Hallo erstmal,
dieser tolle Rootkit hat sich auf einen Windows 2003 R2 Server breit gemacht.
Ich wurde darauf aufmerksam als ich gemerkt habe, dass Google Suchergebnisse auf Seiten wie z.B. 1dayoftheweek, 2dayoftheweek,...., 6dayoftheweek etc. weitergleitet wurde. Hängt auch nicht mit Firefox oder dem IE zusammen.
Mit dem TDSSKiller (aktuellste Version) werden mir zwei Objekte angezeigt:
Rootkit.Win32.ZAccess.c: Entweder Cure oder Copy to quarantine
Unter C:\Windows\ gibt es noch die Datei "1921001702:433553293.exe": Delete oder Copy to quarantine
Diese Datei findet man auch als Prozess im TaskManager. Kann weder den Prozess noch die Datei an sich entfernen (wer hätte es gedacht)
Nachdem ich nun aber den Rechner neu starte, sind die Dateien, wie auch bei vielen anderen wieder da....
TDDSKillerLog:
Zitat:
2011/09/01 19:31:33.0640 5224 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/09/01 19:31:35.0640 5224 ================================================================================
2011/09/01 19:31:35.0640 5224 SystemInfo:
2011/09/01 19:31:35.0640 5224
2011/09/01 19:31:35.0640 5224 OS Version: 5.2.3790 ServicePack: 2.0
2011/09/01 19:31:35.0640 5224 Product type: Domain controller
2011/09/01 19:31:35.0640 5224 ComputerName: S-CONNECT-STUTT
2011/09/01 19:31:35.0640 5224 UserName: Administrator
2011/09/01 19:31:35.0640 5224 Windows directory: C:\Dokumente und Einstellungen\Administrator\WINDOWS
2011/09/01 19:31:35.0640 5224 System windows directory: C:\WINDOWS
2011/09/01 19:31:35.0640 5224 Processor architecture: Intel x86
2011/09/01 19:31:35.0640 5224 Number of processors: 8
2011/09/01 19:31:35.0640 5224 Page size: 0x1000
2011/09/01 19:31:35.0640 5224 Boot type: Normal boot
2011/09/01 19:31:35.0640 5224 ================================================================================
2011/09/01 19:31:36.0000 5224 Initialize success
2011/09/01 19:31:38.0171 0152 ================================================================================
2011/09/01 19:31:38.0171 0152 Scan started
2011/09/01 19:31:38.0187 0152 Mode: Manual;
2011/09/01 19:31:38.0187 0152 ================================================================================
2011/09/01 19:31:38.0625 0152 ACPI (0b8a84e19d697160c9d5e948e3b19226) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/09/01 19:31:38.0671 0152 ACPIEC (9dd1c189e2f273e75fa53f9bb9d4fe6d) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/09/01 19:31:39.0078 0152 AFD (336d51e35c5737809449128f421431a1) C:\WINDOWS\System32\drivers\afd.sys
2011/09/01 19:31:39.0312 0152 AppleTalk (892a8da8ad1177c6be3d015c2d47b06b) C:\WINDOWS\system32\DRIVERS\sfmatalk.sys
2011/09/01 19:31:39.0453 0152 AsyncMac (a35b971f631d4dfdeb68d71e770d2ce9) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/09/01 19:31:39.0484 0152 atapi (ff953a8f08ca3f822127654375786bbe) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/09/01 19:31:39.0593 0152 ati2mtag (fb61579b321953e2dfc92a1cc12be2c6) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/09/01 19:31:39.0656 0152 Atmarpc (d12dad5032285343ce3aa4906f661181) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/09/01 19:31:39.0703 0152 audstub (5bfd980c2107d88101d1dc14055526fc) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/09/01 19:31:39.0750 0152 avgio (8a966b330f39aeb11f3facab6bdde668) C:\Programme\Avira\AntiVir Server\avgio.sys
2011/09/01 19:31:39.0781 0152 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\drivers\avgntflt.sys
2011/09/01 19:31:39.0843 0152 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/09/01 19:31:39.0875 0152 b06bdrv (974d35f8f9e69b475acf353a3d1ae865) C:\WINDOWS\system32\DRIVERS\bxvbdx.sys
2011/09/01 19:31:39.0921 0152 b06diag (cd9578cd6e7189a2c787a85b0bfe81f9) C:\WINDOWS\system32\DRIVERS\bxdiagx.sys
2011/09/01 19:31:39.0968 0152 Beep (99572503e15a3d10239b7b9887cbaf89) C:\WINDOWS\system32\drivers\Beep.sys
2011/09/01 19:31:40.0031 0152 cbidf2k (1342877de604a5a6bff986e288e3a8a7) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/09/01 19:31:40.0093 0152 Cdfs (e6d72780c957b69c48bfc66bc3ecdad4) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/09/01 19:31:40.0125 0152 Cdrom (825aa877a852ecc731fa0c39c8c37744) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/09/01 19:31:40.0265 0152 Clfs (821b38deb84b3d5f2f7c3e22b55ae040) C:\WINDOWS\system32\clfs.sys
2011/09/01 19:31:40.0328 0152 ClusDisk (54308cdf97622fae1620bb1ec39ef014) C:\WINDOWS\system32\DRIVERS\ClusDisk.sys
2011/09/01 19:31:40.0500 0152 CpqCiDrv (93ae26ab0b6db4efecd99d8cbdcb163d) C:\WINDOWS\system32\DRIVERS\cpqcidrv.sys
2011/09/01 19:31:40.0640 0152 CPQTeam (fdb09ef88f51bb3ffcd5017d8544531b) C:\WINDOWS\system32\DRIVERS\cpqteam.sys
2011/09/01 19:31:40.0718 0152 crcdisk (0ee27d9dbb208c13314f3c60f66aed26) C:\WINDOWS\system32\DRIVERS\crcdisk.sys
2011/09/01 19:31:40.0906 0152 DfsDriver (444726b01c31d29c70e60f7c35de43e5) C:\WINDOWS\system32\drivers\Dfs.sys
2011/09/01 19:31:40.0953 0152 Disk (98433302c02f1168efb7364f8111a179) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/09/01 19:31:41.0015 0152 dmboot (724361de7280af1763dc4378f8e861df) C:\WINDOWS\system32\drivers\dmboot.sys
2011/09/01 19:31:41.0046 0152 dmio (a2a89e412718fb8cc818f2422244194d) C:\WINDOWS\system32\drivers\dmio.sys
2011/09/01 19:31:41.0078 0152 dmload (3d9bfa13b6f1cd2d91c50c52b32e91a2) C:\WINDOWS\system32\drivers\dmload.sys
2011/09/01 19:31:41.0203 0152 DwMirror (383182215a2c238e76b86e3b5ede40eb) C:\WINDOWS\system32\DRIVERS\DamewareMini.sys
2011/09/01 19:31:41.0234 0152 dwvkbd (5a402c57f621114c99f813c6ae7bc37a) C:\WINDOWS\system32\DRIVERS\dwvkbd.sys
2011/09/01 19:31:41.0265 0152 e6288072 (8f2bb1827cac01aee6a16e30a1260199) C:\WINDOWS\1921001702:433553293.exe
2011/09/01 19:31:42.0171 0152 Suspicious file (Hidden): C:\WINDOWS\1921001702:433553293.exe. md5: 8f2bb1827cac01aee6a16e30a1260199
2011/09/01 19:31:42.0171 0152 e6288072 - detected HiddenFile.Multi.Generic (1)
2011/09/01 19:31:42.0312 0152 Fastfat (e792a18abdc32286212dce8e75baa124) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/09/01 19:31:42.0343 0152 Fdc (5090cd3f6ab1d71ad507953cff556ea9) C:\WINDOWS\system32\drivers\Fdc.sys
2011/09/01 19:31:42.0406 0152 Fips (9e6ffca260f8fd489d587f81e340a88d) C:\WINDOWS\system32\drivers\Fips.sys
2011/09/01 19:31:42.0437 0152 Flpydisk (c621a51f415419a3145a5939abde39fa) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/09/01 19:31:42.0484 0152 FltMgr (f978277ef786532195cdd9f88e908632) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/09/01 19:31:42.0515 0152 Fs_Rec (aebff3d810b74971b91b2b77b289a98b) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/09/01 19:31:42.0562 0152 Ftdisk (dc44beb527e1d36954faacafda054c20) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/09/01 19:31:42.0593 0152 Gpc (30b1653a955f548352024a5fee203cc3) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/09/01 19:31:42.0671 0152 hidusb (90a325e14f9b95f17712707b1a7181b5) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/09/01 19:31:42.0750 0152 HpCISSs2 (9ccb1b1e2b08e561d966c8b4bab200de) C:\WINDOWS\system32\drivers\HpCISSs2.sys
2011/09/01 19:31:42.0812 0152 hpqilo2 (531932f83691cb19a2978af004820cb2) C:\WINDOWS\system32\DRIVERS\hpqilo2.sys
2011/09/01 19:31:42.0890 0152 HTTP (66523e5ed59d095336046d3e65543cd5) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/09/01 19:31:43.0000 0152 i8042prt (bf156c8be79871e0072223dbee736190) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/09/01 19:31:43.0109 0152 imapi (44c132b35921b54b4a9ac64369d86d83) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/09/01 19:31:43.0218 0152 intelppm (b294c450af3807f66de26d7d71d58414) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/09/01 19:31:43.0265 0152 Ip6Fw (d7e7e7898a05c53dd862b49828747c1e) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/09/01 19:31:43.0296 0152 IpFilterDriver (5a41f207b7c39ee4918f7496a4f19b14) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/09/01 19:31:43.0359 0152 IpNat (890e7a14a63aec2ea9257a79a88be784) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/09/01 19:31:43.0406 0152 IPSec (0a9bae243b8bc13d76d165372288c65b) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/09/01 19:31:43.0406 0152 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ipsec.sys. Real md5: 0a9bae243b8bc13d76d165372288c65b, Fake md5: 1a9aeac49683b32df55b7fb1516f3028
2011/09/01 19:31:43.0421 0152 IPSec - detected Rootkit.Win32.ZAccess.c (0)
2011/09/01 19:31:43.0484 0152 IRENUM (11407ee682a2d5b0248de8af0f1a6996) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/09/01 19:31:43.0531 0152 isapnp (b435bf66b0c9821b55576e951e0a4997) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/09/01 19:31:43.0593 0152 Kbdclass (183ab0d0ca4fc1a03a9186099d9f472a) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/09/01 19:31:43.0625 0152 kbdhid (57fba4e0696790bc6d255f7262e6ac26) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/09/01 19:31:43.0687 0152 KSecDD (9a99005e1a41ab360de231fb8e2f6184) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/09/01 19:31:43.0734 0152 l2nd (c53bb64df95a7d71628aae3fb331d6af) C:\WINDOWS\system32\DRIVERS\bxnd52x.sys
2011/09/01 19:31:43.0921 0152 MACSRV (18fdf96fbca7914255a6a6b6cfbaba23) C:\WINDOWS\system32\DRIVERS\sfmsrv.sys
2011/09/01 19:31:43.0968 0152 mnmdd (c35bb38904d843c0465858195b30dab7) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/09/01 19:31:44.0015 0152 Modem (f2c104342467841d462ca064ff139d1f) C:\WINDOWS\system32\drivers\Modem.sys
2011/09/01 19:31:44.0046 0152 Mouclass (53482a6f728ef75f269b839178ef82e6) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/09/01 19:31:44.0093 0152 mouhid (ea6d4c67acb52602f5cf93776a27a3c8) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/09/01 19:31:44.0125 0152 MountMgr (fc43a7a34309c750b9daeadf2f6ec9b9) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/09/01 19:31:44.0203 0152 MRxDAV (ab6db63a1791f8e86b085291686464fd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/09/01 19:31:44.0250 0152 MRxSmb (16936142fa1d989cf63fd22c8b9d4a6d) C:\WINDOWS\system32\drivers\tsk3.tmp
2011/09/01 19:31:44.0312 0152 Msfs (8f50b87361585763841c6b603d23260c) C:\WINDOWS\system32\drivers\Msfs.sys
2011/09/01 19:31:44.0359 0152 msnfsflt (6fd2380e2199b77d44b8e73671099939) C:\WINDOWS\system32\DRIVERS\msnfsflt.sys
2011/09/01 19:31:44.0390 0152 mssmbios (92afab2f216ce8ffbad3bc510fcf4a33) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/09/01 19:31:44.0453 0152 Mup (834560abee4eae62620f4026263aa051) C:\WINDOWS\system32\drivers\Mup.sys
2011/09/01 19:31:44.0500 0152 NDIS (33739ab31d36184772af1ee132d5c2e2) C:\WINDOWS\system32\drivers\NDIS.sys
2011/09/01 19:31:44.0531 0152 NdisTapi (888b08f81b7d8428a37439d15c27f419) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/09/01 19:31:44.0562 0152 Ndisuio (8b8e682b03483092e17ab9dfe70fedff) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/09/01 19:31:44.0593 0152 NdisWan (1b397eef4614419be5679e0209f7848b) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/09/01 19:31:44.0640 0152 NDProxy (5298ed90bbe5c5eeedc363eed2888a25) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/09/01 19:31:44.0671 0152 NetBIOS (a0d5d6ae530ca78a062fc0471f1e6f78) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/09/01 19:31:44.0718 0152 NetBT (5cd7cca08498ec8753b22e92d367ca11) C:\WINDOWS\system32\drivers\tsk5.tmp
2011/09/01 19:31:44.0859 0152 NfsRdr (6755cca69800cde9a1f80f6db2caee84) C:\WINDOWS\system32\drivers\NfsRdr.sys
2011/09/01 19:31:44.0921 0152 NfsSvr (e289e07c8c4eb0874f717c682bfceae7) C:\WINDOWS\system32\DRIVERS\nfssvr.sys
2011/09/01 19:31:45.0109 0152 Npfs (d5bb605f6dcbdfe0129670c8de57913e) C:\WINDOWS\system32\drivers\Npfs.sys
2011/09/01 19:31:45.0171 0152 Ntfs (482ea51aadb8763a0f67588c394ec693) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/09/01 19:31:45.0218 0152 Null (5db0ede7aaf3a7bc9110d18c12524be0) C:\WINDOWS\system32\drivers\Null.sys
2011/09/01 19:31:45.0265 0152 NUServerXP32 (baf298fc64119702b39d4d2f539461d9) C:\WINDOWS\system32\DRIVERS\NUServerXP32.sys
2011/09/01 19:31:45.0359 0152 Parport (47df103cdb17749599861a1ce59bcf47) C:\WINDOWS\system32\drivers\Parport.sys
2011/09/01 19:31:45.0406 0152 PartMgr (4eb6f7418959444a06d3c51eb81bff04) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/09/01 19:31:45.0437 0152 PCI (1f589871ff5e5b56133114b7273b5136) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/09/01 19:31:45.0468 0152 PCIIde (a52f408e27cc00b21e23e181b75c627d) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/09/01 19:31:45.0515 0152 Pcmcia (efea11a064ddfc3a08cc6e9bced4aef8) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/09/01 19:31:45.0828 0152 Portmap (84be99f10e328dbe365f34585cf698b1) C:\WINDOWS\system32\DRIVERS\portmap.sys
2011/09/01 19:31:45.0859 0152 PptpMiniport (4454f2639bcca93be86a45137e427277) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/09/01 19:31:45.0921 0152 Ptilink (0320fd91fb5ed4298355977cecfc0eb4) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/09/01 19:31:46.0250 0152 RasAcd (48ee7b6802c0306f9a66f34db7e9ef75) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/09/01 19:31:46.0296 0152 Rasl2tp (3633175613e052ecb41776dee2777a89) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/09/01 19:31:46.0359 0152 RasPppoe (59842f0a22216a71cade6f89fe84c973) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/09/01 19:31:46.0390 0152 Raspti (5b11871de804d3ed28bbdcc65fe14ede) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/09/01 19:31:46.0421 0152 Rdbss (4496b15c44ccb703fbc54f2cf5b67f15) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/09/01 19:31:46.0453 0152 RDPCDD (ac5bb528ecd2bea4ff4bff9df9baf749) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/09/01 19:31:46.0515 0152 rdpdr (ff678596b761e1ccba79f49981ef51bc) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/09/01 19:31:46.0562 0152 RDPWD (319ea134a11fb4b78285475b7f9147e9) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/09/01 19:31:46.0593 0152 redbook (9ce91985ec59536b34aff85fca840000) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/09/01 19:31:46.0687 0152 RpcXdr (b31bf740db5838e1becf798a649ed828) C:\WINDOWS\system32\DRIVERS\rpcxdr.sys
2011/09/01 19:31:46.0750 0152 sacdrv (cb267fa4fbf01858b53cdd3364bf24d0) C:\WINDOWS\system32\drivers\sacdrv.sys
2011/09/01 19:31:46.0843 0152 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/09/01 19:31:46.0890 0152 serenum (b261d4597bf9a2723b7020207260c72a) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/09/01 19:31:46.0921 0152 Serial (d917646336e9515f1f39cd9719cfad6a) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/09/01 19:31:47.0000 0152 Sfloppy (831826dc54fa225f0b654ef2f1e13af9) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/09/01 19:31:47.0125 0152 SIS (7668635315c63f0a5efff92d06efa772) C:\WINDOWS\system32\DRIVERS\sis.sys
2011/09/01 19:31:47.0234 0152 Srv (e8b1a07774a9e4fec3105cbad49bf289) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/09/01 19:31:47.0265 0152 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/09/01 19:31:47.0296 0152 swenum (93965919785102ba847545ab460ce2df) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/09/01 19:31:47.0593 0152 Tcpip (238dc2b879d1b37b91f8d5d44f3815d3) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/09/01 19:31:47.0625 0152 TDPIPE (45d49fb800463de84d1cc2e231319ad5) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/09/01 19:31:47.0656 0152 TDTCP (d7c31008de209b8b11ced207580e9c91) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/09/01 19:31:47.0687 0152 TermDD (a01e46fff445a38d35db188c5458582c) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/09/01 19:31:47.0875 0152 Udfs (c26024265a7523312a5d06fc33aa57aa) C:\WINDOWS\system32\drivers\Udfs.sys
2011/09/01 19:31:47.0968 0152 Update (b0e133858e63940755b496761834f334) C:\WINDOWS\system32\DRIVERS\update.sys
2011/09/01 19:31:48.0000 0152 usbccgp (185959a7fccfd38aa71a274ae6252b88) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/09/01 19:31:48.0046 0152 usbehci (9dd4aba9462938734bcbf51d8669c884) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/09/01 19:31:48.0078 0152 usbhub (17859937740bc0d422fe71a588d6ddf7) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/09/01 19:31:48.0125 0152 usbscan (ff0464bab0572888111f22da5b9a5fe7) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/09/01 19:31:48.0156 0152 USBSTOR (d0740ff9f7e819486e88096826b4dc37) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/09/01 19:31:48.0203 0152 usbuhci (cbd3053337bb475f442a892edf671312) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/09/01 19:31:48.0250 0152 vga (2eb062b434792bb6bb614f107dd3a5cf) C:\WINDOWS\system32\DRIVERS\vgapnp.sys
2011/09/01 19:31:48.0281 0152 VgaSave (062fbc10147fd837d819f94aa394e661) C:\WINDOWS\System32\drivers\vga.sys
2011/09/01 19:31:48.0359 0152 VolSnap (1f946569f38935b5e4497620bc39e17c) C:\WINDOWS\system32\DRIVERS\volsnap.sys
2011/09/01 19:31:48.0437 0152 Wanarp (ce030b1d05a01fa012d32f2d25676b1c) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/09/01 19:31:48.0468 0152 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
2011/09/01 19:31:48.0640 0152 WLBS (aa0b9758a4035c3c181bf98e14620461) C:\WINDOWS\system32\DRIVERS\wlbs.sys
2011/09/01 19:31:48.0796 0152 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
2011/09/01 19:31:48.0937 0152 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1
2011/09/01 19:31:48.0953 0152 Boot (0x1200) (17a391fe6ebedf7844c514b6bd1aef8f) \Device\Harddisk0\DR0\Partition0
2011/09/01 19:31:48.0984 0152 Boot (0x1200) (858d8b612536eff19f7b58e13a1ad7cf) \Device\Harddisk0\DR0\Partition1
2011/09/01 19:31:49.0000 0152 Boot (0x1200) (3b8bd6b9524ebccf589950914021ace9) \Device\Harddisk1\DR1\Partition0
2011/09/01 19:31:49.0015 0152 ================================================================================
2011/09/01 19:31:49.0015 0152 Scan finished
2011/09/01 19:31:49.0015 0152 ================================================================================
2011/09/01 19:31:49.0062 6140 Detected object count: 2
2011/09/01 19:31:49.0062 6140 Actual detected object count: 2
2011/09/01 19:31:59.0625 6140 HiddenFile.Multi.Generic(e6288072) - User select action: Skip
2011/09/01 19:31:59.0640 6140 IPSec (0a9bae243b8bc13d76d165372288c65b) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/09/01 19:31:59.0640 6140 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ipsec.sys. Real md5: 0a9bae243b8bc13d76d165372288c65b, Fake md5: 1a9aeac49683b32df55b7fb1516f3028
2011/09/01 19:32:00.0531 6140 Backup copy found, using it..
2011/09/01 19:32:00.0531 6140 C:\WINDOWS\system32\DRIVERS\ipsec.sys - will be cured after reboot
2011/09/01 19:32:00.0531 6140 Rootkit.Win32.ZAccess.c(IPSec) - User select action: Cure
2011/09/01 19:32:10.0625 6096 Deinitialize success
|
Nächster Schritt wäre wohl ComboFix und Log posten?
Ich bedanke mich schon einmal recht herzlich für eure hilfe!
Edit: OTL Log und
Malwarebytes Log werden gerade noch erstellt. Werde es dann auch gleich noch posten. GMer Log kann ich leider erst gegen später posten.
02.09.2011, 13:23
Baum-Darstellung