP 0x61}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtSetInformationFile 7C91DC5E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtSetInformationFile + 4 7C91DC62 2 Bytes [71, 5F] {JNO 0x61}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtUnloadKey 7C91DECE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtUnloadKey + 4 7C91DED2 2 Bytes [62, 5F]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtWriteFile 7C91DF7E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtWriteFile + 4 7C91DF82 2 Bytes [74, 5F] {JZ 0x61}
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtWriteVirtualMemory 7C91DFAE 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ntdll.dll!NtWriteVirtualMemory + 4 7C91DFB2 2 Bytes [77, 5F] {JA 0x61}
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F310F5A
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F3A0F5A
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F340F5A
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [3E, 5F]
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [41, 5F] {INC ECX; POP EDI}
.text C:\WINXP\Explorer.EXE[280] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F370F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!CloseServiceHandle 77DB6CE5 6 Bytes JMP 5F100F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!OpenServiceW 77DB6FFD 6 Bytes JMP 5F220F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!StartServiceA 77DBFB58 6 Bytes JMP 5F250F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!StartServiceW 77DC3E94 6 Bytes JMP 5F280F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!ControlService 77DC4A09 6 Bytes JMP 5F130F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!OpenServiceA 77DC4C66 6 Bytes JMP 5F1F0F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!LsaAddAccountRights 77DEABF1 6 Bytes JMP 5F2B0F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!LsaRemoveAccountRights 77DEAC91 6 Bytes JMP 5F2E0F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 6 Bytes JMP 5F040F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!ChangeServiceConfigW 77E07001 6 Bytes JMP 5F070F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 6 Bytes JMP 5F0A0F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E0718D 2 Bytes [0E, 5F] {PUSH CS; POP EDI}
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 5F160F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 5F190F5A
.text C:\WINXP\Explorer.EXE[280] ADVAPI32.dll!DeleteService 77E074B1 6 Bytes JMP 5F1C0F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!DispatchMessageW 7E368A01 6 Bytes JMP 5FB00F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!TranslateMessage 7E368BF6 6 Bytes JMP 5F8E0F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 5FA10F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!DispatchMessageA 7E3696B8 6 Bytes JMP 5F8B0F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!CreateAcceleratorTableW 7E36D9BB 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] USER32.dll!CreateAcceleratorTableW + 4 7E36D9BF 2 Bytes [AB, 5F] {STOSD ; POP EDI}
.text C:\WINXP\Explorer.EXE[280] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 5FAD0F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!GetKeyState 7E379ED9 6 Bytes JMP 5F9B0F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!GetAsyncKeyState 7E37A78F 6 Bytes JMP 5F920F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 5FA40F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!BeginDeferWindowPos 7E37AFB9 6 Bytes JMP 5F880F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!GetKeyboardState 7E37D226 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] USER32.dll!GetKeyboardState + 4 7E37D22A 2 Bytes [99, 5F] {CDQ ; POP EDI}
.text C:\WINXP\Explorer.EXE[280] USER32.dll!SetClipboardData 7E380F9E 6 Bytes JMP 5FB30F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 5F850F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 5FA70F5A
.text C:\WINXP\Explorer.EXE[280] USER32.dll!AttachThreadInput 7E381E52 3 Bytes [FF, 25, 1E]
.text C:\WINXP\Explorer.EXE[280] USER32.dll!AttachThreadInput + 4 7E381E56 2 Bytes [96, 5F] {XCHG ESI, EAX; POP EDI}
.text C:\WINXP\Explorer.EXE[280] USER32.dll!DdeConnect 7E3A81C3 6 Bytes JMP 5F9E0F5A
.text C:\WINXP\Explorer.EXE[280] ole32.dll!CLSIDFromProgID 774E8322 6 Bytes JMP 5F820F5A
.text C:\WINXP\Explorer.EXE[280] ole32.dll!CLSIDFromProgIDEx 77526235 6 Bytes JMP 5F7F0F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!sendto 71A12F51 6 Bytes JMP 5FC20F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!recvfrom 71A12FF7 6 Bytes JMP 5FBC0F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!closesocket 71A13E2B 6 Bytes JMP 5FD40F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!connect 71A14A07 6 Bytes JMP 5FB60F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!send 71A14C27 6 Bytes JMP 5FBF0F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!WSARecv 71A14CB5 6 Bytes JMP 5FC80F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!recv 71A1676F 6 Bytes JMP 5FB90F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!WSASend 71A168FA 6 Bytes JMP 5FCE0F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!WSARecvFrom 71A1F66A 6 Bytes JMP 5FCB0F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!WSASendTo 71A20AAD 6 Bytes JMP 5FD10F5A
.text C:\WINXP\Explorer.EXE[280] WS2_32.dll!WSAConnect 71A20C81 6 Bytes JMP 5FC50F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtClose 7C91CFEE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtClose + 4 7C91CFF2 2 Bytes [65, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtCreateFile 7C91D0AE 1 Byte [FF]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtCreateFile 7C91D0AE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtCreateFile + 4 7C91D0B2 2 Bytes [86, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtCreateKey 7C91D0EE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtCreateKey + 4 7C91D0F2 2 Bytes [68, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDeleteFile 7C91D23E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDeleteFile + 4 7C91D242 2 Bytes [89, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDeleteKey 7C91D24E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDeleteKey + 4 7C91D252 2 Bytes [6B, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDeleteValueKey 7C91D26E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDeleteValueKey + 4 7C91D272 2 Bytes [6E, 5F] {OUTSB ; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDuplicateObject 7C91D29E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtDuplicateObject + 4 7C91D2A2 2 Bytes [71, 5F] {JNO 0x61}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtEnumerateKey 7C91D2CE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtEnumerateKey + 4 7C91D2D2 2 Bytes [74, 5F] {JZ 0x61}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtEnumerateValueKey 7C91D2EE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtEnumerateValueKey + 4 7C91D2F2 2 Bytes [77, 5F] {JA 0x61}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtLoadDriver 7C91D46E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtLoadDriver + 4 7C91D472 2 Bytes [9E, 5F] {SAHF ; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtOpenFile 7C91D59E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtOpenFile + 4 7C91D5A2 2 Bytes [8C, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtQueryMultipleValueKey 7C91D86E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtQueryMultipleValueKey + 4 7C91D872 2 Bytes [7A, 5F] {JP 0x61}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtQueryValueKey 7C91D96E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtQueryValueKey + 4 7C91D972 2 Bytes [7D, 5F] {JGE 0x61}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtReadFile 7C91D9CE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtReadFile + 4 7C91D9D2 2 Bytes [8F, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtSetContextThread 7C91DBAE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtSetContextThread + 4 7C91DBB2 2 Bytes [9B, 5F] {WAIT ; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtSetInformationFile 7C91DC5E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtSetInformationFile + 4 7C91DC62 2 Bytes [92, 5F] {XCHG EDX, EAX; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtSetValueKey 7C91DDCE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtSetValueKey + 4 7C91DDD2 2 Bytes [80, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtUnloadKey 7C91DECE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtUnloadKey + 4 7C91DED2 2 Bytes [83, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtWriteFile 7C91DF7E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtWriteFile + 4 7C91DF82 2 Bytes [95, 5F] {XCHG EBP, EAX; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtWriteVirtualMemory 7C91DFAE 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ntdll.dll!NtWriteVirtualMemory + 4 7C91DFB2 2 Bytes [98, 5F] {CWDE ; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!TerminateProcess 7C801E1A 6 Bytes JMP 5F520F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!CreateFileMappingW 7C80943C 6 Bytes JMP 5F5B0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!MapViewOfFileEx 7C80B936 6 Bytes JMP 5F550F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!CreateRemoteThread 7C8104CC 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!CreateRemoteThread + 4 7C8104D0 2 Bytes [5F, 5F] {POP EDI; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!MoveFileWithProgressW 7C81F72E 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!MoveFileWithProgressW + 4 7C81F732 2 Bytes [62, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 5F580F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!CloseServiceHandle 77DB6CE5 6 Bytes JMP 5F310F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!OpenServiceW 77DB6FFD 6 Bytes JMP 5F430F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!StartServiceA 77DBFB58 6 Bytes JMP 5F460F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!StartServiceW 77DC3E94 6 Bytes JMP 5F490F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!ControlService 77DC4A09 6 Bytes JMP 5F340F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!OpenServiceA 77DC4C66 6 Bytes JMP 5F400F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!LsaAddAccountRights 77DEABF1 6 Bytes JMP 5F4C0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!LsaRemoveAccountRights 77DEAC91 6 Bytes JMP 5F4F0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 6 Bytes JMP 5F250F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!ChangeServiceConfigW 77E07001 6 Bytes JMP 5F280F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 6 Bytes JMP 5F2B0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!ChangeServiceConfig2W + 4 77E0718D 2 Bytes [2F, 5F] {DAS ; POP EDI}
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!CreateServiceA 77E07211 6 Bytes JMP 5F370F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!CreateServiceW 77E073A9 6 Bytes JMP 5F3A0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ADVAPI32.dll!DeleteService 77E074B1 6 Bytes JMP 5F3D0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!DispatchMessageW 7E368A01 6 Bytes JMP 5FD60F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!TranslateMessage 7E368BF6 6 Bytes JMP 5FB50F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!PostMessageW 7E368CCB 6 Bytes JMP 5FC70F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!DispatchMessageA 7E3696B8 6 Bytes JMP 5FB20F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!CreateAcceleratorTableW 7E36D9BB 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!CreateAcceleratorTableW + 4 7E36D9BF 2 Bytes [D1, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 5FD30F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!GetKeyState 7E379ED9 6 Bytes JMP 5FC10F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!GetAsyncKeyState 7E37A78F 6 Bytes JMP 5FB80F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!PostMessageA 7E37AAFD 6 Bytes JMP 5FCA0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!BeginDeferWindowPos 7E37AFB9 6 Bytes JMP 5FAF0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!GetKeyboardState 7E37D226 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!GetKeyboardState + 4 7E37D22A 2 Bytes [BF, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!SetClipboardData 7E380F9E 6 Bytes JMP 5FD90F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 5FAC0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 5FCD0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!AttachThreadInput 7E381E52 3 Bytes [FF, 25, 1E]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!AttachThreadInput + 4 7E381E56 2 Bytes [BC, 5F]
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] USER32.dll!DdeConnect 7E3A81C3 6 Bytes JMP 5FC40F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!sendto 71A12F51 6 Bytes JMP 5F100F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!recvfrom 71A12FF7 6 Bytes JMP 5F0A0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!closesocket 71A13E2B 6 Bytes JMP 5F220F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!connect 71A14A07 6 Bytes JMP 5F040F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!send 71A14C27 6 Bytes JMP 5F0D0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!WSARecv 71A14CB5 6 Bytes JMP 5F160F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!recv 71A1676F 6 Bytes JMP 5F070F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!WSASend 71A168FA 6 Bytes JMP 5F1C0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!WSARecvFrom 71A1F66A 6 Bytes JMP 5F190F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!WSASendTo 71A20AAD 6 Bytes JMP 5F1F0F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] WS2_32.dll!WSAConnect 71A20C81 6 Bytes JMP 5F130F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ole32.dll!CoCreateInstanceEx 774CF154 6 Bytes JMP 5FA90F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ole32.dll!CoGetClassObject 774E51F5 6 Bytes JMP 5FA60F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ole32.dll!CLSIDFromProgID 774E8322 6 Bytes JMP 5FA30F5A
.text C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe[1760] ole32.dll!CLSIDFromProgIDEx 77526235 6 Bytes JMP 5FA00F5A
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINXP\Explorer.EXE[280] @ C:\WINXP\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs ShlDrv51.sys (PandaShield driver/Panda Security, S.L.)
AttachedDevice \FileSystem\Ntfs \Ntfs av5flt.sys
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSE05.00.00.01PRO 4575818C93200CEC0D094BC14669FBE15464BD17222CEF174E64E106EEF03462B1A418571E0CC660FE3B5DCCB8E27EE78B8CDB6E12C50D9965A255D554CFC5F88222CF105AE33D94C044231852ADB946366644CD3CBCE37656AAF3902E29637B5A25286170CAAA83889958FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E6678EDD5E5BE2F6E6678EDD5E5BE2F6E66795D3BEBF9D9BE55D47E2EF2CF26D0CE46A59C088A09799B0E4B0D5C345E81845C0FE408D1602EAA9CE16BDAE47958DAE5CE6F53806F9E47CF3BCD37F8487167EAAC2706991CC7E150FE0040A488B2C970E61EB0B458B6D2CFCE648EEF3B8EFEB2CBB19996796F0D487E57CAE46FD7792C58D713CC730A50EB33BADBAB53618D67EDA0752110ED2539919660035B140C63187D37E98E33FA7AC188501104EC1C1BFE40BBFADF7FB2C8EC506D72E7FA08DE0BE68776AB1B42EE0B354546C64E66072F1FD0102AA84B212099F01EAD272F54875863D12BB400E2E93A33BD9EDC41C7DEEB528F291CAECB2557E3C4C2DD4C2414288DF873763E65615FEAE88745C0F2A1D92BD8C2B7312E26FF1BBD6A02B6A070F4F5F686CE18CFEE6779C4F97738D299174BB7D8C62117C72CB2931589C963A1DBEAFF53BC306AF8D21E8290A12980AB4C2111
---- EOF - GMER 1.0.15 ----
|
|
09.06.2011, 10:32
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Trojaner in system volume information_Recent - Kontrolle mit GMER Bitte poste alle Logs von Malwarebytes
__________________
__________________ |
|
09.06.2011, 20:01
| #3 |
| | Trojaner in system volume information_Recent - Kontrolle mit GMER Malwarebytes' Anti-Malware 1.51.0.1200
__________________www.malwarebytes.org Datenbank Version: 6789 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 06.06.2011 23:57:11 mbam-log-2011-06-06 (23-57-11).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|) Durchsuchte Objekte: 203320 Laufzeit: 49 Minute(n), 19 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 6 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\system volume information\_restore{b63df984-428c-4bf0-93ca-2ce276b61861}\RP10\A0004536.exe (Trojan.IRCBot) -> Quarantined and deleted successfully. f:\software-fp\easeus data recovery wizard professional 4.3.6.exe (Trojan.IRCBot) -> Quarantined and deleted successfully. f:\system volume information\_restore{b63df984-428c-4bf0-93ca-2ce276b61861}\RP25\A0006314.exe (Trojan.IRCBot) -> Quarantined and deleted successfully. Gruß Taumel |
|
09.06.2011, 20:13
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner in system volume information_Recent - Kontrolle mit GMERZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
09.06.2011, 20:24
| #5 |
| | Trojaner in system volume information_Recent - Kontrolle mit GMER Tja, von einem Freund. Der wiederum meinte, es war auf einer Heft-CD von Chip drauf. Was ich aber selbst nicht glaube... |
|
09.06.2011, 20:33
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner in system volume information_Recent - Kontrolle mit GMER Ist gecrackte und damit illegale Software. Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!! Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!
__________________ --> Trojaner in system volume information_Recent - Kontrolle mit GMER |
|
09.06.2011, 20:42
| #7 |
| | Trojaner in system volume information_Recent - Kontrolle mit GMER Arne, hab ich kein Problem damit! Ich habe die FP komplett neu formatiert und Ruhe ist. Inklusive Löschung aller verdächtigen Dateien bzw. Programme. Ich habe meinem Freund seiner Aussage vertraut, mehr kann ich dazu nicht sagen... |
|
09.06.2011, 20:52
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner in system volume information_Recent - Kontrolle mit GMER Ja nur leider dürfen wir bei gecrackter Software nicht helfen. Wenn es nur auf der externen Platte drauf ist sei froh  Sei in Zukunft vorsichtiger wenn dir jmd Software anquatschen will. Vllt hat dieser sich das auch gerade erst gezogen um zu sehen, ob es das System verseucht um nicht das Risiko auf dem eigenen Rechner zu tragen  Je anonymer die Quelle, desto gefährlicher. V.a. wenn es "kostenlos" ein Programm ist, das sonst für viel Geld gekauft werden muss ist es eigentlich immer gecrackt, damit illegal und eigentlich auch immer verseucht. In deinem Fall kostet der easeus data recovery wizard professional 90 US-$ !!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.06.2011, 11:58
| #9 |
| | Trojaner in system volume information_Recent - Kontrolle mit GMER Versteh Dich schon! Wollte aber keine Hilfe zu irgendwelcher Software haben, sondern nur Eure Meinung zu dem Log vom GMER. Bei dem Preis kann ich mir gut vorstellen, dass die User sich einen "anderen Weg" suchen. Natürlich mit dem Risiko, sich etwas einzufangen... |
|
| Themen zu Trojaner in system volume information_Recent - Kontrolle mit GMER |
| anti-malware, auswertung, code, crypt, datei, explorer.exe, festgestellt, gmer, harddisk, ide, log, mbamservice.exe, ntdll.dll, programme, registry, rootkits, scan, security, service pack 3, shell32.dll, software, sp3, system, system volume information, system32, temp, trojan.ircbot, trojaner, winxp, zwei trojaner |
Linear-Darstellung
