| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Hilfe! Trojaner TR/Crypt.XPACK.Gen und TR/Dropper.GenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
01.08.2009, 10:39
| #1 |
 |  Hilfe! Trojaner TR/Crypt.XPACK.Gen und TR/Dropper.Gen ...weiter gehts: Code:
ATTFilter Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [164] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [200] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [468] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [696] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [740] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [752] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [908] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Canon\CAL\CALMAIN.exe [1020] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1036] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1148] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1208] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1344] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [1384] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1420] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\wbem\wmiprvse.exe [1692] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\spoolsv.exe [1704] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1956] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe [1984] 0x006A0000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\AntiVir PersonalEdition Classic\sched.exe [2020] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\AntiVir PersonalEdition Classic\avguard.exe [2032] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\iPod\bin\iPodService.exe [2168] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\Ati2evxx.exe [2572] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [2716] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\ATI Technologies\ATI.ACE\cli.exe [2924] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Synaptics\SynTP\SynTPEnh.exe [2932] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\RTHDCPL.EXE [2940] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\sm56hlpr.exe [2956] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\CyberLink\PowerDVD\PDVDServ.exe [2972] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe [2980] 0x009C0000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Java\jre1.6.0_01\bin\jusched.exe [3072] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\HP\HP Software Update\HPWuSchd2.exe [3136] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Mozilla Firefox\firefox.exe [3228] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\iTunes\iTunesHelper.exe [3240] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\FreePDF_XP\fpassist.exe [3276] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe [3292] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [3340] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\ctfmon.exe [3376] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\HP\Digital Imaging\bin\hpqimzone.exe [3796] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Programme\ATI Technologies\ATI.ACE\cli.exe [3844] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\Dokumente und Einstellungen\Iche\Desktop\8ztsnwlc.exe [3932] 0x10000000
Library \\?\globalroot\systemroot\system32\kungsfhkanjywe.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [4676] 0x10000000
---- Services - GMER 1.0.15 ----
Service C:\WINDOWS\system32\drivers\kungsfymjbmsos.sys (*** hidden *** ) [SYSTEM] kungsfawmgljyu <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu@imagepath \systemroot\system32\drivers\kungsfymjbmsos.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main@aid 10099
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main@sid 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main@cmddelay 14400
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main\injector@* kungsfwsp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\modules@kungsfrk.sys \systemroot\system32\drivers\kungsfymjbmsos.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\modules@kungsfcmd.dll \systemroot\system32\kungsftetvvvab.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\modules@kungsflog.dat \systemroot\system32\kungsfnvxmlqvu.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\modules@kungsfwsp.dll \systemroot\system32\kungsfhkanjywe.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\kungsfawmgljyu\modules@kungsf.dat \systemroot\system32\kungsfcmiutkuh.dat
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu@imagepath \systemroot\system32\drivers\kungsfymjbmsos.sys
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main@aid 10099
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main@sid 0
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main\injector@* kungsfwsp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\modules@kungsfrk.sys \systemroot\system32\drivers\kungsfymjbmsos.sys
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\modules@kungsfcmd.dll \systemroot\system32\kungsftetvvvab.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\modules@kungsflog.dat \systemroot\system32\kungsfnvxmlqvu.dat
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\modules@kungsfwsp.dll \systemroot\system32\kungsfhkanjywe.dll
Reg HKLM\SYSTEM\ControlSet003\Services\kungsfawmgljyu\modules@kungsf.dat \systemroot\system32\kungsfcmiutkuh.dat
|
|
01.08.2009, 10:41
| #2 |
| | Hilfe! Trojaner TR/Crypt.XPACK.Gen und TR/Dropper.Gen Und noch das RootRepeal-Logfile. (Gab für Drivers, Stealth Objects und Hidden Services je eins extra):
__________________Code:
ATTFilter ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/08/01 10:58
Program Version: Version 1.3.3.0
Windows Version: Windows XP SP2
==================================================
Stealth Objects
-------------------
Object: Hidden Module [Name: kungsftetvvvab.dll]
Process: svchost.exe (PID: 936) Address: 0x00660000 Size: 53248
Object: Hidden Module [Name: kungsfhkanjywe.dll]
Process: svchost.exe (PID: 936) Address: 0x10000000 Size: 28672
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/08/01 10:58
Program Version: Version 1.3.3.0
Windows Version: Windows XP SP2
==================================================
Hidden Services
-------------------
Service Name: kungsfawmgljyu
Image PathC:\WINDOWS\system32\drivers\kungsfymjbmsos.sys
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/08/01 10:58
Program Version: Version 1.3.3.0
Windows Version: Windows XP SP2
==================================================
Drivers
-------------------
Name: 1394BUS.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS
Address: 0xF7632000 Size: 53248 File Visible: - Signed: -
Status: -
Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xF74E2000 Size: 188800 File Visible: - Signed: -
Status: -
Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000 Size: 2146304 File Visible: - Signed: -
Status: -
Name: ACPIEC.sys
Image Path: ACPIEC.sys
Address: 0xF7A2E000 Size: 12160 File Visible: - Signed: -
Status: -
Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xAF83B000 Size: 138368 File Visible: - Signed: -
Status: -
Name: atapi.sys
Image Path: atapi.sys
Address: 0xF749A000 Size: 95360 File Visible: - Signed: -
Status: -
Name: ati2cqag.dll
Image Path: C:\WINDOWS\System32\ati2cqag.dll
Address: 0xBFA17000 Size: 237568 File Visible: - Signed: -
Status: -
Name: ati2dvag.dll
Image Path: C:\WINDOWS\System32\ati2dvag.dll
Address: 0xBF9D5000 Size: 270336 File Visible: - Signed: -
Status: -
Name: ati2mtag.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
Address: 0xF6059000 Size: 1470464 File Visible: - Signed: -
Status: -
Name: ati3duag.dll
Image Path: C:\WINDOWS\System32\ati3duag.dll
Address: 0xBFA87000 Size: 2519040 File Visible: - Signed: -
Status: -
Name: atikvmag.dll
Image Path: C:\WINDOWS\System32\atikvmag.dll
Address: 0xBFA51000 Size: 221184 File Visible: - Signed: -
Status: -
Name: ativvaxx.dll
Image Path: C:\WINDOWS\System32\ativvaxx.dll
Address: 0xBFCEE000 Size: 1105920 File Visible: - Signed: -
Status: -
Name: atksgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\atksgt.sys
Address: 0xAD560000 Size: 271360 File Visible: - Signed: -
Status: -
Name: audstub.sys
Image Path: C:\WINDOWS\system32\DRIVERS\audstub.sys
Address: 0xF7D24000 Size: 3072 File Visible: - Signed: -
Status: -
Name: avgio.sys
Image Path: C:\Programme\AntiVir PersonalEdition Classic\avgio.sys
Address: 0xB0796000 Size: 6144 File Visible: - Signed: -
Status: -
Name: avgntflt.sys
Image Path: C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys
Address: 0xAD482000 Size: 81920 File Visible: - Signed: -
Status: -
Name: avipbb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys
Address: 0xAF790000 Size: 69632 File Visible: - Signed: -
Status: -
Name: BATTC.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\BATTC.SYS
Address: 0xF7A2A000 Size: 16384 File Visible: - Signed: -
Status: -
Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xF7BC4000 Size: 4224 File Visible: - Signed: -
Status: -
Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xF7A22000 Size: 12288 File Visible: - Signed: -
Status: -
Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xACE75000 Size: 63744 File Visible: - Signed: -
Status: -
Name: cdrom.sys
Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys
Address: 0xF7712000 Size: 49536 File Visible: - Signed: -
Status: -
Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\system32\drivers\CLASSPNP.SYS
Address: 0xF7662000 Size: 53248 File Visible: - Signed: -
Status: -
Name: CmBatt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\CmBatt.sys
Address: 0xF7ADA000 Size: 14080 File Visible: - Signed: -
Status: -
Name: compbatt.sys
Image Path: compbatt.sys
Address: 0xF7A26000 Size: 9344 File Visible: - Signed: -
Status: -
Name: disk.sys
Image Path: disk.sys
Address: 0xF7672000 Size: 36352 File Visible: - Signed: -
Status: -
Name: drmk.sys
Image Path: C:\WINDOWS\system32\drivers\drmk.sys
Address: 0xF77B2000 Size: 61440 File Visible: - Signed: -
Status: -
Name: dump_iaStor.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys
Address: 0xAF697000 Size: 876544 File Visible: No Signed: -
Status: -
Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xB00BC000 Size: 12288 File Visible: - Signed: -
Status: -
Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF9C3000 Size: 73728 File Visible: - Signed: -
Status: -
Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xF7D0B000 Size: 4096 File Visible: - Signed: -
Status: -
Name: Fastfat.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fastfat.SYS
Address: 0xAF76D000 Size: 143360 File Visible: - Signed: -
Status: -
Name: Fips.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS
Address: 0xB083E000 Size: 35072 File Visible: - Signed: -
Status: -
Name: fltMgr.sys
Image Path: fltMgr.sys
Address: 0xF734B000 Size: 128896 File Visible: - Signed: -
Status: -
Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xF7BC2000 Size: 7936 File Visible: - Signed: -
Status: -
Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xF74B2000 Size: 126336 File Visible: - Signed: -
Status: -
Name: GEARAspiWDM.sys
Image Path: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys
Address: 0xF61E4000 Size: 9984 File Visible: - Signed: -
Status: -
Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x806E3000 Size: 134272 File Visible: - Signed: -
Status: -
Name: HDAudBus.sys
Image Path: C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
Address: 0xF6020000 Size: 151552 File Visible: - Signed: -
Status: -
Name: HIDCLASS.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS
Address: 0xB7000000 Size: 36864 File Visible: - Signed: -
Status: -
Name: HIDPARSE.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS
Address: 0xB7105000 Size: 28672 File Visible: - Signed: -
Status: -
Name: hidusb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\hidusb.sys
Address: 0xEB020000 Size: 9600 File Visible: - Signed: -
Status: -
Name: HTTP.sys
Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys
Address: 0xACD4C000 Size: 262784 File Visible: - Signed: -
Status: -
Name: i8042prt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\i8042prt.sys
Address: 0xF76F2000 Size: 53248 File Visible: - Signed: -
Status: -
Name: iaStor.sys
Image Path: iaStor.sys
Address: 0xF73C4000 Size: 874240 File Visible: - Signed: -
Status: -
Name: imapi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys
Address: 0xF7702000 Size: 41856 File Visible: - Signed: -
Status: -
Name: intelide.sys
Image Path: intelide.sys
Address: 0xF7B16000 Size: 5504 File Visible: - Signed: -
Status: -
Name: intelppm.sys
Image Path: C:\WINDOWS\system32\DRIVERS\intelppm.sys
Address: 0xF76E2000 Size: 40192 File Visible: - Signed: -
Status: -
Name: ipnat.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys
Address: 0xAF867000 Size: 134912 File Visible: - Signed: -
Status: -
Name: ipsec.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys
Address: 0xB6018000 Size: 74752 File Visible: - Signed: -
Status: -
Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xF7612000 Size: 36224 File Visible: - Signed: -
Status: -
Name: kbdclass.sys
Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys
Address: 0xF79B2000 Size: 25216 File Visible: - Signed: -
Status: -
Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xF7B12000 Size: 8192 File Visible: - Signed: -
Status: -
Name: klif.sys
Image Path: C:\WINDOWS\system32\DRIVERS\klif.sys
Address: 0xEC48E000 Size: 143360 File Visible: - Signed: -
Status: -
Name: kmixer.sys
Image Path: C:\WINDOWS\system32\drivers\kmixer.sys
Address: 0xA9C68000 Size: 172416 File Visible: - Signed: -
Status: -
Name: ks.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys
Address: 0xF5F97000 Size: 143360 File Visible: - Signed: -
Status: -
Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xF7322000 Size: 92032 File Visible: - Signed: -
Status: -
Name: kungsfymjbmsos.sys
Image Path: C:\WINDOWS\system32\drivers\kungsfymjbmsos.sys
Address: 0xB602B000 Size: 163840 File Visible: - Signed: -
Status: Hidden from the Windows API!
Name: Lbd.sys
Image Path: Lbd.sys
Address: 0xF7682000 Size: 57472 File Visible: - Signed: -
Status: -
|
|
01.08.2009, 10:43
| #3 |
| | Hilfe! Trojaner TR/Crypt.XPACK.Gen und TR/Dropper.Gen ...und weiter
__________________Code:
ATTFilter Name: lirsgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\lirsgt.sys
Address: 0xB67CB000 Size: 18048 File Visible: - Signed: -
Status: -
Name: mnmdd.SYS
Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS
Address: 0xF7BC6000 Size: 4224 File Visible: - Signed: -
Status: -
Name: Modem.SYS
Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS
Address: 0xF78DA000 Size: 30336 File Visible: - Signed: -
Status: -
Name: mouclass.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys
Address: 0xF79BA000 Size: 23552 File Visible: - Signed: -
Status: -
Name: mouhid.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mouhid.sys
Address: 0xB03C4000 Size: 12288 File Visible: - Signed: -
Status: -
Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xF7642000 Size: 42240 File Visible: - Signed: -
Status: -
Name: mrxdav.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mrxdav.sys
Address: 0xAD5F3000 Size: 179584 File Visible: - Signed: -
Status: -
Name: mrxsmb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
Address: 0xAF7A1000 Size: 453632 File Visible: - Signed: -
Status: -
Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xB70FD000 Size: 19072 File Visible: - Signed: -
Status: -
Name: msgpc.sys
Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys
Address: 0xF7762000 Size: 35072 File Visible: - Signed: -
Status: -
Name: mssmbios.sys
Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys
Address: 0xF61CC000 Size: 15488 File Visible: - Signed: -
Status: -
Name: Mup.sys
Image Path: Mup.sys
Address: 0xF7202000 Size: 104704 File Visible: - Signed: -
Status: -
Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xF7255000 Size: 182912 File Visible: - Signed: -
Status: -
Name: ndistapi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys
Address: 0xF61DC000 Size: 9600 File Visible: - Signed: -
Status: -
Name: ndisuio.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndisuio.sys
Address: 0xB46E8000 Size: 14592 File Visible: - Signed: -
Status: -
Name: ndiswan.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys
Address: 0xF5F80000 Size: 91776 File Visible: - Signed: -
Status: -
Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xF7782000 Size: 38016 File Visible: - Signed: -
Status: -
Name: netbios.sys
Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys
Address: 0xB084E000 Size: 34560 File Visible: - Signed: -
Status: -
Name: netbt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys
Address: 0xB5F97000 Size: 162816 File Visible: - Signed: -
Status: -
Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xB70F5000 Size: 30848 File Visible: - Signed: -
Status: -
Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xF7282000 Size: 574464 File Visible: - Signed: -
Status: -
Name: ntkrnlpa.exe
Image Path: C:\WINDOWS\system32\ntkrnlpa.exe
Address: 0x804D7000 Size: 2146304 File Visible: - Signed: -
Status: -
Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xB9A44000 Size: 2944 File Visible: - Signed: -
Status: -
Name: nvatabus.sys
Image Path: nvatabus.sys
Address: 0xF73AD000 Size: 93568 File Visible: - Signed: -
Status: -
Name: nvraid.sys
Image Path: nvraid.sys
Address: 0xF739A000 Size: 77056 File Visible: - Signed: -
Status: -
Name: ohci1394.sys
Image Path: ohci1394.sys
Address: 0xF7622000 Size: 61312 File Visible: - Signed: -
Status: -
Name: OPRGHDLR.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
Address: 0xF7BDB000 Size: 4096 File Visible: - Signed: -
Status: -
Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xF789A000 Size: 18688 File Visible: - Signed: -
Status: -
Name: pci.sys
Image Path: pci.sys
Address: 0xF74D1000 Size: 68224 File Visible: - Signed: -
Status: -
Name: pciide.sys
Image Path: pciide.sys
Address: 0xF7BDA000 Size: 3328 File Visible: - Signed: -
Status: -
Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
Address: 0xF7892000 Size: 28672 File Visible: - Signed: -
Status: -
Name: PDDSLADP.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\PDDSLADP.SYS
Address: 0xF61D0000 Size: 15488 File Visible: - Signed: -
Status: -
Name: PDDSLHND.sys
Image Path: PDDSLHND.sys
Address: 0xF7A32000 Size: 15104 File Visible: - Signed: -
Status: -
Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000 Size: 2146304 File Visible: - Signed: -
Status: -
Name: portcls.sys
Image Path: C:\WINDOWS\system32\drivers\portcls.sys
Address: 0xED4AC000 Size: 139264 File Visible: - Signed: -
Status: -
Name: psched.sys
Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys
Address: 0xF5F6F000 Size: 69120 File Visible: - Signed: -
Status: -
Name: ptilink.sys
Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys
Address: 0xF79CA000 Size: 17792 File Visible: - Signed: -
Status: -
Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xF7692000 Size: 35712 File Visible: - Signed: -
Status: -
Name: rasacd.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys
Address: 0xEB01C000 Size: 8832 File Visible: - Signed: -
Status: -
Name: rasl2tp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
Address: 0xF7732000 Size: 51328 File Visible: - Signed: -
Status: -
Name: raspppoe.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys
Address: 0xF7742000 Size: 41472 File Visible: - Signed: -
Status: -
Name: raspptp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys
Address: 0xF7752000 Size: 48384 File Visible: - Signed: -
Status: -
Name: raspti.sys
Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys
Address: 0xF79D2000 Size: 16512 File Visible: - Signed: -
Status: -
Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000 Size: 2146304 File Visible: - Signed: -
Status: -
Name: rdbss.sys
Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys
Address: 0xAF810000 Size: 174592 File Visible: - Signed: -
Status: -
Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xF7BC8000 Size: 4224 File Visible: - Signed: -
Status: -
Name: redbook.sys
Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys
Address: 0xF7722000 Size: 57600 File Visible: - Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xAC46B000 Size: 49152 File Visible: No Signed: -
Status: -
Name: RtkHDAud.sys
Image Path: C:\WINDOWS\system32\drivers\RtkHDAud.sys
Address: 0xED4CE000 Size: 4247552 File Visible: - Signed: -
Status: -
Name: Rtnicxp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys
Address: 0xF5FE9000 Size: 78720 File Visible: - Signed: -
Status: -
Name: SCSIPORT.SYS
Image Path: C:\WINDOWS\system32\drivers\SCSIPORT.SYS
Address: 0xF7382000 Size: 98304 File Visible: - Signed: -
Status: -
Name: secdrv.sys
Image Path: C:\WINDOWS\system32\DRIVERS\secdrv.sys
Address: 0xEB07C000 Size: 40960 File Visible: - Signed: -
Status: -
Name: sfdrv01.sys
Image Path: sfdrv01.sys
Address: 0xF721C000 Size: 73728 File Visible: - Signed: -
Status: -
Name: sfhlp02.sys
Image Path: sfhlp02.sys
Address: 0xF78AA000 Size: 32768 File Visible: - Signed: -
Status: -
Name: sfvfs02.sys
Image Path: sfvfs02.sys
Address: 0xF722E000 Size: 77824 File Visible: - Signed: -
Status: -
Name: SiSRaid2.sys
Image Path: SiSRaid2.sys
Address: 0xF78A2000 Size: 30976 File Visible: - Signed: -
Status: -
Name: smserial.sys
Image Path: C:\WINDOWS\system32\DRIVERS\smserial.sys
Address: 0xED8DB000 Size: 846720 File Visible: - Signed: -
Status: -
Name: sr.sys
Image Path: sr.sys
Address: 0xF7339000 Size: 73472 File Visible: - Signed: -
Status: -
Name: srescan.sys
Image Path: srescan.sys
Address: 0xF7241000 Size: 81920 File Visible: No Signed: -
Status: -
Name: srv.sys
Image Path: C:\WINDOWS\system32\DRIVERS\srv.sys
Address: 0xAD4E6000 Size: 333184 File Visible: - Signed: -
Status: -
Name: swenum.sys
Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys
Address: 0xF7B68000 Size: 4352 File Visible: - Signed: -
Status: -
Name: SynTP.sys
Image Path: C:\WINDOWS\system32\DRIVERS\SynTP.sys
Address: 0xF5FBA000 Size: 191168 File Visible: - Signed: -
Status: -
Name: sysaudio.sys
Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys
Address: 0xAD1C2000 Size: 60800 File Visible: - Signed: -
Status: -
Name: tcpip.sys
Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys
Address: 0xB5FBF000 Size: 360960 File Visible: - Signed: -
Status: -
Name: TDI.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS
Address: 0xF79C2000 Size: 20480 File Visible: - Signed: -
Status: -
Name: termdd.sys
Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys
Address: 0xF7772000 Size: 40704 File Visible: - Signed: -
Status: -
Name: update.sys
Image Path: C:\WINDOWS\system32\DRIVERS\update.sys
Address: 0xF5F16000 Size: 364160 File Visible: - Signed: -
Status: -
Name: USBD.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS
Address: 0xF7B66000 Size: 8192 File Visible: - Signed: -
Status: -
Name: usbehci.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys
Address: 0xF79AA000 Size: 27008 File Visible: - Signed: -
Status: -
Name: usbhub.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys
Address: 0xF5A8C000 Size: 57856 File Visible: - Signed: -
Status: -
Name: USBPORT.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS
Address: 0xF5FFD000 Size: 143360 File Visible: - Signed: -
Status: -
Name: USBSTOR.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
Address: 0xF793A000 Size: 26496 File Visible: - Signed: -
Status: -
Name: usbuhci.sys
Image Path: C:\WINDOWS\system32\DRIVERS\usbuhci.sys
Address: 0xF79A2000 Size: 20480 File Visible: - Signed: -
Status: -
Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xF7932000 Size: 20992 File Visible: - Signed: -
Status: -
Name: viamraid.sys
Image Path: viamraid.sys
Address: 0xF736B000 Size: 92672 File Visible: - Signed: -
Status: -
Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS
Address: 0xF6045000 Size: 81920 File Visible: - Signed: -
Status: -
Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xF7652000 Size: 53760 File Visible: - Signed: -
Status: -
Name: vsdatant.sys
Image Path: C:\WINDOWS\System32\vsdatant.sys
Address: 0xB5F37000 Size: 389344 File Visible: - Signed: -
Status: -
Name: wanarp.sys
Image Path: C:\WINDOWS\system32\DRIVERS\wanarp.sys
Address: 0xB085E000 Size: 34560 File Visible: - Signed: -
Status: -
Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xAFE41000 Size: 20480 File Visible: - Signed: -
Status: -
Name: wdmaud.sys
Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys
Address: 0xAD125000 Size: 82944 File Visible: - Signed: -
Status: -
Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -
Status: -
Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -
Status: -
Name: wmiacpi.sys
Image Path: C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
Address: 0xF7ADE000 Size: 8832 File Visible: - Signed: -
Status: -
Name: WMILIB.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS
Address: 0xF7B14000 Size: 8192 File Visible: - Signed: -
Status: -
Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000 Size: 2146304 File Visible: - Signed: -
Status: -
Name: WudfPf.sys
Image Path: WudfPf.sys
Address: 0xF730F000 Size: 77568 File Visible: - Signed: -
Status: -
|
|
| Themen zu Hilfe! Trojaner TR/Crypt.XPACK.Gen und TR/Dropper.Gen |
| .dll, antivir, avira, computer, dateien, einstellungen, explorer, externe festplatte, festplatte, frage, hijack.system.hidden, logfile, malwarebytes, microsoft, namen, ordner, registrierungsschlüssel, security.hijack, software, spyware.onlinegames, system32, temp, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/dropper.gen, trojan.agent, trojan.backdoor, trojaner, trojaner tr/crypt.xpack.gen, userinit.exe, versteckte dateien, windows, zu lang |
Hybrid-Darstellung
