Rootkit.Win32.Agent.p

Das Perd mit dem Virus

Und hir die zweite Sache.

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Symbol search path is: SRV*<C:\Symbols>*http://msdl.microsoft.com/download/symbols
Executable search path is:
*******************************************************************************
WARNING: Local kernel debugging requires booting with kernel
debugging support (/debug or bcdedit -debug on) to work optimally.
*******************************************************************************
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Sun Nov 18 18:51:10.156 2007 (GMT+1)
System Uptime: 0 days 0:28:57.734
lkd> !chkimg -d nt
804e2724-804e2727 4 bytes - nt!KiServiceTable+7c
[ 00 a8 58 80:b0 fe 0a f6 ]
804e273c-804e273f 4 bytes - nt!KiServiceTable+94 (+0x18)
[ f8 fb 56 80:70 c8 0a f6 ]
804e274c-804e274f 4 bytes - nt!KiServiceTable+a4 (+0x10)
[ a9 e7 56 80:00 77 0b f6 ]
804e2760-804e276b 12 bytes - nt!KiServiceTable+b8 (+0x14)
[ e1 74 59 80 a4 0a 5b 80:70 02 0b f6 00 65 0b f6 ]
804e2770-804e2773 4 bytes - nt!KiServiceTable+c8 (+0x10)
[ 1b 46 56 80:90 a0 0b f6 ]
804e277c-804e277f 4 bytes - nt!KiServiceTable+d4 (+0x0c)
[ a1 c4 57 80:fc 64 db f7 ]
804e2788-804e278b 4 bytes - nt!KiServiceTable+e0 (+0x0c)
[ ea 24 5a 80:50 03 0b f6 ]
804e27a0-804e27a7 8 bytes - nt!KiServiceTable+f8 (+0x18)
[ 97 73 5d 80 36 51 59 80:f0 ce 0a f6 20 87 0b f6 ]
804e27ac-804e27af 4 bytes - nt!KiServiceTable+104 (+0x0c)
[ ac 3a 59 80:60 83 0b f6 ]
804e27b8-804e27bb 4 bytes - nt!KiServiceTable+110 (+0x0c)
[ 26 2b 57 80:70 62 0b f6 ]
804e2830-804e2833 4 bytes - nt!KiServiceTable+188 (+0x78)
[ 80 e4 5a 80:60 8a 0b f6 ]
804e2878-804e287b 4 bytes - nt!KiServiceTable+1d0 (+0x48)
[ 93 fb 56 80:40 cd 0a f6 ]
804e2890-804e2893 4 bytes - nt!KiServiceTable+1e8 (+0x18)
[ 06 2d 57 80:e8 64 db f7 ]
804e28a8-804e28ab 4 bytes - nt!KiServiceTable+200 (+0x18)
[ 06 c8 58 80:ed 64 db f7 ]
804e29a8-804e29af 8 bytes - nt!KiServiceTable+300 (+0x100)
[ 29 d0 64 80 1e d5 64 80:d0 91 0b f6 50 8d 0b f6 ]
804e29c8-804e29cb 4 bytes - nt!KiServiceTable+320 (+0x20)
[ 2a 5f 57 80:50 fb 0a f6 ]
804e29d8-804e29db 4 bytes - nt!KiServiceTable+330 (+0x10)
[ 42 c0 64 80:00 90 0b f6 ]
804e29f0-804e29f3 4 bytes - nt!KiServiceTable+348 (+0x18)
[ ee e9 57 80:60 00 0b f6 ]
804e2a28-804e2a2b 4 bytes - nt!KiServiceTable+380 (+0x38)
[ 9c 6e 57 80:60 d0 0a f6 ]
804e2a84-804e2a87 4 bytes - nt!KiServiceTable+3dc (+0x5c)
[ 8d 3c 57 80:d7 7e 0b f6 ]
804e2aac-804e2aaf 4 bytes - nt!KiServiceTable+404 (+0x28)
[ 40 47 58 80:f7 64 db f7 ]
804e2afc-804e2aff 4 bytes - nt!KiServiceTable+454 (+0x50)
[ 97 a6 57 80:f2 64 db f7 ]
104 errors : nt (804e2724-804e2aff)
lkd> lmfk
start end module name
804d7000 806ebe00 nt ntoskrnl.exe

Unloaded modules:
f0a0e000 f0a39000 kmixer.sys
f0b73000 f0b9e000 kmixer.sys
f140d000 f1438000 kmixer.sys
f7d64000 f7d65000 drmkaud.sys
f15b8000 f15c5000 DMusic.sys
f15c8000 f15d6000 swmidi.sys
f1438000 f145b000 aec.sys
f7bc7000 f7bc9000 splitter.sys
f785f000 f786c000 ATITool.sys
f782f000 f7839000 processr.sys
f7967000 f796c000 Cdaudio.SYS
f7471000 f7474000 Sfloppy.SYS