| |
| |||||||
Log-Analyse und Auswertung: trojaner, erfolgreich entfernt?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
10.01.2010, 17:43
| #1 |
| |  trojaner, erfolgreich entfernt? Was für ein Akt, nach zahlreichen Abstürzen endlich geschafft: Code:
ATTFilter GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-10 17:13:43
Windows 5.1.2600 Service Pack 3
Running: z241bt09.exe; Driver: C:\DOKUME~1\PCUSER~1\LOKALE~1\Temp\agpdafog.sys
---- System - GMER 1.0.15 ----
SSDT F7BF6D16 ZwCreateKey
SSDT F7BF6D0C ZwCreateThread
SSDT F7BF6D1B ZwDeleteKey
SSDT F7BF6D25 ZwDeleteValueKey
SSDT spdr.sys ZwEnumerateKey [0xF73DBCA2]
SSDT spdr.sys ZwEnumerateValueKey [0xF73DC030]
SSDT F7BF6D2A ZwLoadKey
SSDT spdr.sys ZwOpenKey [0xF73BD0C0]
SSDT F7BF6CF8 ZwOpenProcess
SSDT F7BF6CFD ZwOpenThread
SSDT spdr.sys ZwQueryKey [0xF73DC108]
SSDT spdr.sys ZwQueryValueKey [0xF73DBF88]
SSDT F7BF6D34 ZwReplaceKey
SSDT F7BF6D2F ZwRestoreKey
SSDT F7BF6D20 ZwSetValueKey
SSDT F7BF6D07 ZwTerminateProcess
INT 0x62 ? 86567BF8
INT 0x82 ? 86567BF8
INT 0x84 ? 865D7BF8
INT 0x94 ? 865D7BF8
INT 0xA4 ? 865D7BF8
---- Kernel code sections - GMER 1.0.15 ----
? spdr.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F610A8AC 5 Bytes JMP 865D71D8
.text ac6sjq4q.SYS F5FF0386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text ac6sjq4q.SYS F5FF03AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text ac6sjq4q.SYS F5FF03C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text ac6sjq4q.SYS F5FF03C9 1 Byte [2E]
.text ac6sjq4q.SYS F5FF03C9 11 Bytes [2E, 00, 00, 00, 5A, 02, 00, ...]
.text ...
.reloc C:\WINDOWS\system32\drivers\acedrv11.sys section is executable [0xA9BFC300, 0x25D4C, 0xE0000060]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xA9B75300, 0x3B6D8, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xF799D300, 0x1BEE, 0xE8000020]
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F73BE040] spdr.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F73BE13C] spdr.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F73BE0BE] spdr.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F73BE7FC] spdr.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F73BE6D2] spdr.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F73CE048] spdr.sys
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!KfAcquireSpinLock] C0840CEC
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!READ_PORT_UCHAR] 053C0D74
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!KeGetCurrentIrql] 57B80974
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!KfRaiseIrql] 8B000000
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!KfLowerIrql] 56C35DE5
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!HalGetInterruptVector] 8D08758B
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!HalTranslateBusAddress] 8D51FC4D
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!KeStallExecutionProcessor] 8D52FD55
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!KfReleaseSpinLock] 8D51FE4D
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 8D52FF55
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!READ_PORT_USHORT] 8D51F84D
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 5052F455
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[HAL.dll!WRITE_PORT_UCHAR] EACAE856
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[WMILIB.SYS!WmiSystemControl] 0FC08520
IAT \SystemRoot\System32\Drivers\ac6sjq4q.SYS[WMILIB.SYS!WmiCompleteRequest] 0001B185
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 865D61F8
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
Device \Driver\NetBT \Device\NetBT_Tcpip_{59C75092-A6FE-42DB-89B8-A6D73B0E3834} 848D11F8
Device \Driver\usbuhci \Device\USBPDO-0 863851F8
Device \Driver\PCI_PNP8414 \Device\00000051 spdr.sys
Device \Driver\PCI_PNP8414 \Device\00000051 spdr.sys
Device \Driver\dmio \Device\DmControl\DmIoDaemon 865D81F8
Device \Driver\dmio \Device\DmControl\DmConfig 865D81F8
Device \Driver\dmio \Device\DmControl\DmPnP 865D81F8
Device \Driver\dmio \Device\DmControl\DmInfo 865D81F8
Device \Driver\usbuhci \Device\USBPDO-1 863851F8
Device \Driver\usbuhci \Device\USBPDO-2 863851F8
Device \Driver\sptd \Device\1745023414 spdr.sys
Device \Driver\usbuhci \Device\USBPDO-3 863851F8
Device \Driver\usbehci \Device\USBPDO-4 863571F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 865681F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 865681F8
Device \Driver\Cdrom \Device\CdRom0 862CA1F8
Device \Driver\Cdrom \Device\CdRom1 862CA1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F7310B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [F7310B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [F7310B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F7310B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Ftdisk \Device\HarddiskVolume3 865681F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 848D11F8
Device \Driver\NetBT \Device\NetbiosSmb 848D11F8
Device \Driver\usbuhci \Device\USBFDO-0 863851F8
Device \Driver\usbuhci \Device\USBFDO-1 863851F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 848CA1F8
Device \Driver\usbuhci \Device\USBFDO-2 863851F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 848CA1F8
Device \Driver\usbuhci \Device\USBFDO-3 863851F8
Device \Driver\usbehci \Device\USBFDO-4 863571F8
Device \Driver\Ftdisk \Device\FtControl 865681F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{00EBD39A-85D8-44AE-96CE-4EFEFB9E4F2E} 848D11F8
Device \Driver\ac6sjq4q \Device\Scsi\ac6sjq4q1 862C91F8
Device \Driver\ac6sjq4q \Device\Scsi\ac6sjq4q1Port2Path0Target0Lun0 862C91F8
Device \FileSystem\Fastfat \Fat 845C91F8
Device \FileSystem\Fastfat \Fat A8E3C297
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 8483F500
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF2 0x10 0x71 0x0A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xEC 0x57 0x09 0xFF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC3 0xEF 0x81 0x6B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF2 0x10 0x71 0x0A ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xEC 0x57 0x09 0xFF ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC3 0xEF 0x81 0x6B ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF2 0x10 0x71 0x0A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xEC 0x57 0x09 0xFF ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC3 0xEF 0x81 0x6B ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xF2 0x10 0x71 0x0A ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xEC 0x57 0x09 0xFF ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC3 0xEF 0x81 0x6B ...
---- EOF - GMER 1.0.15 ----
|
|
| Themen zu trojaner, erfolgreich entfernt? |
| 1.exe, anti malware, antivir, antivir guard, avira, bho, c:\windows\temp, desktop, entfernt?, excel, firefox, frage, google, gupdate, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, limewire, malware, monitor, mozilla, programm, registry, scan, software, sweetim, system, toolbars, trojaner, uleadburninghelper, windows, windows xp, windows\temp |
Hybrid-Darstellung
