| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Habe ich ein Rootkit auf dem PC?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.10.2007, 11:12
| #1 |
| |  Habe ich ein Rootkit auf dem PC? Hi Leute, habe seit ein paar Tagen ein Problem: Wenn ich manche Sachen starte(beispielsweise Quicktime oder die Benutzerkonten über die Systemsteuerung) hängt das Betriebssystem und der Monitor geht aus, später rebootet der PC. Ab und zu erhalte ich auch Meldungen wie Buffer Overrun etc. hier mein Hijack this Log Logfile of HijackThis v1.99.1 Scan saved at 11:57:29, on 26.10.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\iSaver\iSaverCtrl.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Eraser\Eraser.exe C:\Program Files\Free Download Manager\FUM\fumoei.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\hh.exe C:\DOCUME~1\...\LOCALS~1\Temp\Rar$EX00.469\Rootkit_Detective.exe C:\Program Files\TrueCrypt\TrueCrypt.exe C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE C:\Documents and Settings\...\Desktop\hijackthis_199\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [iSaverCtrl] C:\Program Files\iSaver\iSaverCtrl.exe --startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SAITEKAUTOCONFIGURE] C:\Program Files\Saitek\ST\Drv\saicnfig.exe /autorun O4 - HKCU\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Senden an &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Program Files\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Program Files\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O11 - Options group: [INTERNATIONAL] International* O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - c:\xampp\filezillaftp\filezillaserver.exe (file missing) O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe hier der report vom Rootkit unlocker >SSDT State NtConnectPort Actual Address 0xF3E4AEB0 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtCreateFile Actual Address 0xF3E47870 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtCreateKey Actual Address 0xF3E52700 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtCreatePort Actual Address 0xF3E4B270 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtCreateProcess Actual Address 0xF3E51500 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtCreateProcessEx Actual Address 0xF3E51730 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtCreateSection Actual Address 0xF3E55090 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtCreateThread Actual Address 0xF7D059BC Hooked by: Unknown module filename NtCreateWaitablePort Actual Address 0xF3E4B350 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtDeleteFile Actual Address 0xF3E47EF0 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtDeleteKey Actual Address 0xF3E53720 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtDeleteValueKey Actual Address 0xF3E53360 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtDuplicateObject Actual Address 0xF3E51270 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtEnumerateKey Actual Address 0xF752AFB2 Hooked by: sptd.sys NtEnumerateValueKey Actual Address 0xF752B340 Hooked by: sptd.sys NtLoadKey Actual Address 0xF3E53A60 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtOpenFile Actual Address 0xF3E47D40 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtOpenKey Actual Address 0xF75250B0 Hooked by: sptd.sys NtOpenProcess Actual Address 0xF7D059A8 Hooked by: Unknown module filename NtOpenThread Actual Address 0xF7D059AD Hooked by: Unknown module filename NtQueryKey Actual Address 0xF752B418 Hooked by: sptd.sys NtQueryValueKey Actual Address 0xF752B298 Hooked by: sptd.sys NtRenameKey Actual Address 0xF3E541D0 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtReplaceKey Actual Address 0xF3E53D50 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtRequestWaitReplyPort Actual Address 0xF3E4AB50 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtRestoreKey Actual Address 0xF3E54000 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtSecureConnectPort Actual Address 0xF3E4B060 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtSetInformationFile Actual Address 0xF3E48060 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtSetValueKey Actual Address 0xF3E52ED7 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtTerminateProcess Actual Address 0xF7D059B7 Hooked by: Unknown module filename NtWriteVirtualMemory Actual Address 0xF7D059B2 Hooked by: Unknown module filename >Shadow NtUserMessageCall Actual Address 0xF3E491A0 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtUserPostMessage Actual Address 0xF3E49230 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtUserPostThreadMessage Actual Address 0xF3E492B0 Hooked by: C:\WINDOWS\System32\vsdatant.sys NtUserSendInput Actual Address 0xF3E49470 Hooked by: C:\WINDOWS\System32\vsdatant.sys >Processes >Drivers >Stealth Unknown page with executable code Address: 0x86C2F706 Size: 2298 Unknown page with executable code Address: 0x86CA23BD Size: 3139 Unknown page with executable code Address: 0x86C35DE2 Size: 542 Unknown page with executable code Address: 0x86CA1D92 Size: 622 >Files >Hooks fastfat.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xBAC9787C hook handler located in [unknown_code_page] ntoskrnl.exe-->IoCreateDevice, Type: EAT modification at address 0x8067E8F4 hook handler located in [unknown_code_page] tcpip.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF3EDEF28 hook handler located in [vsdatant.sys] tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF3EDEF54 hook handler located in [vsdatant.sys] tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF3EDEF60 hook handler located in [vsdatant.sys] tcpip.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xF3EDEF88 hook handler located in [unknown_code_page] wanarp.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF7774B4C hook handler located in [vsdatant.sys] wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification at address 0xF7774B1C hook handler located in [vsdatant.sys] wanarp.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF7774B3C hook handler located in [vsdatant.sys] wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF7774B28 hook handler located in [vsdatant.sys] wanarp.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xF7774C08 hook handler located in [unknown_code_page] !!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =) |
|
26.10.2007, 11:13
| #2 |
| | Habe ich ein Rootkit auf dem PC? mc afee rootkit scanner
__________________McAfee(R) Rootkit Detective 1.0 scan report On 26-10-2007 at 11:54:23 OS-Version 5.1.2600 Service Pack 2.0 ==================================== Object-Type: SSDT-hook Object-Name: ZwConnectPort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreatePort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateProcess Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateProcessEx Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateSection Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateThread Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwCreateWaitablePort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDeleteFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDeleteKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDeleteValueKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDuplicateObject Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwEnumerateKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwEnumerateValueKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwLoadKey2 Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwOpenFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwOpenKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwOpenProcess Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwOpenThread Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwQueryKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwQueryValueKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwRenameKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwReplaceKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwRequestWaitReplyPort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwRestoreKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwSecureConnectPort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwSetInformationFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwSetValueKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwTerminateProcess Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwWriteVirtualMemory Object-Path: (NULL) Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_SYSTEM_CONTROL Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_POWER Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_CLEANUP Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_SHUTDOWN Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_INTERNAL_DEVICE_CONTROL Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_DEVICE_CONTROL Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_FLUSH_BUFFERS Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_WRITE Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_READ Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_CREATE Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_CLEANUP Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_INTERNAL_DEVICE_CONTROL Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_DEVICE_CONTROL Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_CLOSE Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_CREATE Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Unable to access registry key Object-Type: Registry-key Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Unable to access registry key Object-Type: Registry-key Object-Name: 00000001ontrolSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Unable to access registry key Object-Type: Registry-key Object-Name: 0Jf40M\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Unable to access registry key Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Hidden Object-Type: Registry-value Object-Name: a0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-value Object-Name: p0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: s1 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: s2 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: g0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-key Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-key Object-Name: 00000001ontrolSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-key Object-Name: 0Jf40M\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Hidden Object-Type: Registry-key Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-key Object-Name: 00000001ontrolSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-key Object-Name: 0Jf40M\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Unable to access registry key Object-Type: Registry-key Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Unable to access registry key Object-Type: Registry-key Object-Name: 00000001ontrolSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Unable to access registry key Object-Type: Registry-key Object-Name: 0Jf40M\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Unable to access registry key Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Status: Hidden Object-Type: Registry-value Object-Name: a0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Status: Hidden Object-Type: Registry-value Object-Name: p0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: s1 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: s2 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: g0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-key Object-Name: DataEM\ControlSet001\Services\sptd\Cfg Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data Status: Hidden Object-Type: Registry-key Object-Name: a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771 System Provider\*Local Machine*\Data Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771 Status: Hidden Object-Type: Registry-key Object-Name: 00000000-0000-0000-0000-000000000000 System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771 Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000 Status: Hidden Object-Type: Registry-key Object-Name: {6340E680-FF06-435f-8767-B79D88AEBD4D}ystem Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000 Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000\{6340E680-FF06-435f-8767-B79D88AEBD4D} Status: Hidden Object-Type: Registry-value Object-Name: Item Data Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000\{6340E680-FF06-435f-8767-B79D88AEBD4D} Status: Hidden Object-Type: Registry-value Object-Name: Display String Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771\00000000-0000-0000-0000-000000000000 Status: Hidden Object-Type: Registry-value Object-Name: Display String Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771 Status: Hidden Object-Type: Registry-key Object-Name: Data 2RE\Microsoft\Protected Storage System Provider\*Local Machine*\Data\a5c5c2e4-6bee-4ef9-a0f5-f76a07cce771 Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2 Status: Hidden Object-Type: Registry-key Object-Name: WindowsE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2 Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2\Windows Status: Hidden Object-Type: Registry-value Object-Name: Value Object-Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Protected Storage System Provider\*Local Machine*\Data 2\Windows Status: Hidden Object-Type: Process Object-Name: services.exe Pid: 960 Object-Path: C:\WINDOWS\system32\services.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1332 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: ctfmon.exe Pid: 1580 Object-Path: C:\WINDOWS\system32\ctfmon.exe Status: Visible Object-Type: Process Object-Name: Eraser.exe Pid: 2448 Object-Path: C:\Program Files\Eraser\Eraser.exe Status: Visible Object-Type: Process Object-Name: alg.exe Pid: 1736 Object-Path: C:\WINDOWS\system32\alg.exe Status: Visible Object-Type: Process Object-Name: BTSTAC~1.EXE Pid: 2604 Object-Path: C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE Status: Visible Object-Type: Process Object-Name: hh.exe Pid: 620 Object-Path: C:\WINDOWS\hh.exe Status: Visible Object-Type: File/Folder Object-Name: System Idle Process Pid: n/a Object-Path: System Idle Process Status: Visible Object-Type: Process Object-Name: vsmon.exe Pid: 1396 Object-Path: C:\WINDOWS\system32\ZoneLabs\vsmon.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1180 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: Rootkit_Detective.exe Pid: 2916 Object-Path: C:\DOCUME~1\...\LOCALS~1\Temp\Rar$EX00.469\Rootkit_Detective.exe Status: Visible Object-Type: Process Object-Name: System Pid: 4 Object-Path: Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1120 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: explorer.exe Pid: 1556 Object-Path: C:\WINDOWS\explorer.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 812 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: wdfmgr.exe Pid: 844 Object-Path: C:\WINDOWS\system32\wdfmgr.exe Status: Visible Object-Type: Process Object-Name: AppleMobileDeviceService.exe Pid: 504 Object-Path: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe Status: Visible Object-Type: Process Object-Name: lsass.exe Pid: 972 Object-Path: C:\WINDOWS\system32\lsass.exe Status: Visible Object-Type: Process Object-Name: BTTray.exe Pid: 2492 Object-Path: C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe Status: Visible Object-Type: Process Object-Name: TeaTimer.exe Pid: 2432 Object-Path: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1224 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: iSaverCtrl.exe Pid: 2372 Object-Path: C:\Program Files\iSaver\iSaverCtrl.exe Status: Visible Object-Type: Process Object-Name: winlogon.exe Pid: 916 Object-Path: C:\WINDOWS\system32\winlogon.exe Status: Visible Object-Type: Process Object-Name: oodag.exe Pid: 700 Object-Path: C:\WINDOWS\system32\oodag.exe Status: Visible Object-Type: Process Object-Name: spoolsv.exe Pid: 1880 Object-Path: C:\WINDOWS\system32\spoolsv.exe Status: Visible Object-Type: Process Object-Name: btwdins.exe Pid: 516 Object-Path: C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe Status: Visible Object-Type: Process Object-Name: NBService.exe Pid: 640 Object-Path: C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe Status: Visible Object-Type: Process Object-Name: avgnt.exe Pid: 2252 Object-Path: C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe Status: Visible Object-Type: Process Object-Name: daemon.exe Pid: 2440 Object-Path: C:\Program Files\DAEMON Tools\daemon.exe Status: Visible Object-Type: Process Object-Name: firefox.exe Pid: 3184 Object-Path: C:\Program Files\Mozilla Firefox\firefox.exe Status: Visible Object-Type: Process Object-Name: fumoei.exe Pid: 2472 Object-Path: C:\Program Files\Free Download Manager\FUM\fumoei.exe Status: Visible Object-Type: Process Object-Name: csrss.exe Pid: 892 Object-Path: C:\WINDOWS\system32\csrss.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1264 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: avguard.exe Pid: 1916 Object-Path: C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe Status: Visible Object-Type: Process Object-Name: nvsvc32.exe Pid: 676 Object-Path: C:\WINDOWS\system32\nvsvc32.exe Status: Visible Object-Type: Process Object-Name: smss.exe Pid: 740 Object-Path: C:\WINDOWS\system32\smss.exe Status: Visible Object-Type: Process Object-Name: sched.exe Pid: 492 Object-Path: C:\Program Files\AntiVir PersonalEdition Classic\sched.exe Status: Visible Object-Type: Process Object-Name: d2ltlFyCK4.exe Pid: 1360 Object-Path: Status: Visible Object-Type: Process Object-Name: zlclient.exe Pid: 2260 Object-Path: C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe Status: Visible Object-Type: Process Object-Name: jusched.exe Pid: 2292 Object-Path: C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe Status: Visible Scan complete. Hidden registry keys/values: 42 |
|
26.10.2007, 11:51
| #3 |
| /// AVZ-Toolkit Guru   | Habe ich ein Rootkit auf dem PC? Halli hallo.
__________________Deine Probleme hören sich eher nach ZoneAlarm Zicken an.. Führe mal bitte folgende Scans durch: -Combofix. Poste den erscheinenden Text. -Silentrunners poste das logFile ebenfalls..
__________________ |
|
26.10.2007, 12:03
| #4 |
| | Habe ich ein Rootkit auf dem PC? ComboFix 07-10-23.2 - username 2007-10-26 12:59:20.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.544 [GMT 2:00] Running from: C:\Documents and Settings\username\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 ))))))))))))))))))))))))))))))) . 2007-10-26 12:57 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-26 12:00 <DIR> d-------- C:\Program Files\Lavasoft 2007-10-26 11:51 6,656 C:\WINDOWS\system32\C3BF9422.exe 2007-10-26 11:50 <DIR> d-------- C:\RkUnhooker 2007-10-24 22:40 <DIR> d-------- C:\Program Files\Runtime Software 2007-10-24 15:30 <DIR> d-------- C:\WINDOWS\system32\Lang 2007-10-24 15:22 765,952 --a------ C:\WINDOWS\system\crlds3d.dll 2007-10-24 15:22 65,536 --a------ C:\WINDOWS\system32\Audio3D.dll 2007-10-22 14:37 87,040 --a------ C:\WINDOWS\system32\wiafbdrv.dll 2007-10-22 14:37 87,040 --a--c--- C:\WINDOWS\system32\dllcache\wiafbdrv.dll 2007-10-22 14:37 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-10-22 14:37 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2007-10-22 14:34 57,856 -ra------ C:\WINDOWS\system32\gl.dll 2007-10-22 14:34 36,864 -ra------ C:\WINDOWS\system32\Vizmicro.dll 2007-10-22 14:34 26,112 -ra------ C:\WINDOWS\RunUnDrv.exe 2007-10-13 19:23 <DIR> d-------- C:\Program Files\ABIT 2007-10-11 20:37 <DIR> d-------- C:\Documents and Settings\username\Application Data\dvdcss 2007-10-11 18:02 <DIR> d-------- C:\Program Files\ASUS 2007-10-11 13:04 <DIR> d-------- C:\WINDOWS\system32\oodag 2007-10-11 13:02 <DIR> d-------- C:\Program Files\OO Software 2007-10-10 12:57 <DIR> dr-h----- C:\Documents and Settings\username\Application Data\SecuROM 2007-10-10 12:57 <DIR> d-------- C:\Documents and Settings\username\Application Data\Bioshock 2007-10-10 10:39 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-10-09 12:19 <DIR> d-------- C:\Program Files\Playlogic 2007-10-07 19:32 <DIR> d-------- C:\Program Files\Audacity 2007-10-06 18:48 <DIR> d-------- C:\Program Files\Saitek 2007-10-06 18:48 1,024,000 --a------ C:\WINDOWS\system32\ImmCpl.dll 2007-10-06 18:48 192,512 --a------ C:\WINDOWS\system32\IFC22.dll 2007-10-06 18:48 98,304 --a------ C:\WINDOWS\system32\ImmPID.dll 2007-10-06 18:48 29,372 --a------ C:\WINDOWS\system32\drivers\ImHidUsb.sys 2007-10-06 18:48 20,480 --a------ C:\WINDOWS\system32\imm_ger.dll 2007-10-06 11:17 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-02 21:27 <DIR> d-------- C:\Program Files\Combined Community Codec Pack 2007-10-02 21:25 <DIR> d-------- C:\Documents and Settings\username\Application Data\Media Player Classic 2007-10-02 10:29 <DIR> d-------- C:\STROKES 2007-09-30 10:09 <DIR> d-------- C:\Program Files\Common Files\SWF Studio 2007-09-28 15:57 <DIR> d-------- C:\Documents and Settings\username\Application Data\Nero 2007-09-28 15:53 <DIR> d-------- C:\Program Files\Nero 2007-09-28 15:53 <DIR> d-------- C:\Program Files\Common Files\Nero . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-26 10:00 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-10-25 22:28 --------- d-----w C:\Documents and Settings\username\Application Data\Azureus 2007-10-24 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-23 22:41 --------- d-----w C:\Program Files\SFT Loader 2007-10-21 13:30 --------- d-----w C:\Documents and Settings\username\Application Data\OpenOffice.org2 2007-10-19 09:55 --------- d-----w C:\Program Files\Biet-O-Matic 2007-10-09 08:36 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-09 08:34 --------- d-----w C:\Program Files\Mafia 2007-09-29 08:47 --------- d-----w C:\Documents and Settings\username\Application Data\Free Download Manager 2007-09-26 16:25 11,376 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-17 17:41 --------- d-----w C:\Program Files\Creative 2007-09-17 07:54 --------- d-----w C:\Program Files\Windows Desktop Search 2007-09-11 15:47 --------- d-----w C:\Program Files\Canon 2007-09-11 14:41 --------- d--h--w C:\Program Files\CanonBJ 2007-09-09 10:44 --------- d-----w C:\Documents and Settings\username\Application Data\SMA 2007-09-09 10:23 --------- d-----w C:\Program Files\SMA 2007-09-08 13:10 --------- d-----w C:\Program Files\iTunes 2007-09-08 13:09 --------- d-----w C:\Program Files\iPod 2007-09-06 18:56 --------- d-----w C:\Documents and Settings\username\Application Data\Apple Computer 2007-09-05 19:10 --------- d-----w C:\Program Files\Azureus 2007-09-04 20:14 --------- d-----w C:\Program Files\QuickTime 2007-09-04 20:14 --------- d-----w C:\Program Files\Apple Software Update 2007-09-04 20:13 --------- d-----w C:\Program Files\Common Files\Apple 2007-08-30 21:09 --------- d-----w C:\Program Files\Free Download Manager 2007-08-28 11:19 --------- d-----w C:\Program Files\iSaver 2007-08-28 11:18 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-08-27 04:29 348,160 ----a-w C:\WINDOWS\system32\MSVCR71.dll 2007-08-27 04:25 --------- d-----w C:\Program Files\Java 2007-08-27 04:25 --------- d-----w C:\Program Files\Common Files\Java 2007-08-26 21:26 --------- d-----w C:\Program Files\Eraser 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-04 08:40 972,072 ----a-w C:\WINDOWS\UNRecode.exe 2007-08-04 08:10 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll 2007-08-03 10:52 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe 2007-07-31 02:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-31 02:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-31 02:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-31 02:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-31 02:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-31 02:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-31 02:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-31 02:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-28 21:05 640,336 ----a-w C:\WINDOWS\system32\Eraser.dll 2007-07-28 21:05 292,176 ----a-w C:\WINDOWS\system32\Erasext.dll 2007-07-28 21:05 112,976 ----a-w C:\WINDOWS\system32\Eraserl.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 10:00] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-10 22:25] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-22 06:54] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-06-29 09:43] "nwiz"="nwiz.exe" [2007-06-29 09:43 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-06-29 09:43] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-15 03:32] "iSaverCtrl"="C:\Program Files\iSaver\iSaverCtrl.exe" [2006-11-16 08:18] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57] "SAITEKAUTOCONFIGURE"="C:\Program Files\Saitek\ST\Drv\saicnfig.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Jet Detection"="C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [2001-04-20 23:52] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 10:04] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24] "Eraser"="C:\Program Files\Eraser\Eraser.exe" [2007-07-28 23:05] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56] "Free Uploader Oe Integration"="C:\Program Files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 19:02] R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\DRIVERS\avgntmgr.sys R0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys R0 viasraid;viasraid;C:\WINDOWS\system32\drivers\viasraid.sys R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe R3 emu10kx;Creative EMU10K1/EMU10K2 Audio Driver (WDM);C:\WINDOWS\system32\drivers\e10kx2k.sys R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\getnd5b.sys S3 SMA_USBBus;SMA USB Serial Converter;C:\WINDOWS\system32\DRIVERS\FTD2XX.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L] AutoRun\command - L:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b19737ec-6cf9-11dc-bc3b-0009dd21c943}] AutoRun\command - L:\LaunchU3.exe -a *Newly Created Service* - 0DCF *Newly Created Service* - AAWSERVICE *Newly Created Service* - CATCHME *Newly Created Service* - RKHDRV40 *Newly Created Service* - RKREVEAL150 . Contents of the 'Scheduled Tasks' folder "2007-09-04 20:14:09 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-26 13:01:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-26 13:01:59 . --- E O F --- |
|
26.10.2007, 12:05
| #5 |
| | Habe ich ein Rootkit auf dem PC? "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Jet Detection" = "C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [empty string] "SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "Eraser" = "C:\Program Files\Eraser\Eraser.exe -hide" ["Heidi Computers Ltd"] "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Free Uploader Oe Integration" = "C:\Program Files\Free Download Manager\FUM\fumoei.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "UpdReg" = "C:\WINDOWS\Updreg.exe" ["Creative Technology Ltd."] "avgnt" = ""C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] "ZoneAlarm Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"" ["Sun Microsystems, Inc."] "iSaverCtrl" = "C:\Program Files\iSaver\iSaverCtrl.exe --startup" ["infoMantis GmbH"] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Inc."] "NeroFilterCheck" = "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" ["Nero AG"] "SAITEKAUTOCONFIGURE" = "C:\Program Files\Saitek\ST\Drv\saicnfig.exe /autorun" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided) -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension" -> {HKLM...CLSID} = "Display Panning CPL Extension" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" = "Multiscan" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Eigene Telefone" -> {HKLM...CLSID} = "Eigene Telefone" \InProcServer32\(Default) = "C:\Program Files\Sony Ericsson\Mobile\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"] "{7842554E-6BED-11D2-8CDB-B05550C10000}" = "Monitor" -> {HKLM...CLSID} = "Monitor Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\btncopy.dll" ["Broadcom Corporation."] "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper" -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS] "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"OODBS" ["O&O Software GmbH"]|"lsdelete" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] Erasext\(Default) = "{8BE13461-936F-11D1-A87D-444553540000}" -> {HKLM...CLSID} = "Eraser Shell Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\erasext.dll" ["-"] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Erasext\(Default) = "{8BE13461-936F-11D1-A87D-444553540000}" -> {HKLM...CLSID} = "Eraser Shell Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\erasext.dll" ["-"] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ FdmUplShlExt\(Default) = "{F49C55B9-D417-45A1-A6E7-D6E057946280}" -> {HKLM...CLSID} = "FdmUplShlExt Class" \InProcServer32\(Default) = "C:\Program Files\Free Download Manager\FUM\fumshext.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Bliss.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\username\Application Data\Mozilla\Firefox\Desktop Hintergrund.bmp" Startup items in "username" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Start Menu\Programs\Startup "BTTray" -> shortcut to: "C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe" ["Broadcom Corporation."] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{03C1C47F-0538-4645-8372-D3109B9FC636}\(Default) = "Easy-WebPrint" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Canon\Easy-WebPrint\Toolband.dll" [null data] HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Recherchieren" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {0E921E80-267A-42AA-AEE4-60B9A1222A44}\ "ButtonText" = "Klicke hier um das Projekt xp-AntiSpy zu unterstützen" "MenuText" = "Unterstützung für xp-AntiSpy" "Exec" = "C:\Program Files\xp-AntiSpy\sponsoring\sponsor.html" [null data] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Konsole" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."] {2670000A-7350-4F3C-8081-5663EE0C6C49}\ "ButtonText" = "An OneNote senden" "MenuText" = "An OneNote s&enden" "CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}" -> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {CCA281CA-C863-46EF-9331-5C8D4460577F}\ "ButtonText" = "@btrez.dll,-4015" "MenuText" = "@btrez.dll,-4017" "Script" = "C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm" [null data] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1}\ "ButtonText" = "Upload" "CLSIDExtension" = "{FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1}" -> {HKLM...CLSID} = "FDMUploadBtnForIe Class" \InProcServer32\(Default) = "C:\Program Files\Free Download Manager\FUM\fumiebtn.dll" [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ad-Aware 2007 Service, aawservice, ""C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"" ["Lavasoft AB"] AntiVir PersonalEdition Classic Guard, AntiVirService, ""C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"] AntiVir PersonalEdition Classic Planer, AntiVirScheduler, ""C:\Program Files\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"] Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple, Inc."] Bluetooth Service, btwdins, "C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe" ["Broadcom Corporation."] Nero BackItUp Scheduler 3, Nero BackItUp Scheduler 3, "C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe" ["Nero AG"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] O&O Defrag, O&O Defrag, "C:\WINDOWS\system32\oodag.exe" ["O&O Software GmbH"] TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Bluetooth-Druckeranschluss\Driver = "bthcrp.dll" ["Broadcom Corporation."] Canon BJ Language Monitor iP5300\Driver = "CNMLM89.DLL" ["CANON INC."] Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS] ---------- (launch time: 2007-10-26 13:04:08) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 41 seconds, including 14 seconds for message boxes) |
|
26.10.2007, 12:52
| #6 |
| /// AVZ-Toolkit Guru | Habe ich ein Rootkit auf dem PC? Deine logs sehen absolut sauber aus. Warum befürchtest du eine Infizierung?
__________________ --> Habe ich ein Rootkit auf dem PC? |
|
26.10.2007, 13:27
| #7 |
| | Habe ich ein Rootkit auf dem PC? naja weil das system ohne dass ich was installiert habe seit etwa einem tag völlig unsicher läuft, bei manchen programmstarts einfach neu bootet und ich öfters mal ne meldung haben "buffer overrun" |
|
26.10.2007, 14:49
| #8 |
| /// AVZ-Toolkit Guru | Habe ich ein Rootkit auf dem PC? Hast du schon versucht ob es an einem früheren Systemwiederherstellungspunkt das Gleiche ist?
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
26.10.2007, 15:06
| #9 |
| | Habe ich ein Rootkit auf dem PC? kann ich dir leider nicht sagen, hab vergessen wo man den einstellen kann  aber ich glaub man kann doch eh nur den letzten wiederherstellen und heute wurde von einem tool schon ein Systemwiederherstellungspunkt gesetzt... |
|
26.10.2007, 15:41
| #10 |
| /// AVZ-Toolkit Guru | Habe ich ein Rootkit auf dem PC? Start->Programme->Zubehör->Systemprogramme->Systemwiederherstellung. Und nein, man kann auch ältere Punkte laden.
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
27.10.2007, 13:50
| #11 |
| | Habe ich ein Rootkit auf dem PC? hm ich habs gefühl irgend ne hardware wie pci, ram oder hdd geht kaputt. das problem tritt immer öfters auf... ich werde jetzt ram und hdds checken(ist glaub ne hdd von01  ) |
|
| Themen zu Habe ich ein Rootkit auf dem PC? |
| adobe, antivir, avira, bho, browser, buffer overrun, desktop, eraser, firefox, free download, ftp, geht aus, gservice, hijack, hijack this, hijackthis, hängt, internet, internet explorer, monitor, mozilla, mozilla firefox, problem, rootkit, rundll, senden, server, software, windows, windows xp |
Linear-Darstellung
