Diverse E-Mail Konten gehackt

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-04-09 17:26:09
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.CXM0 119,24GB
Running: eie89vfw.exe; Driver: C:\Users\xxx\AppData\Local\Temp\pfdiqpog.sys


---- System - GMER 2.1 ----

SSDT            8E760986                                  ZwCreateSection
SSDT            8E760990                                  ZwRequestWaitReplyPort
SSDT            8E76098B                                  ZwSetContextThread
SSDT            8E760995                                  ZwSetSecurityObject
SSDT            8E76099A                                  ZwSystemDebugControl
SSDT            8E760927                                  ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntoskrnl.exe!ZwRollbackEnlistment + 1401  82C359A9 1 Byte  [06]
.text           ntoskrnl.exe!KiDispatchInterrupt + 5A2    82C554D2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntoskrnl.exe!KeRemoveQueueEx + 14BF       82C5C87C 4 Bytes  [86, 09, 76, 8E] {XCHG [ECX], CL; JBE 0xffffff92}
.text           ntoskrnl.exe!KeRemoveQueueEx + 181B       82C5CBD8 4 Bytes  [90, 09, 76, 8E] {NOP ; OR [ESI-0x72], ESI}
.text           ntoskrnl.exe!KeRemoveQueueEx + 185F       82C5CC1C 4 Bytes  [8B, 09, 76, 8E] {MOV ECX, [ECX]; JBE 0xffffff92}
.text           ntoskrnl.exe!KeRemoveQueueEx + 18DB       82C5CC98 4 Bytes  [95, 09, 76, 8E] {XCHG EBP, EAX; OR [ESI-0x72], ESI}
.text           ntoskrnl.exe!KeRemoveQueueEx + 192F       82C5CCEC 4 Bytes  CALL F8CF6773 
.text           ...                                       

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0   Wdf01000.sys

---- EOF - GMER 2.1 ----
         

Malwarebytes Anti-Rootkit BETA 1.01.0.1022
www.malwarebytes.org

Database version: v2013.04.09.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
xxx :: xxx-PC [administrator]

09.04.2013 17:33:23
mbar-log-2013-04-09 (17-33-23).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 27112
Time elapsed: 4 minute(s), 28 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)