| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Dropper.GENWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
20.03.2010, 14:50
| #5 |
| |  TR/Dropper.GEN Hier die GMER Log Datei. Eine Sache ist mir noch aufgefallen, von dem ich nicht weiss, ob es von Bedeutung ist: Die AVIRA Warnung und die zufälligen Ordner werden nur dann kreiert, wenn ich online bin. Gestern auf der Bahnfahrt wwar ich 2 1/2 Stunden mit dem Rechner beschäftigt, allerdings offline, und es gab weder eine Warnung noch sonst irgendeine Auffälligkeit. Ich hoffe wir habens jetzt bald eingekreist, und bedanke mich schon mal jetzt für Eure Hilfe. Matthias GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-03-20 14:43:44 Windows 6.0.6002 Service Pack 2 Running: ekpipezg.exe; Driver: C:\Users\Matthias\AppData\Local\Temp\fxlyqkow.sys ---- System - GMER 1.0.15 ---- SSDT 8D76631C ZwCreateThread SSDT 8D766308 ZwOpenProcess SSDT 8D76630D ZwOpenThread SSDT 8D766317 ZwTerminateProcess ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!KeSetEvent + 221 81EBC984 4 Bytes [1C, 63, 76, 8D] {SBB AL, 0x63; JBE 0xffffffffffffff91} .text ntkrnlpa.exe!KeSetEvent + 3F1 81EBCB54 4 Bytes [08, 63, 76, 8D] .text ntkrnlpa.exe!KeSetEvent + 40D 81EBCB70 4 Bytes [0D, 63, 76, 8D] .text ntkrnlpa.exe!KeSetEvent + 621 81EBCD84 4 Bytes [17, 63, 76, 8D] {POP SS; ARPL [ESI-0x73], SI} .rsrc C:\Windows\system32\drivers\atapi.sys entry point in ".rsrc" section [0x828D7014] .text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8E406340, 0x3E9407, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\Windows\system32\svchost.exe[1116] ntdll.dll!NtProtectVirtualMemory 77384D34 5 Bytes JMP 0027000A .text C:\Windows\system32\svchost.exe[1116] ntdll.dll!NtWriteVirtualMemory 77385674 5 Bytes JMP 0028000A .text C:\Windows\system32\svchost.exe[1116] ntdll.dll!KiUserExceptionDispatcher 77385DC8 5 Bytes JMP 0026000A .text C:\Windows\system32\svchost.exe[1116] ole32.dll!CoCreateInstance 75A79EA6 5 Bytes JMP 0132000A .text C:\Windows\system32\svchost.exe[1116] USER32.dll!GetCursorPos 75D20B88 5 Bytes JMP 0133000A .text C:\Program Files\Mozilla Firefox\firefox.exe[1164] ntdll.dll!NtProtectVirtualMemory 77384D34 5 Bytes JMP 008D000A .text C:\Program Files\Mozilla Firefox\firefox.exe[1164] ntdll.dll!NtWriteVirtualMemory 77385674 5 Bytes JMP 008E000A .text C:\Program Files\Mozilla Firefox\firefox.exe[1164] ntdll.dll!KiUserExceptionDispatcher 77385DC8 5 Bytes JMP 0040000A .text C:\Windows\Explorer.EXE[1936] ntdll.dll!NtProtectVirtualMemory 77384D34 5 Bytes JMP 0033000A .text C:\Windows\Explorer.EXE[1936] ntdll.dll!NtWriteVirtualMemory 77385674 5 Bytes JMP 0034000A .text C:\Windows\Explorer.EXE[1936] ntdll.dll!KiUserExceptionDispatcher 77385DC8 5 Bytes JMP 0032000A ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[264] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01542F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[264] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [01542D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[264] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01542CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[264] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01542CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74357817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [743AA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7435BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7434F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [743575E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7434E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74388395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7435DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7434FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7434FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [743471CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [743DCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7437C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7434D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74346853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7434687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1936] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74352AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2960] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2960] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [003B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2960] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2960] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Users\Matthias\Downloads\ekpipezg.exe[3436] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [001D2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Users\Matthias\Downloads\ekpipezg.exe[3436] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [001D2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Users\Matthias\Downloads\ekpipezg.exe[3436] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [001D2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) IAT C:\Users\Matthias\Downloads\ekpipezg.exe[3436] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [001D2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation) AttachedDevice \Driver\tdx \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB) Device -> \Driver\atapi \Device\Harddisk0\DR0 85F5BCA1 ---- Files - GMER 1.0.15 ---- File C:\Windows\system32\drivers\atapi.sys suspicious modification ---- EOF - GMER 1.0.15 ---- |
Baum-Darstellung