| |
| |||||||
Log-Analyse und Auswertung: Hijack-Logfile nach Rootkit Attacke.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
05.01.2007, 11:56
| #3 | |
 |  Hijack-Logfile nach Rootkit Attacke. Hallo Karl,
__________________danke für Deine Analyse. Die japanische IP lässt sich sicherlich mit TOR erklären, das habe ich nämlich installiert, wenngleich ich es selten benutze. Ich habe diese IP mal eingegeben bei Google und es kommt eine offensichtlich TOR-bezogene Seite (wenngleich man die nicht anwählen kann), also wird diese wohl dem Proxy zuzuordnen sein. Ich denke auch, dass mehr Ergebnisse kämen bei Google, u.a. von anderen Boards wenn diese IP schmutzig wäre. So, nun liefere ich noch Logs von meinen Rootkit-Jägern nach, hier erst mal vom TrendMicro Rootkit Buster: +---------------------------------------------------- | Trend Micro RootkitBuster 1.6 Beta. | Module version: 1.6.0.1049 +---------------------------------------------------- --== Dump Hidden File on C:\ ==-- No hidden files found. --== Dump Hidden Registry Value on HKLM ==-- [HIDDEN_REGISTRY][Hidden Reg Value]: KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40 Root : 0 SubKey : jdgg40 ValueName : ujdew Data : 20 02 00 00 E7 56 C0 78 ... ValueType : 3 AccessType: 0 FullLength: 0x4b DataSize : 0x220 [HIDDEN_REGISTRY][Hidden Reg Value]: KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40 Root : 0 SubKey : jdgg40 ValueName : ljej40 Data : 69 CB FC E5 34 20 22 72 ... ValueType : 3 AccessType: 0 FullLength: 0x4b DataSize : 0x1ac 2 hidden registry entries found. --== Dump Hidden Process ==-- No hidden processes found. --== Dump Hidden Driver ==-- No hidden drivers found. Googeln hat ergeben, dass diese Einträge vom Alcohol120 stammen. Die Datei vom Eintrag 023 ist in der Tat auch nach einem Reboot nicht mehr auf meinem System. Auch lässt sich nix über sie im Netz finden, weswegen ich einfach mal annehme, dass RRevealer sie nicht ganz sauber entfernt hat. IceSword meldet im Wesentlichen 2 ihm verdächtig vorkommende Aktivitäten. Nämlich von a347bus.sys und vsdatant.sys. Erstgenanntes ist wiederum mit Alcohol120 verbunden, zweit genannte sys ist offensichtlich ein Bestandteil vom Zone Alarm, den ich i.d.T. laufen habe. Der Rootkit Unhooker spuckt folgendes Log aus: >SSDT State !!!!!!!!!!!Hooked service: NtClose Actual Address 0xF7492028 Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtConnectPort Actual Address 0xBABE68D0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtCreateFile Actual Address 0xBABE32D0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtCreateKey Actual Address 0xBABEE0D0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtCreatePagingFile Actual Address 0xF7485B00 Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtCreatePort Actual Address 0xBABE6C60 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtCreateProcess Actual Address 0xBABECEE0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtCreateProcessEx Actual Address 0xBABED110 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtCreateSection Actual Address 0xBABF06D0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtCreateWaitablePort Actual Address 0xBABE6D40 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtDeleteFile Actual Address 0xBABE3950 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtDeleteKey Actual Address 0xBABEF0B0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtDeleteValueKey Actual Address 0xBABEED00 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtDuplicateObject Actual Address 0xBABECC50 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtEnumerateKey Actual Address 0xF74865DC Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtEnumerateValueKey Actual Address 0xF7492120 Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtLoadKey Actual Address 0xBABEF3E0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtOpenFile Actual Address 0xBABE37A0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtOpenKey Actual Address 0xF7491FA4 Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtOpenProcess Actual Address 0xBABEC9A0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtOpenThread Actual Address 0xBABEC7C0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtQueryKey Actual Address 0xF74865FC Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtQueryValueKey Actual Address 0xF7492076 Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtReplaceKey Actual Address 0xBABEF6D0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtRequestWaitReplyPort Actual Address 0xBABE6570 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtRestoreKey Actual Address 0xBABEF980 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtSecureConnectPort Actual Address 0xBABE6A80 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtSetInformationFile Actual Address 0xBABE3AC0 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtSetSystemPowerState Actual Address 0xF7491550 Hooked by: a347bus.sys !!!!!!!!!!!Hooked service: NtSetValueKey Actual Address 0xBABEE897 Hooked by: C:\WINDOWS\System32\vsdatant.sys !!!!!!!!!!!Hooked service: NtTerminateProcess Actual Address 0xBABED340 Hooked by: C:\WINDOWS\System32\vsdatant.sys >Processes >Drivers >Files Suspect File: D:\Cache\dtatempfile1167992182528.part2 Status: Hidden Suspect File: D:\Cache\dtatempfile1167992184108.part1 Status: Hidden Suspect File: D:\Cache\dtatempfile1167992187793.part0 Status: Hidden Suspect File: D:\Cache\dtatempfile1167992188587.part3 Status: Hidden Suspect File: D:\Cache\dtatempfile1167992189880.part4 Status: Hidden Suspect File: F:\HUEPP.GIF Status: Hidden >Hooks !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> GetSidSubAuthorityCount, Type: Inline at address 0x00417650 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegCloseKey, Type: Inline at address 0x00417540 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegCreateKeyA, Type: Inline at address 0x004175A0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegCreateKeyExA, Type: Inline at address 0x004175E0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegCreateKeyExW, Type: Inline at address 0x00417600 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegCreateKeyW, Type: Inline at address 0x004175C0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegDeleteKeyA, Type: Inline at address 0x00417620 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegDeleteKeyW, Type: Inline at address 0x00417650 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegDeleteValueA, Type: Inline at address 0x00417680 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegDeleteValueW, Type: Inline at address 0x004176B0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegEnumKeyExA, Type: Inline at address 0x004176E0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegEnumKeyExW, Type: Inline at address 0x00417710 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegEnumValueA, Type: Inline at address 0x00417740 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegEnumValueW, Type: Inline at address 0x00417770 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegFlushKey, Type: Inline at address 0x00417570 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegOpenKeyA, Type: Inline at address 0x004177A0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegOpenKeyExA, Type: Inline at address 0x004177E0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegOpenKeyExW, Type: Inline at address 0x00417810 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegOpenKeyW, Type: Inline at address 0x004177C0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegQueryInfoKeyA, Type: Inline at address 0x00417840 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegQueryInfoKeyW, Type: Inline at address 0x00417870 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegQueryValueA, Type: Inline at address 0x004178A0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegQueryValueExA, Type: Inline at address 0x00417900 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegQueryValueExW, Type: Inline at address 0x00417930 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegQueryValueW, Type: Inline at address 0x004178D0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegSetValueA, Type: Inline at address 0x00417960 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegSetValueExA, Type: Inline at address 0x004179C0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegSetValueExW, Type: Inline at address 0x004179F0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> advapi32.dll -> RegSetValueW, Type: Inline at address 0x00417990 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> kernel32.dll -> CreateFileA, Type: Inline at address 0x00459870 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> kernel32.dll -> CreateFileW, Type: Inline at address 0x00459940 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> kernel32.dll -> IsDebuggerPresent, Type: Inline at address 0x005CA6D0 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> user32.dll -> ChangeDisplaySettingsExA, Type: Inline at address 0x00459810 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> user32.dll -> ChangeDisplaySettingsExW, Type: Inline at address 0x00459840 hook handler located in [mplayerc.exe] !!!!!!!!!!!Hook: mplayerc.exe -> user32.dll -> MapVirtualKeyExW, Type: Inline at address 0x00459840 hook handler located in [mplayerc.exe] !!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =) Das wärs soweit. Hoffe das sagt genug aus. Gruß und danke, Ich-mag-keine-Viren Zitat:
|
| Themen zu Hijack-Logfile nach Rootkit Attacke. |
| ad-aware, adobe, antivirus, avast!, bho, drivers, ellung, exe, firefox, free download, helfen, helper, hijack, install.exe, internet, internet explorer, ip-adresse, log-files, logfile, monitor, problem, prozesse, präzise, registry, rootkit, rundll, software, spam, starten, trojaner, urlsearchhook, usb, viren, windows, windows xp, ändern |
Baum-Darstellung