Google Suchergebnisse ohne Umlaute und z.T. falsche Linkweiterleitung

superfury

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-02 17:56:44
Windows 6.0.6002 Service Pack 2
Running: hz3xm3i8.exe; Driver: C:\Users\SUPERF~1\AppData\Local\Temp\uwriauob.sys


---- System - GMER 1.0.15 ----

SSDT 8719E960 ZwAlertResumeThread
SSDT 8719EA40 ZwAlertThread
SSDT 871980C0 ZwAllocateVirtualMemory
SSDT 870D3370 ZwAlpcConnectPort
SSDT 8719FD58 ZwCreateMutant
SSDT 871983B0 ZwCreateThread
SSDT 8719DFB0 ZwDebugActiveProcess
SSDT 8719A328 ZwFreeVirtualMemory
SSDT 8719FE48 ZwImpersonateAnonymousToken
SSDT 8719FF28 ZwImpersonateThread
SSDT 8719A228 ZwMapViewOfSection
SSDT 8719FC78 ZwOpenEvent
SSDT 87198190 ZwOpenProcessToken
SSDT 8719FAB8 ZwOpenSection
SSDT 8719EF18 ZwOpenThreadToken
SSDT 871975B8 ZwResumeThread
SSDT 8719EE38 ZwSetContextThread
SSDT 8719A058 ZwSetInformationProcess
SSDT 8719ED48 ZwSetInformationThread
SSDT 8719FB98 ZwSuspendProcess
SSDT 8719EB88 ZwSuspendThread
SSDT 8719AC18 ZwTerminateProcess
SSDT 8719EC68 ZwTerminateThread
SSDT 8719A148 ZwUnmapViewOfSection
SSDT 8719A418 ZwWriteVirtualMemory

INT 0x51 ? 84888BF8
INT 0x52 ? 86514BF8
INT 0x62 ? 86514BF8
INT 0x62 ? 86514BF8
INT 0x72 ? 86514BF8
INT 0xA2 ? 84888BF8
INT 0xB2 ? 84888BF8
INT 0xB3 ? 86514BF8

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 11D 824BF860 8 Bytes JMP 6C8C7F7E
.text ntkrnlpa.exe!KeSetEvent + 131 824BF874 4 Bytes [C0, 80, 19, 87]
.text ntkrnlpa.exe!KeSetEvent + 13D 824BF880 4 Bytes [70, 33, 0D, 87]
.text ntkrnlpa.exe!KeSetEvent + 1F5 824BF938 4 Bytes [58, FD, 19, 87]
.text ntkrnlpa.exe!KeSetEvent + 221 824BF964 4 Bytes [B0, 83, 19, 87]
.text ...
? System32\Drivers\sppw.sys Das System kann den angegebenen Pfad nicht finden. !
.text USBPORT.SYS!DllUnload 8E91541B 5 Bytes JMP 865141D8
.text awmtmfz3.SYS 88380000 22 Bytes [82, 33, 7D, 82, 6C, 32, 7D, ...]
.text awmtmfz3.SYS 88380017 159 Bytes [00, 32, F7, 70, 80, 3D, F5, ...]
.text awmtmfz3.SYS 883800B7 22 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text awmtmfz3.SYS 883800CE 80 Bytes [00, 00, 26, 00, 00, 00, E0, ...]
.text awmtmfz3.SYS 8838011F 194 Bytes [7E, 38, 40, 39, 82, 3B, C4, ...]
.text ...

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [806096D2] \SystemRoot\System32\Drivers\sppw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [80609040] \SystemRoot\System32\Drivers\sppw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [806097FC] \SystemRoot\System32\Drivers\sppw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [806090BE] \SystemRoot\System32\Drivers\sppw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8060913C] \SystemRoot\System32\Drivers\sppw.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [80618D92] \SystemRoot\System32\Drivers\sppw.sys
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortNotification] F73BFF33
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortWritePortUchar] B85F0B75
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortWritePortUlong] FFFFFFFE
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 08C25D5E
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 5D8B5300
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortGetScatterGatherList] 74DF3B0C
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortReadPortUchar] 01FB8311
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortStallExecution] 5F5B0C74
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortGetParentBusType] FFFFFEB8
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortRequestCallback] C25D5EFF
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 7E390008
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortGetUnCachedExtension] C7077524
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortCompleteRequest] E1642446
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortMoveMemory] 7E398838
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] C7077528
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] E1902846
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 468B8838
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortReadPortUshort] 244E8B2C
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 7468016A
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortInitialize] 500000FA
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortGetDeviceBase] C73BD1FF
IAT \SystemRoot\System32\Drivers\awmtmfz3.SYS[ataport.SYS!AtaPortDeviceStateChange] 5F5B0C75

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 856281F8
Device \Driver\volmgr \Device\VolMgrControl 856251F8
Device \Driver\usbohci \Device\USBPDO-0 865331F8
Device \Driver\usbohci \Device\USBPDO-1 865331F8
Device \Driver\usbohci \Device\USBPDO-2 865331F8
Device \Driver\usbohci \Device\USBPDO-3 865331F8
Device \Driver\usbohci \Device\USBPDO-4 865331F8
Device \Driver\netbt \Device\NetBT_Tcpip_{DC0FF27C-D9B2-4839-B295-7762D761235C} 8716B1F8

AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\usbehci \Device\USBPDO-5 865301F8
Device \Driver\volmgr \Device\HarddiskVolume1 856251F8
Device \Driver\volmgr \Device\HarddiskVolume2 856251F8
Device \Driver\cdrom \Device\CdRom0 865E7500
Device \Driver\PCI_PNP3566 \Device\00000059 sppw.sys
Device \Driver\sptd \Device\3917197575 sppw.sys
Device \Driver\volmgr \Device\HarddiskVolume3 856251F8
Device \Driver\cdrom \Device\CdRom1 865E7500
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 856271F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-3 856271F8
Device \Driver\atapi \Device\Ide\IdePort0 856271F8
Device \Driver\atapi \Device\Ide\IdePort1 856271F8
Device \Driver\atapi \Device\Ide\IdePort2 856271F8
Device \Driver\atapi \Device\Ide\IdePort3 856271F8
Device \Driver\netbt \Device\NetBt_Wins_Export 8716B1F8
Device \Driver\Smb \Device\NetbiosSmb 871691F8
Device \Driver\netbt \Device\NetBT_Tcpip_{C596B1B6-ECCA-4576-B6B7-7F40A73B8619} 8716B1F8
Device \Driver\iScsiPrt \Device\RaidPort0 865FC1F8

AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\usbohci \Device\USBFDO-0 865331F8
Device \Driver\usbohci \Device\USBFDO-1 865331F8
Device \Driver\usbohci \Device\USBFDO-2 865331F8
Device \Driver\usbohci \Device\USBFDO-3 865331F8
Device \Driver\usbohci \Device\USBFDO-4 865331F8
Device \Driver\usbehci \Device\USBFDO-5 865301F8
Device \Driver\awmtmfz3 \Device\Scsi\awmtmfz31Port5Path0Target0Lun0 865A01F8
Device \Driver\awmtmfz3 \Device\Scsi\awmtmfz31 865A01F8
Device \FileSystem\cdfs \Cdfs AAFB11F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA3 0xE2 0x06 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x95 0xBA 0x48 0xD9 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x75 0x6D 0xA8 0x8A ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA3 0xE2 0x06 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x95 0xBA 0x48 0xD9 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x75 0x6D 0xA8 0x8A ...

---- EOF - GMER 1.0.15 ----
Gruss
Eddie