21.02.2009, 15:58
|
#31 |
| |  Einstellungen lassen sich nciht mehr ändern, div. webseiten lassen sich nicht öffnen
 Hier dann die aktuellen Logs vom PC. Zitat:
GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-21 15:51:55
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.14 ----
SSDT spqo.sys ZwCreateKey [0xF72870E0]
SSDT spqo.sys ZwEnumerateKey [0xF72A5CA2]
SSDT spqo.sys ZwEnumerateValueKey [0xF72A6030]
SSDT spqo.sys ZwOpenKey [0xF72870C0]
SSDT spqo.sys ZwQueryKey [0xF72A6108]
SSDT spqo.sys ZwQueryValueKey [0xF72A5F88]
SSDT spqo.sys ZwSetValueKey [0xF72A619A]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAE6D7F20]
INT 0x62 ? 8A3C9BF8
INT 0x63 ? 8A3C9BF8
INT 0x73 ? 8A3C9BF8
INT 0x82 ? 8A3C9BF8
INT 0xA4 ? 8A439BF8
INT 0xB4 ? 8A439BF8
---- Kernel code sections - GMER 1.0.14 ----
? dkmhj.sys Das System kann die angegebene Datei nicht finden. !
? spqo.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F601F8AC 5 Bytes JMP 8A4391D8
.text aff56qoe.SYS F5410386 35 Bytes [ 00, 00, 00, 00, 00, 00, 20, ... ]
.text aff56qoe.SYS F54103AA 24 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text aff56qoe.SYS F54103C4 3 Bytes [ 00, 70, 02 ]
.text aff56qoe.SYS F54103C9 1 Byte [ 2E ]
.text aff56qoe.SYS F54103CB 9 Bytes [ 00, 00, 5C, 02, 00, 00, 00, ... ]
.text ...
---- Kernel IAT/EAT - GMER 1.0.14 ----
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfAcquireSpinLock] 4B8BDF8B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_UCHAR] 8D3F0304
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KeGetCurrentIrql] CB033043
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfRaiseIrql] 0673C13B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfLowerIrql] C13B0003
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!HalGetInterruptVector] 8366FA72
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!HalTranslateBusAddress] 75000E7B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KeStallExecutionProcessor] 0B7D80E3
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfReleaseSpinLock] 307B8D00
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 00AA840F
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 6A000E7A
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!WRITE_PORT_UCHAR] C6647400
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[WMILIB.SYS!WmiSystemControl] 4F8B0200
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[WMILIB.SYS!WmiCompleteRequest] 968D5140
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7298048] spqo.sys
---- Devices - GMER 1.0.14 ----
Device \FileSystem\Ntfs \Ntfs 8A3C81F8
Device \FileSystem\Fastfat \FatCdrom 89CD6500
Device \FileSystem\Udfs \UdfsCdRom 89D45500
Device \FileSystem\Udfs \UdfsDisk 89D45500
Device \Driver\sptd \Device\4210415302 spqo.sys
Device \Driver\usbohci \Device\USBPDO-0 8A1B21F8
Device \Driver\usbehci \Device\USBPDO-1 8A1B11F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{325DA82C-A080-47FD-9DFD-9070D80C9EF2} 88FAE1F8
Device \Driver\prodrv06 \Device\ProDrv06 E1D78C30
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3CA1F8
Device \Driver\nvatabus \Device\00000071 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3CA1F8
Device \Driver\Cdrom \Device\CdRom0 8A173500
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3CA1F8
Device \Driver\Cdrom \Device\CdRom1 8A173500
Device \Driver\prohlp02 \Device\ProHlp02 E1017398
Device \Driver\NetBT \Device\NetBt_Wins_Export 88FAE1F8
Device \Driver\NetBT \Device\NetbiosSmb 88FAE1F8
Device \Driver\usbstor \Device\00000079 89D17500
Device \Driver\usbstor \Device\00000079 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\PCI_PNP0302 \Device\0000004f spqo.sys
Device \Driver\usbohci \Device\USBFDO-0 8A1B21F8
Device \Driver\nvatabus \Device\0000006d prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbehci \Device\USBFDO-1 8A1B11F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89CFA1F8
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\0000006e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007b 89D17500
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89CFA1F8
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007c 89D17500
Device \Driver\usbstor \Device\0000007c sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\Ftdisk \Device\FtControl 8A3CA1F8
Device \Driver\usbstor \Device\0000007d 89D17500
Device \Driver\usbstor \Device\0000007d sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007e 89D17500
Device \Driver\usbstor \Device\0000007e sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007f 89D17500
Device \Driver\usbstor \Device\0000007f sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1Port3Path0Target0Lun0 89D931F8
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1Port3Path0Target0Lun0 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1 89D931F8
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\Fastfat \Fat 89CD6500
Device \FileSystem\Cdfs \Cdfs 89C06500
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 11481
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@DisplayName Shell Support
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Type 32
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Start 2
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Description Speichert Sicherheitsinformationen f?r lokale Benutzerkonten.
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf\Parameters
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf\Parameters@ServiceDll C:\WINDOWS\system32\hxiiuhx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
---- EOF - GMER 1.0.14 ----
|
|
Baum-Darstellung